Three tools sound like the same thing and are not: a credit freeze, a fraud alert, and a credit lock. Two of them come from federal law and are free forever. The third is a product a company sells you, sometimes bundled with a subscription, and it carries none of the same guarantees.
If you open cards for welcome bonuses, you have a specific version of this problem. The thing that protects you best is also the thing that gets in your way most, and the answer is not to skip it. The answer is to know how to work it.
The credit freeze
A freeze locks your credit file so that no new lender can pull it. Since a lender will not extend credit without a pull, a frozen file means nobody can open an account in your name, including you.
Since September 21, 2018, federal law has made freezing and unfreezing free at all three nationwide bureaus. Before that, some states let bureaus charge for it. The Economic Growth, Regulatory Relief, and Consumer Protection Act ended that nationwide.
A few things people get wrong about freezes.
It does not affect your credit score. Not by a point. The freeze controls who may look at the file, not what is in it.
It does not stop your existing accounts. Cards you already hold keep working, keep reporting, and keep earning. Your issuer can still review your account.
You have to do it three times. Equifax, Experian and TransUnion each maintain their own file, and each freeze is separate. Freezing one and assuming you are covered is the most common mistake here.
Lifting is fast. All three offer a temporary lift, usually effective within an hour online and often within minutes. You can lift for a set window or lift for a single creditor.
The fraud alert
A fraud alert does something weaker and less disruptive. It flags your file so that a lender is required to take reasonable steps to verify your identity before extending credit. It does not block the pull.
Three kinds exist.
Initial fraud alert. Free, and lasts one year. It used to last 90 days; the same 2018 law extended it. You only have to contact one bureau, and that bureau is required to tell the other two.
Extended fraud alert. Seven years, free, and available to people who have filed an identity theft report. This is the one for someone who has actually been hit.
Active duty alert. One year, for deployed servicemembers, and it also removes you from prescreened offer lists for two years.
The one-bureau rule is the practical advantage. A fraud alert takes one phone call or one form. A freeze takes three.
The credit lock
A credit lock does roughly what a freeze does, through an app, usually instantly.
It is not the same thing. A freeze is a statutory right with a defined process and defined obligations on the bureau. A lock is a contract between you and that company, governed by terms they wrote and can change.
Some locks are free. Some are bundled into paid credit monitoring, which is the part worth noticing, because you are being sold access to something the law already gives you at no cost.
Locks are genuinely more convenient, and the convenience is real if you toggle often. But if you are choosing one thing to have in place, choose the freeze. The rights behind it do not depend on a subscription staying current.
Which one to use
Freeze, in almost every case. It is free, it is permanent until you lift it, and it is the only one of the three that actually stops a new account being opened. The cost is friction, and the friction is manageable.
Fraud alert if you want a lighter touch, or as a stopgap the day you learn about a breach and have not had time to freeze all three.
Extended fraud alert if you are an actual identity theft victim, because seven years is a long time and you will not want to think about it again.
You can have a freeze and a fraud alert at the same time, and after a breach that is a reasonable posture.
The part that matters for card applications
Here is where it stops being generic advice.
A frozen file means a declined application, and often an odd, unhelpful decline message rather than a clear one. If you are planning an application, you have to lift the freeze at the bureau that issuer will pull, before you apply.
Issuers do not pull all three. Which bureau you get depends on the issuer and often on your state, and it changes. Some cardholder communities track it closely, and that is the practical source, because no issuer publishes a table.
Three ways to handle it.
- Lift all three for a short window. Simplest and safest. Set a two or three day window covering the application, then let them refreeze automatically.
- Lift only the bureau you expect to be pulled. Faster to redo, and it leaves two thirds of your protection in place. If you guess wrong, you get a decline and lift the right one.
- Reconsider by phone after a freeze decline. A frozen-file decline is usually reversible. Lift the freeze, call the reconsideration line, and ask them to re-pull.
The mistake to avoid is leaving all three permanently thawed because applications are easier that way. That is trading a durable protection for a few minutes of convenience a handful of times a year.
How to actually place one
The process is the same shape at all three and takes about ten minutes each.
You go to the bureau's freeze page, create an account or verify as a one-off, and answer identity questions drawn from your own credit history. Those questions are specific, and they are drawn from records you may not remember well, such as the original amount of a car loan from 2019 or a previous street address. If you fail them online, every bureau has a mail-in route that requires copies of identification and takes a couple of weeks.
Two pieces of housekeeping that people skip and later regret.
Record how you get back in. Equifax and Experian use account logins. TransUnion has historically used a PIN. Whichever it is, put it wherever you keep passwords, because the day you need it is the day you are mid-application.
Do it for your spouse and your children too. The same 2018 law gave parents and guardians the right to freeze a child's file for free, and to have one created for the purpose if none exists. Child identity theft is unusually damaging precisely because nobody checks a seven-year-old's credit report, so it runs for a decade before anyone notices.
If it has already happened to you
A freeze is prevention. If someone has already opened accounts in your name, the order of operations is different.
Start at IdentityTheft.gov. It is the FTC's official site, it is free, and it generates a personal recovery plan plus the FTC Identity Theft Report you will need. Several of the rights that follow, including the seven-year extended fraud alert and the right to have fraudulent information blocked from your report, require that report to exist.
Then freeze all three, so nothing further can be opened while you clean up.
Then dispute each fraudulent account with both the bureau and the company that furnished it. Doing only the bureau half is the most common reason a disputed item comes back a few months later. The furnisher is the source; if it keeps reporting the account, the bureau will keep listing it.
Then keep a file. Dates, names, reference numbers, and copies of everything you send. Recovery is a paperwork exercise more than anything else, and the paperwork is what settles disagreements later.
The FCRA gives the bureaus 30 days to investigate a dispute, and requires them to tell you the outcome in writing. That clock is real and worth invoking by name if you are being stalled.
Freeze the bureaus nobody mentions
The big three are not the only agencies holding a file on you.
NCTUE holds telecom, pay TV and utility account history, and some issuers use it. Innovis is a fourth national credit bureau. ChexSystems covers bank account applications rather than credit, and freezing it stops someone opening a checking account in your name. LexisNexis Risk Solutions is a specialty agency used in various underwriting decisions, and it also owns SageStream, a consumer reporting company some card issuers pull. They are listed separately by the CFPB, but requests for both reports and both freezes are handled through the LexisNexis consumer disclosure centre, so one visit covers them.
All of them offer free freezes. Freezing them takes an afternoon once and then never needs thinking about. If you are doing this properly rather than performatively, do these too.
What a freeze actually costs someone who opens cards
Worth doing the arithmetic rather than hand-waving at it, because the objection is usually vague.
Suppose you open six cards a year, which is a fairly aggressive pace. Each application needs one lift. A lift is a login, two clicks and a date range, so call it three minutes. If you lift all three bureaus every time rather than guessing, call it nine minutes.
Six applications a year at nine minutes is under an hour, annually. That is the entire cost.
Against that, the thing you are buying is the only mechanism that stops somebody opening an account in your name, at any bureau, at any lender, without your involvement. There is no version of that trade where the hour wins.
The reason people still skip it is not the hour. It is that the friction lands at the exact moment you are excited about a bonus, and the protection is invisible the rest of the time. That is a psychology problem, not a cost problem, and the fix is to make lifting part of your application routine rather than an obstacle you meet by surprise.
Monitoring is not protection
Credit monitoring tells you after something has happened. A freeze stops it happening. Those are different products solving different problems, and the marketing tends to blur them.
Free monitoring is genuinely useful as a tripwire, and several card issuers and banks include it at no cost. Paid monitoring bundled with a lock is where the value gets thin, because the lock duplicates a free statutory right and the monitoring duplicates something your bank probably already gives you.
Read what you are paying for. If the answer is mostly a lock, you are paying for a freeze.
What a freeze does not cover
Prescreened credit offers. Those come from a separate list. Opt out at OptOutPrescreen.com, which is the official site run by the bureaus, for five years or permanently.
Existing account fraud. If someone gets your card number, a freeze does nothing. That is a chargeback problem, and our guide to disputing credit card charges covers the process.
Tax refund and government benefit fraud. Different systems entirely. The IRS Identity Protection PIN is the equivalent tool there.
Account takeover. If someone gets into your existing account, the freeze is irrelevant. Two-factor authentication is the control that matters.
Doing it this week
Freeze all three bureaus. Each one takes about ten minutes online and requires identity verification. Save the PINs or logins somewhere you will find them, because you will need them before your next application.
Then pull all three reports at AnnualCreditReport.com, which is free every week, and read them properly. A freeze stops new damage. It does nothing about damage already recorded, and you cannot fix what you have not read.
If something on the report has already moved your score, why did my credit score drop is the place to start, and credit inquiries covers what a hard pull actually costs you.
One last framing, because it is what makes people finally do it. A freeze is not a security product you buy and maintain.
It is a default setting you change once. The correct state for a credit file belonging to somebody who is not currently applying for credit is frozen, and the exception is the application, not the freeze. Set it that way and the decision stops needing to be made.
Some of the links in this article are affiliate links. We may receive a small commission at no extra cost to you if you apply through these links. This helps us keep the site running and continue creating free content.
