I got that e-mail from Target about my credit card; now what do I do?

I’m getting this question a lot, and I know most people are in a big hurry, so I’ll give you a short answer and a long answer.

Short answer: Take Target’s offer. It’s a valuable service and it’s free, particularly given the ever-expanding web of victims in this hacker attack. But do it carefully, and don’t pay for your credit score when you get there.

Here are specific, longer instructions.

1. Go to your address bar of your browser and manually type CreditMonitoring.Target.Com (that is, DON’T click on any links in the e-mail, explanation later. Go to the site MANUALLY). Fill out your name and e-mail address there.

2. Obtain the redemption code Target sends you via a second e-mail. Copy it to your computer clipboard. NOTE: I’ve heard multiple reports that this email is landing in people’s junk/spam folder. Look there! And Google, please let these emails into folks’ regular Gmail inboxes…

3. Manually type ProtectMyID.com/target into your browser’s address bar, bringing you to Experian’s website for Target victims. Paste the redemption code into the correct box. Fill out the other identifying information, including (gulp!) your Social Security Number. Yup, as long as you manually travel to the site, it’s OK, and you have to do it to get the free, valuable credit monitoring service. You’ll also have to answer those annoying out-of-wallet question like, “Which of these companies holds your mortgage?”

4. Once you are authenticated, look at your credit report and check for errors. Repeat every month or so, for free! Set up free text alerts so you are notified if someone opens credit in your name, for free!

5. DON’T fall for the upsell and pay to get your credit score. It’s really a shame that Experian is using this mess as a marketing opportunity, but you don’t have to fall for it.

LONGER ANSWER

I know, when you are already worried that someone has stolen your personal information, the last thing you want to do is hand out more personal information, particularly to a website you’ve never heard of before. Good. I’m glad you have that healthy skepticism. But the way Experian authenticates you requires that you hand over the data, and it’s a good thing they ask. We wouldn’t want Experian making it easy for criminals to sign up as you and get access to your credit report.

The key, of course, is making sure you really are responding to Target’s offer, and really do land on Experian’s site, when filling out the information. I believe we will see an avalanche of fake e-mails masquerading as offers from Target, Experian, or others claiming to have information about the Target situation. That’s why I want you to MANUALLY direct your web browser at these websites. By the way, the Target mea culpa emails correctly don’t include links to the sites you are supposed to visit (good on them). So one way to pick a fake from a real is the fakes will have links, the real emails won’t.

Why should you take up Target on its offer? Because it’s good to check your credit report often, and it’s great to do it for free. If you’ve never had monitoring, you will learn about how your credit report works, and that’s a good thing. While you can get a free copy of your report every year from AnnualCreditReport.com, most Americans don’t bother, so this is a great opportunity.

The alert system works well, too. It’s dumb that people pay $10 or $20 a month for that service. Because of the seemingly never-ending data breaches that result in free monitoring offers, I’ve never had to pay for it. I just wait my turn. If this is your turn, take it.

For more on how these Target emails are confusing consumers, see this blog entry from security firm Sophos. Basically, Sophos is worried that some customers will be tricked into calling the wrong customer support phone number and give up personal information that way. I think they are being a little hard on Target there, but in this environment, it’s smart to have your Spidey sense turned up very high.

Who’s entitled to Target’s offer? Everyone, I think.

Target does not appear to be limiting sign-ups in any way. They aren’t verifying you are a Target victim before giving you a code to get the service, for example. Sure looks to me like anyone can sign up, though they clearly aren’t advertising that. I’ll leave it to you to decide if you want to wait around before getting an invite from Target to sign up, or if you think it’s somehow not right to take their offer even if you might not be a victim. Before you decide, however, consider this: We already know that some people who say they’ve never shopped at Target are getting e-mail invites, suggesting that non-Target customers might be caught up in this anyway. To me, that means it’s fair for you to take their free offer, unless and until the can somehow definitively prove you aren’t a victim.

Previous coverage:

Sign up for Bob Sullivan’s free newsletter and always get good advice in these situations.