Last reviewed 31 October 2026
The gap a freeze doesn't cover
A credit freeze stops new accounts from being opened in your name. It does nothing about the cards already in your wallet — and card numbers leak constantly: a breached store database, a skimmed gas pump, an old receipt, a phishing page that looked right. When (not if) a number gets out, the only question is how much damage it can do before you notice.
Spending limits and alerts are how you shrink that window. Fifteen minutes in your card apps, once, and a stolen number goes from an open drain to a capped, noisy problem that announces itself immediately.
The three settings, in order
1. An alert on every transaction. This is the foundation — turn it on for every card, at the lowest threshold the app allows (ideally every purchase, any amount). Fraud often starts with a tiny test charge, sometimes under a dollar, to see if a number is live. An alert on every transaction means you see the test, not just the spree.
2. A spending limit just above your real life. Where your issuer offers a card-level spending limit, set it slightly above your normal monthly spending on that card — enough headroom that your own life never trips it, low enough that a thief hits the ceiling fast. A card that normally carries $800 a month doesn't need a $10,000 runway.
3. Lock the cards you rarely use. The old store card, the backup card in a drawer, the one from a promotion three years ago — if a card's whole job is “someday,” keep it locked in the app and unlock it on the rare day you use it. A locked card that gets leaked is a non-event.
When a card has no limit option
Not every issuer offers true spending limits. Don't let that stall the step — use what's available, in this order of value:
- Transaction alerts (above) — the single highest-value setting, and nearly universal.
- Category and merchant controls — some apps let you block online purchases, international charges, or specific categories per card. Block what that card never legitimately does.
- A lock toggle — if the card is secondary, keep it locked by default.
- Virtual card numbers — several issuers and browsers can generate a separate number for online shopping, so the number stored at a hundred websites isn't the one on your physical card. If the virtual number leaks, you delete it, not your card.
Make one card the online card
A simple structure that works for most families: one card is the designated online/subscription card — the only number stored at stores, streaming services, and apps — with alerts on and a modest limit. Everything else stays out of websites entirely. Then a breach anywhere has exactly one throat to choke, and reissuing one card doesn't mean updating your number at forty merchants while a storm is coming.
The storm connection
Card fraud during an evacuation is a special kind of bad: you're spending more, in unfamiliar places, under stress, and not reading statements. Limits and alerts are the controls that work while you're not watching — which is precisely the condition preparedness exists for. Set them on a quiet day.
Sources: Federal Trade Commission — consumer.ftc.gov (credit card fraud and account alerts) · Your card issuers' apps (limit, lock, and alert settings vary by issuer)