Somebody, somewhere, would like to open a credit card in your name. That is not paranoia. It is the plain arithmetic of a country where billions of personal records have leaked in data breaches, and where the Federal Trade Commission logs well over a million identity theft reports a year. The encouraging part is that you have two genuinely powerful, mostly free tools to shut the door: the credit freeze and the fraud alert. They sound like cousins, and people use the names interchangeably, but they do different jobs with different strengths. Pick the wrong one for your situation and you can feel protected while staying exposed. This guide walks through exactly what each does, what neither does, how the bureaus' paid lock products fit in, and how to set up the right protection tonight.
Most new-account identity theft works the same boring way. A criminal gets your name, date of birth, address, and Social Security number, usually bought cheaply from a breach, and uses them to apply for credit as if they were you. The lender pulls your credit report to decide whether to approve, sees a real history, and opens the account. The first you hear of it is often a bill, a collection notice, or a strange entry on your own credit report months later. The damage is not just the balance. It is the hours of paperwork, the disputed accounts dragging on your score, and sometimes a loan you get denied because a stranger maxed out credit in your name.
The key insight is that this entire scheme depends on one step: the lender pulling your credit file. If a new creditor cannot see your file, it will not approve a new account, because no responsible lender extends credit blind. That single chokepoint is what both the credit freeze and the fraud alert aim at, from different angles. The freeze slams the door. The fraud alert posts a guard who is supposed to check ID before letting anyone through. Understanding which one you want starts with understanding that difference.
A credit freeze, sometimes called a security freeze, restricts access to your credit report. While the freeze is on, the bureau will not release your file to a new creditor, which means new applications in your name get stuck before they start. A thief can have every digit of your Social Security number and still fail, because the lender's request to view your report comes back blocked. The freeze is the strongest standard protection an ordinary person can put on a credit file, and it is the one security experts most often recommend keeping on by default.
A few things a freeze does not do, because the confusion here is common. It does not lower your credit score. It does not close or freeze your existing accounts, so your current cards, loans, and bank accounts keep working exactly as before. It does not stop you from checking your own credit report. And it does not stop companies you already do business with from monitoring your accounts, nor does it block your existing creditors from reviewing your file. The freeze is narrow and surgical: it blocks new credit access by parties who do not already have a relationship with you.
Here is the part that surprises people. Because of a 2018 federal law, freezing and unfreezing your credit is completely free at all three nationwide bureaus, in every state. There is no fee to place a freeze, no fee to lift it temporarily, and no fee to remove it permanently. For years some states allowed bureaus to charge a few dollars per action, which discouraged people from using the tool. That era is over. If anything tries to charge you to freeze your own credit, you have wandered onto a paid product, not the free legal freeze.
A freeze only protects you at the bureau where you set it. There are three nationwide bureaus, Equifax, Experian, and TransUnion, and a lender can pull your file from any of them. If you freeze only one, a thief simply ends up at a lender that checks one of the other two, and the application sails through. So a real freeze means three separate freezes, one at each bureau, each set up on its own. This is the single most common mistake people make, and it quietly defeats the whole strategy.
Each bureau lets you freeze online, by phone, or by mail. Online is fastest and usually instant. When you place a freeze, the bureau gives you a way to manage it later: a PIN, a password, or an online account login depending on the bureau. Keep that access information somewhere safe, because you will need it to thaw the freeze when you want to apply for credit. Losing a freeze PIN is annoying but recoverable; the bureaus have identity-verification recovery processes, they just add friction.
A freeze is not a one-way door, which is exactly why it is so livable. When you want to apply for a mortgage, a car loan, a new credit card, or even some apartment rentals and cell phone plans, you temporarily lift the freeze. This is called a thaw. You can thaw all three bureaus, or just the one a particular lender uses if you know which it is, and you can set the thaw to last a specific window, say a week, after which the freeze automatically snaps back on.
Thawing is free and, online, usually takes only a few minutes and goes into effect quickly. The bureaus are legally required to act on an electronic or phone thaw request within one hour. The practical rhythm for someone who keeps standing freezes looks like this: decide to apply for credit, ask the lender which bureau it pulls, thaw that bureau for a short window, submit your application, and let the freeze re-engage. A little planning replaces a lot of vulnerability. If you do not know which bureau a lender uses, thawing all three for a few days covers it.
A fraud alert takes a lighter touch. Instead of blocking access to your file, it places a notice on your credit report asking any business that pulls it to take extra steps to verify your identity before opening new credit. In practice that means a lender is supposed to contact you, often by the phone number you provide, to confirm you really are the one applying. The file stays accessible; the alert just adds a verification speed bump.
That difference matters. A freeze is a locked door. A fraud alert is a sign on an unlocked door asking visitors to check with you first. The alert depends on the lender actually following the request, and while most do, it is a softer protection than a freeze. The upside is convenience: with a fraud alert you do not have to thaw anything before applying for credit, because your file was never blocked. For people who open new accounts often and want some protection without the thaw routine, the fraud alert is the lower-friction choice.
Fraud alerts come in three flavors, and the distinction is worth knowing:
One convenience: unlike a freeze, you only contact one bureau to set a fraud alert. That bureau is legally required to notify the other two, so a single request covers all three. With a freeze, by contrast, you must contact each bureau yourself.
Walk through any bureau's website and you will be nudged toward a credit lock instead of, or alongside, a freeze. A lock does roughly what a freeze does, blocking access to your file, but with two important differences. First, a lock is typically toggled on and off instantly through a mobile app, which feels more convenient than the freeze workflow. Second, and this is the catch, a lock is a product governed by a terms-of-service contract you accept, not by the Fair Credit Reporting Act.
That legal distinction has real consequences. A freeze is a federal right with statutory protections behind it, including the requirement that it be free and that thaws happen within set timeframes. A lock runs on the bureau's terms, which the bureau can change, and which may include arbitration clauses or other conditions buried in the agreement. Some locks are free, but others are bundled into paid credit-monitoring subscriptions that can run a few dollars to twenty-plus dollars a month, often pitched as a package with the lock as the headline feature. You are then paying monthly for something the free freeze does at least as well.
None of this makes locks useless. If you genuinely value toggling protection on and off several times a month from an app, and a particular lock is free, it can be a reasonable convenience layer. But understand what you are choosing. For most people, the free, legally backed freeze is the better default, and you should be skeptical of any pitch that frames a paid lock subscription as necessary protection. The free freeze covers the core job.
Strip away the jargon and the choice gets simple. Reach for a credit freeze when you want the strongest protection and do not mind a short thaw before applying for credit. That covers most people most of the time, and it is the right call if your data has been exposed in a breach, if you are an identity theft victim, if you rarely open new accounts, or if you simply want to lock things down by default. Security professionals overwhelmingly favor keeping standing freezes for exactly these reasons.
Reach for a fraud alert when you want a lighter layer without the thaw routine, especially if you open new credit frequently or share a file situation where freezing is impractical. An initial fraud alert is also a sensible first move the day you get a breach notice, because it is fast, free, and buys you protection while you decide whether to go all the way to freezes. Many people do both: freezes for the hard block, plus an extended fraud alert if they are confirmed victims. The two are not mutually exclusive, and stacking them is fine.
One more practical note for parents and caregivers. You can freeze the credit of a minor child, who is a favorite target precisely because no one checks a kid's credit for years, and you can freeze the file of an adult you have legal authority over. Child identity theft can go undetected until the teenager applies for a first student loan, so a freeze on a minor's file, where one exists, is a quietly powerful move.
This is the section to read twice, because the biggest danger is a false sense of safety. Both tools target new-account fraud, the scenario where a criminal opens fresh credit in your name. They do almost nothing for several other very real threats, and pretending otherwise is how protected people still get burned.
Neither a freeze nor a fraud alert protects your existing accounts. If a thief steals your actual credit card number, or phishes your online banking login, or takes over an account you already have, the freeze is irrelevant, because no new credit file pull is involved. Account takeover and existing-card fraud are defended with strong unique passwords, two-factor authentication, transaction alerts, and watching your statements, not with a freeze. Neither tool stops tax-refund fraud, where a criminal files a fake return using your Social Security number, nor medical identity theft, nor government-benefits fraud, none of which run through a credit report pull. And neither stops you from being scammed into voluntarily handing money or access to a fraudster, which is a growing share of losses.
So treat the freeze and fraud alert as one strong layer in a stack, not the whole defense. The full kit looks like this: freeze your three credit files, use a password manager so every login is long and unique, turn on two-factor authentication everywhere it is offered, enable transaction alerts on your cards and bank, and check your free credit reports periodically at AnnualCreditReport.com. Each layer covers a gap the others leave open.
Here is the concrete setup. Budget about thirty minutes the first time. Have on hand your Social Security number, date of birth, and recent address history, since the bureaus verify your identity before letting you freeze.
Work through each bureau in turn. At each one, go to its official freeze page, create or log into an account, verify your identity, and place the freeze. Save the confirmation and any PIN or password the bureau issues, because you will need it to thaw later. Then repeat at the next bureau. When all three are frozen, you are done, and the protection stands until you choose to thaw it. If you would rather not create online accounts, each bureau also accepts freeze requests by phone, and by mail if you prefer a paper trail.
While you are at it, consider freezing two lesser-known files that some lenders and check-cashing services use: your report at the National Consumer Telecom and Utilities Exchange and your ChexSystems banking report. These are optional and beyond the big three, but they close additional side doors a determined thief might try. For most people, the three nationwide bureaus are the priority, and you can always add the others later.
If you have already found accounts you did not open, or a lender has flagged fraud, switch into recovery mode and move fast, because faster reporting limits your liability and your headache. The single best starting point is IdentityTheft.gov, the FTC's official recovery site. It is free, it asks what happened, and it builds a personalized, step-by-step recovery plan. Crucially, it generates an FTC identity theft report, a document that unlocks stronger rights, including the ability to have fraudulent accounts blocked from your credit reports and access to the seven-year extended fraud alert.
With that report in hand, the recovery sequence is straightforward. Place an extended fraud alert and freeze all three credit files to stop further damage. Contact the fraud department of every company where a fraudulent account was opened, explain the situation, and ask them to close the account and confirm in writing that you are not liable. Send the bureaus a block request with your identity theft report so the fraudulent items come off your credit reports, generally within four business days of receipt. Change passwords and enable two-factor authentication on your important accounts, since a thief who got this far may have more than just your credit info. And if the theft involves a stolen government document or tax fraud, follow the specific guidance IdentityTheft.gov provides for those situations.
Keep records of everything: dates, names, confirmation numbers, copies of letters. Recovery is rarely instant, and the person with the paper trail wins the disputes that follow. The good news is that the law is firmly on your side here, with deadlines on the bureaus and clear liability protections for genuine victims. The tools in this guide, used together, are how you take the file back.
If you remember one thing, make it this: a credit freeze is the stronger lock and it is free, so for most people the right answer is to freeze all three files and thaw only when you shop for credit. A fraud alert is the lighter, no-thaw alternative, useful right after a breach notice or for people who open credit often, and a must-have extended version once you are a confirmed victim. Credit locks do a similar job but trade your federal protections for app convenience and sometimes a monthly fee, so reach for the free freeze first. And no matter which you choose, remember that none of these guard your existing accounts, so pair them with strong passwords and two-factor login. Thirty minutes tonight closes the door that most identity thieves are counting on finding open.
Predatory offers and debt traps prey on rushed judgment. BrainSharp 50+ trains reasoning, attention, and fraud detection in daily 10-minute sessions, built for adults 50 and over.
Get your free Brain Age scoreYes. Since a 2018 federal law, placing a credit freeze and lifting it are free at all three nationwide bureaus, with no fee to add it, thaw it temporarily, or remove it permanently. This applies in every state. If a site tries to charge you to freeze your own credit, you are on the wrong page or looking at a paid lock product instead of the free legal freeze.
No. A freeze has no effect on your credit score, and it does not stop you from using the cards and loans you already have. It only blocks new creditors from pulling your file to open new accounts. Your score, your existing payments, and your ability to check your own report all continue to work normally while the freeze is on.
A freeze is a legal right governed by the Fair Credit Reporting Act, always free, and enforced by federal law. A lock is a product the bureaus sell that does roughly the same thing but runs on a terms-of-service agreement you accept, sometimes bundled into a paid monitoring plan. Locks can be faster to toggle in an app, but the free freeze gives you stronger legal footing and costs nothing.
Many security-minded people do exactly that, keeping all three files frozen by default and thawing only when they apply for credit. Because freezing and thawing are free and a thaw takes minutes online, the main cost is a little planning before you shop for a loan or card. If you rarely open new accounts, a standing freeze is a low-effort, high-protection habit.
An initial fraud alert lasts one year and can be renewed. An extended fraud alert, available to confirmed identity theft victims with an identity theft report, lasts seven years. An active-duty alert for deployed service members lasts one year. You only need to contact one bureau to set a fraud alert, and that bureau must tell the other two.
Go to IdentityTheft.gov, the FTC's official recovery site. It walks you through a free, personalized plan and generates an identity theft report you can use to block fraudulent accounts. Then freeze all three credit files, place a fraud alert, and contact the fraud department of each company where an account was opened. Move quickly, since faster reporting limits your losses.
One smart money idea each week, charts included. Join free and get the printable 2026 Money Calendar in your welcome email.
