Credit Freeze vs. Fraud Alert vs. Credit Lock: Which One Actually Protects You
You have three tools to protect your credit from identity thieves: freezes, alerts, and locks. They sound similar. They all claim to stop fraud. They work completely differently.
Here's how each one actually protects you, what each one costs, and which situations call for which tool.
What a Credit Freeze Actually Does
A credit freeze blocks all access to your credit report. When your credit is frozen, lenders can't see your report to approve new accounts. No report access means no new credit cards, no car loans, no mortgages, no utility accounts, no cell phone contracts. The application gets denied automatically.
That's the mechanism. Your credit report still exists. Your credit score still exists. Existing accounts still work. But new creditors hit a wall.
The freeze lives at the bureau level. You freeze your credit separately at Equifax, Experian, and TransUnion. Each bureau maintains its own freeze. A freeze at Equifax doesn't affect Experian or TransUnion.
Lenders don't check all three bureaus for every application. Some check one. Some check two. Some rotate. If your credit is frozen at Equifax but not Experian, and a lender checks Experian, they see your full report. The application goes through.
That's why you freeze at all three bureaus or you don't freeze at all. Partial protection creates a false sense of security.
Credit freezes became free in September 2018 under federal law. Before that, some states charged fees. Now every bureau must offer free freezes, free temporary lifts, and free permanent removals. No exceptions.
You control the freeze. You can lift it temporarily for a specific creditor, lift it temporarily for a set time period, or remove it permanently. Most bureaus process temporary lifts within minutes through their websites or apps.
The freeze stays in place until you lift it. It doesn't expire. It doesn't require renewal. It survives bureau data breaches, system migrations, and corporate acquisitions. Once frozen, it stays frozen.
What a Fraud Alert Actually Does
A fraud alert adds a flag to your credit report. The flag tells lenders: verify this person's identity before approving credit.
That's it. That's the mechanism. The alert doesn't block access. It doesn't stop lenders from pulling your report. It doesn't prevent applications. It asks lenders to take an extra verification step.
Lenders decide what that verification step looks like. Some call the phone number on file. Some require additional documentation. Some ignore the alert entirely. The law requires reasonable verification procedures. It doesn't specify what reasonable means.
You place a fraud alert at one bureau, and that bureau notifies the other two. One action covers all three. The alert lasts one year for standard alerts, seven years for extended alerts available to confirmed identity theft victims.
Standard alerts require renewal. If you place an alert in May 2026, it expires in May 2027. You must place a new alert to maintain protection. The bureaus don't remind you. The alert just disappears.
Extended alerts require an identity theft report from IdentityTheft.gov. That report documents the theft with law enforcement and creates a recovery plan. Extended alerts come with additional protections: you get removed from prescreened credit offer lists for five years, and creditors must contact you directly before opening accounts.
Fraud alerts are free. Always. At all three bureaus. No fees to place, no fees to renew, no fees to remove.
The alert is weaker than a freeze. It relies on lender compliance. Some lenders take verification seriously. Others treat the alert as a suggestion. Research from consumer protection literature commonly suggests that fraud alerts work best as temporary protection during high-risk periods, not as permanent identity theft prevention.
What a Credit Lock Actually Does
A credit lock blocks access to your credit report, similar to a freeze. The difference is who controls it and what legal protections apply.
Credit locks are products sold by the bureaus. You lock and unlock through the bureau's app or website. The lock lives inside the bureau's ecosystem. You use their interface, follow their terms of service, agree to their arbitration clauses.
Freezes are federally regulated. The Fair Credit Reporting Act and state laws define how freezes work, what they cost, and what rights you have. Locks operate under contract law. The bureau writes the terms. You agree or you don't use the lock.
Some bureaus offer free locks. Others bundle locks with paid credit monitoring services. Experian offers a free lock through its app. Equifax and TransUnion include locks in paid subscription tiers, though they also offer free locks with fewer features.
The functional difference between a lock and a freeze is speed and convenience. Locks unlock instantly through an app. Freezes require logging into the bureau's security center, navigating to the freeze management page, and processing the lift. The difference is around 30 seconds.
That convenience comes with tradeoffs. Lock terms of service can change. The bureau can modify access procedures, add fees, or discontinue the service. Freezes can't change without federal legislation.
Locks don't provide the same legal protections as freezes. If a creditor opens an account while your credit is frozen, you have specific legal recourse under federal law. If a creditor opens an account while your credit is locked, your recourse depends on the lock's terms of service and state contract law.
Industry guidance suggests using freezes for permanent protection and locks for temporary convenience. If you need to lock and unlock frequently, a lock might make sense. If you're protecting against identity theft long-term, a freeze provides stronger legal standing.
When to Use Each Tool
Use a credit freeze when you want permanent protection and don't plan to apply for new credit regularly. Freezes work for people who rarely open new accounts, people recovering from identity theft, people whose information appeared in a major breach, and people who want the strongest available protection.
Freeze your credit at all three bureaus. Do it once. Leave it frozen. When you need to apply for credit, check which bureau the lender uses, lift that freeze temporarily, submit your application, then refreeze. The process takes around five minutes per bureau.
Use a fraud alert when you need temporary protection during a high-risk period. Alerts work when you've lost your wallet, when your personal information appeared in a breach but hasn't been used yet, when you're traveling internationally and want an extra verification layer, or when you're monitoring suspicious activity but haven't confirmed fraud.
Alerts expire. Set a calendar reminder to renew. If the threat persists beyond a year, consider switching to a freeze.
Use a credit lock when you need to lock and unlock frequently and accept the tradeoff of weaker legal protections for app convenience. Locks work for people who apply for credit often, people who manage credit for family members through a single app, or people who want instant mobile control.
Don't use a lock as your only protection. If the bureau changes terms, adds fees, or discontinues the service, your protection disappears without warning.
The Practical Differences That Matter
A freeze requires a PIN or password to lift. You create this when you place the freeze. If you lose it, you must verify your identity through the bureau's security process, which can take days. Keep the PIN somewhere secure but accessible. A password manager works. A locked note on your phone works. A paper file at home works.
An alert requires no PIN. You place it, it expires, you place another one. The only thing you need to remember is the renewal date.
A lock requires the bureau's app and an account login. If you delete the app, forget your password, or the bureau changes authentication requirements, you must regain access before you can unlock. The lock itself stays in place.
Freezes and locks both block soft inquiries from prescreened credit offers. You stop receiving pre-approval letters in the mail. Alerts don't block these inquiries. The mail continues.
None of these tools affect your existing accounts. Your credit cards still work. Your mortgage still reports. Your auto loan still appears on your report. The tools only prevent new account openings.
None of these tools stop all identity theft. They stop credit-based fraud. They don't stop someone from filing a fraudulent tax return in your name, stealing your Social Security benefits, using your insurance information, or opening accounts at banks that don't check credit reports.
How to Place Each Tool
To freeze your credit, visit each bureau's security center directly:
- Equifax: equifax.com/personal/credit-report-services/credit-freeze
- Experian: experian.com/freeze/center.html
- TransUnion: transunion.com/credit-freeze
Create an account if you don't have one. Verify your identity. Place the freeze. Save your PIN or password. The process takes around ten minutes per bureau.
To place a fraud alert, visit any one bureau's fraud alert page. That bureau notifies the other two. You only need to do this once:
- Equifax: equifax.com/personal/credit-report-services/credit-fraud-alerts
- Experian: experian.com/fraud/center.html
- TransUnion: transunion.com/fraud-alerts
Provide your contact information. The alert goes into effect within 24 hours.
To set up a credit lock, download the bureau's app or visit their website. Create an account. Enable the lock. Each bureau has its own lock product with its own name:
- Equifax: Lock & Alert through the Equifax app
- Experian: Experian CreditLock through the Experian app
- TransUnion: TransUnion TrueIdentity through the TrueIdentity app
The Scenario That Decides
In The Sting, the con artists spend weeks building an elaborate fake betting parlor to pull off a single score. The whole operation depends on the mark believing the parlor is real until the exact moment the con completes. One premature reveal and the entire scheme collapses.
Identity thieves work the same way. They don't steal your information and immediately open accounts. They wait. They test. They build. They use your data to open one account, then use that account to open another, then use both to open a third. Each new account makes the fraud look more legitimate.
A credit freeze stops this progression at the first step. The thief tries to open an account. The lender pulls your credit. The freeze blocks access. The application gets denied. The scheme collapses before it starts.
A fraud alert asks the lender to verify. Sometimes they do. Sometimes they don't. Sometimes they call a phone number the thief controls because the thief already changed your contact information at the bureau. The alert adds friction, but friction isn't a wall.
A lock works like a freeze with app convenience and contract-based protections. It stops the first application. It relies on you maintaining access to the bureau's app and the bureau maintaining the service.
The scenario that decides: do you want a wall or friction?
If you want a wall, freeze your credit at all three bureaus. If you need temporary friction during a high-risk period, place a fraud alert. If you want app-based convenience and accept the tradeoff, use a lock.
Most people benefit from freezes. The setup takes 30 minutes. The protection lasts forever. The legal protections are strongest. The cost is zero.
What About Monitoring Services
Credit monitoring services watch your credit reports for changes and alert you when new accounts appear, inquiries get logged, or personal information updates. They don't prevent fraud. They detect it after it happens.
Monitoring makes sense alongside a freeze, not instead of one. The freeze prevents unauthorized accounts. Monitoring catches anything that slips through, like fraud on existing accounts or identity theft that doesn't involve credit reports.
Some monitoring services include identity theft insurance, which covers recovery costs like legal fees, lost wages, and document replacement. The insurance doesn't reimburse stolen money. Your bank and credit card issuers handle that through their own fraud protections.
Free monitoring comes from several sources. Many banks and credit card issuers offer it to customers. Credit Karma provides free monitoring of TransUnion and Equifax. AnnualCreditReport.com gives you free reports from all three bureaus once per year, which you can stagger every four months for ongoing visibility.
Paid monitoring adds features like daily updates, dark web scanning, and faster alerts. Whether those features justify the monthly fee depends on your risk tolerance and how closely you watch your accounts through other means.
If you've been affected by a major breach, the company that got breached often provides free monitoring for one to three years. Use it. It costs you nothing and adds a detection layer.
NordProtect offers identity theft monitoring with credit alerts, dark web scanning, and recovery support if fraud occurs. The service watches for your personal information across breach databases and alerts you when your data appears in new leaks.
The Freeze Process in Detail
When you freeze your credit at Equifax, you create an Equifax account, verify your identity by answering questions about your credit history, and set a PIN or password. The freeze takes effect immediately. Equifax generates a confirmation page with your freeze details. Save this page.
When you freeze at Experian, the process is similar. Create an Experian account, verify your identity, set a PIN. Experian also offers a mobile app that lets you manage the freeze from your phone. The app is optional. You can manage everything through the website.
When you freeze at TransUnion, you create a TransUnion account, verify your identity, and set a PIN. TransUnion's interface is slightly different from the other two, but the underlying mechanism is identical.
Each bureau stores your freeze independently. They don't communicate with each other about freeze status. You must manage three separate freezes through three separate accounts.
To lift a freeze temporarily, log into the bureau's website, navigate to the freeze management page, select temporary lift, and specify either a date range or a specific creditor. If you specify a creditor, provide the creditor's name exactly as it appears on the application. If you're not sure, lift the freeze for a specific time period instead.
To lift a freeze permanently, log in and select permanent removal. The freeze disappears. Your credit report becomes accessible to all lenders immediately.
If you forget your PIN, each bureau has a recovery process. You verify your identity by answering security questions, providing documentation, or both. The process can take several days. Don't lose your PIN.
What Doesn't Get Blocked
Credit freezes don't block existing creditors from accessing your report. Your credit card issuer can still pull your report to review your account. Your mortgage lender can still check your credit before offering a refinance. Your auto lender can still monitor your payment history.
Freezes don't block soft inquiries from existing relationships. Your insurance company can still check your credit-based insurance score. Your employer can still run a background check if you've authorized it. Your landlord can still verify your rental history.
Freezes don't block government agencies. The IRS can still access your credit report for tax enforcement. Child support agencies can still check your credit for payment enforcement. Law enforcement can still pull your report with proper authorization.
Freezes don't block collection agencies working on existing debts. If you owe money and stop paying, the creditor can report the delinquency to the bureaus. The freeze doesn't prevent this reporting.
Freezes don't block credit bureau investigations of fraud disputes. If you dispute an item on your report, the bureau can still investigate while your credit is frozen.
The Timing Question
Place a credit freeze before you need it. Once your information appears in a breach, identity thieves have it. The breach notification arrives weeks or months after the exposure. By the time you know, thieves have already had time to test your data.
Don't wait for signs of fraud. Don't wait for suspicious activity. Don't wait for a denied credit application you didn't submit. Freeze your credit now, while you're thinking about it, before the fraud starts.
If you're planning to apply for credit in the next few weeks, you can still freeze. Lift the freeze temporarily when you're ready to apply, submit your application, then refreeze immediately. The temporary lift lasts as long as you specify. Set it for 24 hours if you're applying online. Set it for a week if you're shopping for auto loans at multiple dealers.
If you're actively shopping for a mortgage and expect to submit multiple applications over several weeks, consider waiting to freeze until after you close. Mortgage applications often involve multiple credit pulls from multiple lenders. Managing freeze lifts across three bureaus for multiple lenders creates administrative overhead. A fraud alert provides reasonable protection during this period.
If you've already confirmed identity theft, freeze immediately. File an identity theft report at IdentityTheft.gov, place an extended fraud alert, and freeze your credit at all three bureaus. The extended alert lasts seven years. The freeze lasts forever. Both are free.
The Family Question
You can freeze your child's credit. Children have credit reports if they have Social Security numbers. Those reports are usually empty, which makes them attractive to identity thieves. An empty report means no existing accounts to contradict fraudulent applications.
To freeze a child's credit, you need the child's Social Security number, birth certificate, proof of your identity, and proof of your relationship to the child. Each bureau has specific documentation requirements. Check their websites for current requirements before starting the process.
Some bureaus require you to mail documentation. Others accept uploads through secure portals. The process takes longer than freezing your own credit because the bureaus must verify your authority to freeze someone else's report.
Once frozen, a child's credit stays frozen until they turn 18 or until you lift it. When they turn 18, they gain control of their own freeze. They must create their own accounts and manage their own PINs.
You cannot freeze a spouse's credit without their direct involvement. Each adult must freeze their own credit. You can help with the process, but they must create the accounts and set the PINs themselves.
The Cost of Not Freezing
Research from consumer protection literature commonly suggests that identity theft recovery takes an average of six months and around 200 hours of work. You'll spend that time filing police reports, disputing fraudulent accounts, replacing documents, and proving your identity to creditors who opened accounts in your name.
The financial cost varies. If the fraud is caught early, you might lose nothing. Your bank and credit card issuers typically cover fraudulent charges. If the fraud runs for months, you might face collections, damaged credit, denied applications, higher interest rates, and legal fees to clear your name.
The emotional cost is harder to quantify. Identity theft victims report feeling violated, anxious, and helpless. The fraud touches every aspect of your financial life. Every new account, every credit check, every denied application becomes a potential sign of ongoing theft.
A credit freeze prevents most of this. Not all of it. Freezes don't stop tax fraud, benefits theft, or medical identity theft. But they stop the most common form: someone opening new credit accounts in your name.
The setup takes 30 minutes. The protection lasts forever. The cost is zero. The tradeoff is occasionally spending five minutes to lift a freeze when you apply for credit.
What to Do Right Now
If you want a credit freeze, visit Equifax, Experian, and TransUnion's freeze pages. Create accounts. Place freezes. Save your PINs. Do all three in one sitting. The process takes around 30 minutes total.
If you want a fraud alert instead, visit any one bureau's fraud alert page. Place a standard one-year alert. Set a calendar reminder for 11 months from now to renew. The process takes around five minutes.
If you want a credit lock, download each bureau's app. Create accounts. Enable locks. The process takes around 15 minutes total.
If you're not sure which tool fits your situation, start with a fraud alert. It provides immediate protection while you decide whether to freeze. The alert lasts a year. That gives you time to evaluate your actual credit application frequency and determine whether a freeze makes sense long-term.
If you've been affected by a breach, freeze. Don't wait to see if fraud happens. Don't wait for suspicious activity. Freeze now, while you're thinking about it, before the thieves test your data.
If you have children, freeze their credit. Child identity theft often goes undetected for years because children don't apply for credit. By the time they discover the fraud, the damage is extensive.
The tools exist. They're free. They work. The question is whether you use them before you need them or after.
