Nearly half of all Americans may have had their personal data exposed in the Equifax data breach. Now what?

It’s time to consider what to do to protect your identity, your money and your credit.

You could place a fraud alert on your credit reports. It’s a free way to bolster your personal information security.

But freezing your credit is the more robust — and more complicated — option.

Granted, this is a dramatic step. It is the Fort Knox of options, although given that criminals might have your name, Social Security number, date of birth and address, as well as your driver’s license and credit card numbers, that type of fortress is exactly what you should crave.

Freezing your credit restricts who can see your credit report. The government can still see it, but creditors deciding whether to open a new account in your name cannot. Most reputable lenders won’t open a credit card or issue a loan without first pulling your credit. This is how a freeze protects you.

Getting started

You’ll need to ask for a freeze at each of the three credit bureaus — Equifax, Experian and TransUnion — separately. You can do so online. The bureaus will ask for information like your name, date of birth, Social Security number and current and past addresses. The bureaus may ask for other identifying information as well, including a copy of a government-issued ID or utility bill.

The credit bureaus typically charge you to freeze your credit unless you are an identity theft victim who has filed a police report or other official documents required by your state. The fee you’ll pay depends on the state in which you live, but it’s generally between $5 and $10 per bureau. You can find each state’s rules here.

Equifax says it will waive the fee through Nov. 21 for people who want to freeze their credit. The company also says it will refund any consumers who paid for a freeze in the days immediately following disclosure of the breach.

As part of the freeze, you’ll receive a PIN that you’ll need when it comes time to unfreeze your account. You may have to pay an additional fee to either temporarily or permanently lift the freeze.

The Equifax offer

Equifax is offering all U.S. consumers a free year’s subscription to its TrustedID Premier service, which includes a credit report lock function. However, by accepting the service, you have to agree to settle any dispute through arbitration. (The company said the arbitration clause does not apply to the “cybersecurity incident” itself.)

There is an opt-out provision, which allows you to get out of the arbitration requirement by notifying Equifax in writing within 30 days of adding the service.

The Equifax offer leaves gaps in your protection, as well, as the other bureaus are not required to lock down their versions of your credit report. TrustedID also will provide free credit-monitoring at all three bureaus, but that too leaves you vulnerable,  as credit monitoring only detects identity theft after the fact.

Why not freeze?

The downside of a credit freeze is the ability to do things quickly. If you want to buy a car or take out a mortgage, you’ll have to unfreeze your credit. That can be time-consuming. It could also cost you about $30 every time.

Anything involving your reports may become a hassle, as well. You would have to lift the freeze to allow a background check by a prospective employer or to apply for insurance, for example.

What’s more, a credit freeze isn’t a guarantee you won’t become an identity theft victim and it doesn’t protect you against fraud committed using accounts you already have open. That’s a danger for people who had their credit card numbers taken in the Equifax breach.

Those victims will have to monitor their credit card statements closely for signs of fraud.

Other options

If a credit freeze just seems like too drastic of a step for you, a fraud alert is another option.

In that case, creditors must obtain your permission before getting access to your report. Fraud alerts last 90 days, although you are able to renew it. You typically only need to contact one of the bureaus to set them up at all three, but verify the bureau will report the update with others.