Credit Freeze vs. Fraud Alert: Which One You Actually Need

Credit Freeze vs. Fraud Alert. Choosing between a credit freeze and a fraud alert comes down to a single question: do you want lenders warned, or do you want them blocked? A fraud alert is a flag on your credit file asking creditors to verify your identity before extending credit. A credit freeze restricts access to the file itself, so a prospective lender generally can’t pull it and therefore won’t approve a new account. Both are free, both are federal rights, and both are widely misunderstood — including the part where neither one protects the accounts you already have. This Banktimer guide compares them on what they actually stop, how fast each one goes on and comes off, which situations call for which, and the specialty credit bureaus most people never think to freeze.

A credit freeze blocks access; a fraud alert requests verification. The freeze is the stronger protection by a wide margin, and since September 2018 it has been free by federal law at all three nationwide credit bureaus.

You must place a freeze with each bureau separately. A fraud alert only needs one call. The bureau you contact for an alert is required to notify the other two; there is no equivalent relay for freezes.

A freeze lifts in as little as one hour when you request it by phone or secure electronic means. The “it’s too inconvenient” objection is largely out of date — lifting a freeze before a loan application takes minutes, not days.

Neither one protects your existing accounts. A frozen credit file does nothing to stop a thief using your current credit card, draining your checking account, or filing a tax return in your name. Those need separate defenses.

A credit freeze has no effect on your credit score. The CFPB states it plainly: security freezes do not impact your credit scores in any way whatsoever.

A “credit lock” is a product, not a right. Locks are offered by the bureaus themselves, sometimes for a fee and sometimes bundled with other services. The CFPB’s position is direct: locks are no more effective than security freezes, which are free and which you have a right to by law.

Freezing the big three does not cover everything. Bank accounts, utilities, and phone service are often opened through specialty reporting agencies that the big-three freeze doesn’t touch — a gap most guidance skips entirely.

The Short Answer

If you read no further: for most people, most of the time, the freeze is the better tool. The fraud alert’s main advantages are that one call covers all three bureaus and that it doesn’t interrupt an application already in progress. Those are convenience advantages, not security advantages.

Key Numbers to Know

Credit Freeze vs. Fraud Alert, Side by Side

The two tools sit at different points on the same spectrum. Understanding exactly where they differ makes the choice obvious in most situations.

Two rows carry most of the decision. “Blocking versus advisory” is the security difference: a freeze doesn’t depend on a lender noticing anything or choosing to act. “All three versus one” is the effort difference, and it’s smaller than it sounds — three online forms, roughly fifteen minutes total, done once.

How a Credit Freeze Actually Works

A security freeze restricts prospective creditors from accessing your credit file. Because most lenders won’t approve an application they can’t underwrite, the practical effect is that new accounts can’t be opened in your name — by a thief or by you — while the freeze is on.

Who Can Still See Your File

A freeze isn’t absolute, and knowing the exceptions prevents false confidence. Your existing creditors and their debt collectors can still access the file for account review. Government agencies can access it in connection with a court order, subpoena, or child support enforcement. Companies you already do business with can review the relationship. And you can always get your own reports.

That last point matters: freezing does not block you from pulling your own credit reports free at AnnualCreditReport.com, and you should keep doing so. Banktimer’s guide to credit report errors covers what to look for when you read them.

What It Costs You in Practice

Almost nothing, with one caveat worth planning around. When you apply for a mortgage, auto loan, credit card, or sometimes a rental or a new phone contract, you need to lift the freeze first. If you know which bureau the lender uses, you can lift only that one; if not, lift all three. Either way the process takes minutes online with the PIN or account credentials you set up when you froze.

The realistic failure mode isn’t inconvenience — it’s losing your PIN or account access. Store the credentials for all three bureaus somewhere you’ll actually find them in two years, ideally a password manager rather than a note in a drawer.

Freezing a Child’s Credit File

Child identity theft is unusually damaging because it often goes undetected for years — a teenager discovers it when applying for a first student loan. Federal law lets a parent or guardian freeze the file of a child under 16, and if the child has no credit file, the bureau must create one solely so it can be frozen. That record can’t be used for credit while frozen. You’ll need documentation of your authority and the child’s identity; each bureau publishes its own list.

Freezing the File of Someone You Care For

A guardian, conservator, or person holding a valid power of attorney can request a freeze on behalf of an incapacitated adult, with documentation. This is one of the more effective protections available for an older relative at risk of financial exploitation, and it costs nothing.

How Fraud Alerts Actually Work

A fraud alert is a notice on your credit file telling prospective creditors to take reasonable steps to verify your identity before extending credit. It doesn’t block the file, and it doesn’t require the lender to reach you by any particular method — the obligation is to take reasonable verification steps.

The Three Types

The extended alert carries a benefit the others don’t: it removes you from prescreened credit and insurance offer lists for five years, which cuts off a genuine source of mail-theft-based fraud. The active duty alert does the same for two years.

The Weakness Worth Naming

A fraud alert depends on a lender seeing the flag and choosing to act on it properly. Most do. But the obligation is to take reasonable steps, not to reach you personally, and a determined thief with your full identifying information can sometimes satisfy a verification process. That’s the structural reason a freeze is stronger: it doesn’t ask anyone to do anything.

What Neither One Protects

This is the most important section in the guide, because the gap between what people think a freeze does and what it actually does is where real losses happen. A credit freeze governs one thing: access to your credit file for the purpose of opening new credit. Everything below sits outside it.

Your Existing Accounts

A thief with your card number can keep using your existing credit card. Someone with your debit card or account credentials can drain your checking account. A freeze does nothing about either. Those are protected by card-network rules, federal error-resolution requirements, and your own monitoring — Banktimer’s guides to debit card fraud recovery and to bank impersonation scams cover the deadlines that actually matter there.

Tax Refund Fraud

Filing a fraudulent return in your name requires your Social Security number, not your credit file. The defense is an IRS Identity Protection PIN, which you can request from the IRS and which blocks a return filed without it. Banktimer’s guide to tax refund direct deposit problems covers the adjacent failure modes.

Medical and Insurance Identity Theft

Someone using your identity to obtain medical care generally isn’t opening a credit account, so no freeze applies. Reviewing explanation-of-benefits statements is the practical detection method.

Social Security and Government Benefits

A freeze doesn’t protect your Social Security account. Creating your own account at the Social Security Administration’s site — before someone else does — is the relevant step there.

Account Takeover Through You

No freeze stops you from being talked into authorizing a transfer. Impersonation scams work by getting the account holder to move the money themselves, which is precisely why they’re so effective and so hard to reverse. Banktimer’s guide to phishing texts that look like your bank covers the pattern.

The Bureaus Most People Forget to Freeze

Freezing Equifax, Experian, and TransUnion blocks most new credit accounts. It does not block a new checking account, a utility connection, or a mobile phone contract, because those decisions are often made using entirely different reporting agencies. This is the single largest gap in standard identity-theft advice.

Bank Account Screening

Banks commonly check a deposit-account screening agency before opening a checking account. A thief opening an account in your name to receive stolen funds is not applying for credit, so the big-three freeze doesn’t apply. These agencies accept freeze or security-freeze requests directly.

Utility and Telecom Exchanges

Utility and phone companies often use a shared exchange rather than a nationwide credit bureau. Freezing it closes a route that’s frequently used for service fraud, which can be both costly and slow to unwind.

The Fourth Nationwide Bureau

Beyond the big three, another nationwide consumer reporting agency operates and is used by some lenders. It offers its own freeze, and it’s worth adding to the list once you’re already doing the others.

Insurance and Public Records Data

Specialty agencies compile insurance claim histories and public-records data used in underwriting. Some accept freeze requests and all must provide you a free file disclosure on request.

The CFPB maintains a published list of consumer reporting companies, including the specialty agencies, with contact details and which ones accept freeze requests. That list is the authoritative place to find current names and procedures, which change more often than the big three do.

The last row isn’t a credit bureau at all, and it belongs here anyway. A SIM swap hands an attacker your text-message verification codes, which unlocks a great deal regardless of what your credit file says. A port-out PIN with your carrier is a five-minute call and one of the highest-value protections on this entire list.

A Decision Framework: Which One, and When

Four questions settle it, and they’re worth working through in order rather than jumping to the answer.

Question 1: Has Something Actually Happened?

If you have confirmed identity theft — an account you didn’t open, a collection notice for a debt that isn’t yours, a denial you can’t explain, which Banktimer’s credit score guide can help you interpret — you’re in recovery mode. Freeze all three, file a report at IdentityTheft.gov to create an identity theft report, and use that report to place an extended seven-year alert. The freeze blocks; the extended alert persists long after you’d otherwise stop paying attention.

Question 2: Are You Applying for Credit in the Next Few Weeks?

If yes, a freeze still works — you just lift it first, which takes about an hour. If the application is already in progress and you’d rather not interrupt it, an initial fraud alert gives you a year of coverage without blocking anything. Banktimer’s guide to hard inquiries covers the rate-shopping windows that affect this timing.

Question 3: How Often Do You Open New Accounts?

Someone who opens a card every few years should freeze and leave it frozen. Someone actively rate-shopping across several lenders may prefer to freeze after the shopping is done. Neither answer is wrong; the freeze is simply less convenient during an active application period and no less convenient the rest of the time.

Question 4: Who Else Is in Your Household?

Freezes are per person, so a spouse’s file needs its own three requests, and each child under 16 needs their own. An older relative you help manage money for may need a guardian- or power-of-attorney-based request. Doing the whole household in one sitting takes an afternoon and doesn’t need repeating.

Freeze, Lock, Monitoring, or Insurance?

Four products get sold or recommended for roughly the same worry, and only one of them is a legal right you already have.

Credit Freeze

A statutory right, free, and the strongest of the four at blocking new credit accounts. Governed by federal law, with defined timeframes the bureaus must meet.

Credit Lock

A product the bureaus offer, sometimes free and sometimes bundled into a paid subscription, governed by the terms of that contract rather than by statute. Locks are typically toggled in an app, which is genuinely convenient. The CFPB’s assessment is worth quoting directly: credit locks are no more effective than security freezes, which are free and which you have a right to by law. Read what a lock’s terms say about liability and cancellation before paying for one.

Credit Monitoring

Monitoring detects rather than prevents, much as watching your credit utilization tells you what already reported rather than stopping it. It tells you after something appeared on your report, which is useful but is not protection. Free monitoring is widely available, including through some credit card issuers, and you can approximate it yourself by staggering your three free annual reports across the year.

Identity Theft Insurance

Typically reimburses certain out-of-pocket recovery costs rather than the stolen funds themselves, and often carries exclusions worth reading closely. It’s a supplement to prevention, never a substitute.

If you’re paying for one of the middle rows and haven’t done the free top row, the money is being spent in the wrong order.

What to Do in the First 48 Hours After a Breach or Theft

Order matters here, because some steps unlock others. Work down the list.

Hour One: Freeze and Contain

Place freezes at all three nationwide bureaus. If a specific account has been compromised, call that institution’s fraud line — not a number from an email or text — and have the card or account closed and reissued rather than merely flagged.

Hour Two: Create the Paper Trail

File at IdentityTheft.gov. The report it generates is the identity theft report you’ll need for an extended fraud alert, for blocking fraudulent information on your credit reports, and for pushing back on creditors. Add a police report if a creditor or your state requires one. Write down every call: date, time, name, reference number.

Day One: Close the Side Doors

Set a port-out PIN with your mobile carrier. Request an IRS Identity Protection PIN. Create your Social Security account if you haven’t. Change passwords on email first — email is the reset path for everything else — and turn on app-based rather than text-based two-factor authentication where offered.

Day Two: Extend and Verify

Use the identity theft report to place the seven-year extended alert. Pull all three credit reports and read them line by line for accounts, addresses, and inquiries you don’t recognize. Dispute anything fraudulent in writing, and request that fraudulent information be blocked rather than merely disputed — that’s a distinct right under federal law for identity theft victims.

Then: Add the Specialty Agencies

Freeze the deposit-account screening agency and the utility and telecom exchange. These are the two gaps most likely to be exploited after the obvious doors are closed.

Three Situations, Worked Through

The same two tools produce different plans depending on timing and what has already happened.

A Breach Notice, No Evidence of Misuse

Someone receives a letter saying their Social Security number was exposed in a vendor breach, along with an offer of two years of free monitoring. Nothing has happened yet. The monitoring is worth accepting since it’s free, but it detects rather than prevents, so it isn’t the main move.

The plan: freeze all three bureaus the same day, add the deposit-account screening and utility exchange agencies, set a carrier port-out PIN, and opt out of prescreened offers. Skip the fraud alert entirely — a freeze already blocks what an alert would merely flag, and the alert would expire in a year while the freeze won’t. Total time, about forty minutes, all of it free.

A Collection Notice for a Loan You Never Took

This is confirmed identity theft, and the sequence matters. Freeze all three immediately, then file at IdentityTheft.gov to generate the identity theft report. Use that report to place a seven-year extended alert and to request blocking of the fraudulent account rather than a routine dispute. Notify the collector in writing that the debt resulted from identity theft and enclose the report. Request the application records from the lender that opened the account, because the address and phone number used will tell you whether this was bulk data or someone closer to home.

Mid-Mortgage, and the Card Issuer Just Called About Suspicious Activity

Freezing now would stall an application in progress, and the underwriter may need to re-pull credit before closing. The workable plan is an initial fraud alert, which protects for a year without blocking, plus closing and reissuing the compromised card immediately and turning on transaction alerts. Tell the loan officer what happened, since a fraud alert may add an identity verification step they should expect. Once the loan closes, place the freezes. Banktimer’s guide to mortgage preapproval covers how sensitive that final stretch is to credit-file changes.

The final column is the useful one. In every case the freeze is the easy part; what gets missed is the step just outside the credit file — the specialty agency, the phone carrier, the written notice to a collector, the conversation with a loan officer.

Common Mistakes and Red Flags

The most common mistake is freezing one bureau and assuming it covers all three. Freezes don’t relay; only fraud alerts do. A second is placing an initial fraud alert and forgetting it expires in a year, leaving a gap nobody notices.

A third is losing the freeze PINs, which turns a one-hour lift into an identity-verification process at the worst possible moment. A fourth is believing a freeze protects existing accounts. A fifth is paying for a credit lock or monitoring subscription without first placing the free freezes.

A sixth is freezing only the big three and leaving the deposit-account and utility agencies open. A seventh is freezing your own file while leaving a child’s or an at-risk relative’s untouched — those are often the more attractive targets precisely because nobody is watching them.

Questions to Ask Before You Choose

How New-Account Fraud Actually Starts

Knowing the routes helps you judge which protection matters for your situation, because different entry points defeat different defenses.

Bulk Data From a Breach

The most common starting point. Name, date of birth, Social Security number, and address are enough to attempt a new account almost anywhere. A freeze is the direct counter, because no amount of accurate personal information helps if the lender can’t pull a file.

Mail Theft

Prescreened credit offers, replacement cards, and statements taken from an unlocked mailbox provide both data and, sometimes, a usable application. Opting out of prescreened offers removes a large share of this supply, and it’s a separate step from either a freeze or an alert.

Phishing and Impersonation

A convincing text or call collects the missing pieces directly from you — a one-time code, a security answer, the last four digits that turn partial data into a complete identity. No credit-file protection stops this, which is why recognizing the pattern matters more than any setting.

SIM Swap

An attacker persuades a carrier to move your phone number to their device, capturing every text-based verification code. This defeats two-factor authentication on accounts you already have, and a credit freeze is irrelevant to it. A port-out PIN is the counter.

Insider and Family Access

A meaningful share of identity theft involves someone with legitimate access to your documents — including relatives. This is the main reason to freeze a child’s file, and it’s also why a freeze you place yourself is worth more than a monitoring product someone in the household can see and disable.

The pattern across that table is worth naming. A freeze is excellent at one thing and irrelevant to several others. That isn’t an argument against it — it’s an argument for placing it and then spending five more minutes on the port-out PIN and the prescreened-offer opt-out, which cover the rows it doesn’t.

Your Rights If Fraud Happens Anyway

Federal law gives identity theft victims a specific set of rights that go well beyond placing an alert, and most people never use them because nobody tells them the rights exist.

Free Reports and an Extra Look

Placing an initial fraud alert entitles you to a free credit report from each bureau beyond your normal free reports. An extended alert entitles you to two free reports from each bureau within the following twelve months. Use them — read the addresses and inquiries, not just the accounts.

Blocking, Not Just Disputing

An ordinary dispute asks a bureau to investigate whether information is accurate. Blocking is stronger: with an identity theft report, you can require that information resulting from identity theft be removed from your file, and the bureau must generally act within a defined period. Ask for blocking explicitly rather than filing a generic dispute, because the two requests go down different paths. Banktimer’s guide to credit report errors walks through the ordinary dispute process for comparison.

Documents From the Fraudster’s Application

You have the right to request, from a business where a fraudulent account was opened, the application and transaction records relating to that account. This is how you find out what address, phone number, or employer the thief used — information that often explains how it happened and helps with other cleanup.

Stopping Collection on a Fraudulent Debt

If a debt collector contacts you about an account opened in your name, you can tell them in writing that the debt resulted from identity theft and provide your identity theft report. A collector who has been notified generally may not continue collecting or report the debt while the claim is being evaluated.

Where to Escalate

If a bureau or creditor won’t act, file a complaint with the Consumer Financial Protection Bureau, which forwards it to the company and requires a response. For a bank, you can also escalate to its primary regulator — Banktimer’s guide to who regulates banks, insurance and investments explains how to identify the right one.

Living With a Freeze

The objection people raise is friction. In practice the routine is small, and a few habits remove almost all of it.

Keep the Credentials Somewhere Real

All three bureaus, in a password manager, with the account email noted. This single step converts every future lift from a verification ordeal into a two-minute task.

Ask Which Bureau the Lender Uses

Many lenders will tell you if you ask. Lifting one instead of three saves time and leaves the other two protections in place throughout.

Lift for a Window, Not Forever

Most bureaus let you lift temporarily for a set number of days. Use that rather than a permanent removal, so the freeze resumes on its own if you forget.

Expect the Occasional Surprise

Some transactions you wouldn’t think of as credit involve a credit pull: a new mobile phone contract, some rental applications, occasionally a utility connection or an insurance quote. If something is declined unexpectedly, the freeze is worth checking first.

Re-check After Major Life Events

Marriage, divorce, a move, a death in the family, or turning 16 for a child whose file you froze are all moments to confirm the freezes are still in place and the contact details on file are current.

Who This Guide Suits

This guide is most useful to anyone who just received a data breach notice, anyone who has found an account they didn’t open, and anyone who has been meaning to freeze their credit and wants to know whether it’s worth the trouble. It’s equally relevant if you’re already paying for identity protection and want to know what you’re actually getting.

Anyone worried about money in the bank rather than credit in their name should read Banktimer’s guide to FDIC insurance limits, which covers a different failure entirely. Someone in active recovery from identity theft will get the most from the 48-hour sequence and the specialty-agency section, since those are where recovery efforts most often leave gaps. Someone simply being prudent will get the most from the comparison table and the freeze mechanics, since the real question there is whether a permanent freeze is worth the occasional hour to lift — and for most people it is. Banktimer’s personal finance basics guide covers where this sits among the other protective steps worth taking once.

Frequently Asked Questions

What’s the difference between a credit freeze and a fraud alert?

A freeze restricts access to your credit file so lenders generally can’t pull it, which stops new accounts from being opened. A fraud alert flags the file and asks creditors to verify your identity first, but doesn’t block anything. The freeze is stronger; the alert is easier to place because one bureau notifies the other two.

Is a credit freeze free?

Yes. Placing, lifting, and removing a freeze is free at all three nationwide credit bureaus, and has been since federal law made it so in September 2018.

Does a credit freeze hurt my credit score?

No. The CFPB states that security freezes do not impact your credit scores in any way whatsoever.

How long does it take to unfreeze my credit?

Within one hour if you request it by phone or secure electronic means, and no later than three business days if you request it by mail.

Do I have to freeze all three credit bureaus?

Yes, if you want meaningful protection. Each bureau maintains its own file, and freezing one has no effect on the others. This is the opposite of a fraud alert, where contacting one bureau is enough.

Can I still use my credit cards with a freeze in place?

Yes. A freeze affects new credit applications only. Your existing accounts keep working normally, and your existing creditors can still review your file.

Will a freeze stop someone from using my stolen card number?

No. A freeze does nothing about existing accounts. Card fraud is handled through your issuer’s dispute process, and the practical protection is transaction alerts plus reporting quickly.

How long does a fraud alert last?

An initial fraud alert lasts one year and can be renewed. An extended fraud alert, which requires an identity theft report, lasts seven years. An active duty alert lasts one year and can be renewed for the length of a deployment.

Do I need a police report for a fraud alert?

Not for an initial alert — that requires only identity verification. An extended alert requires an identity theft report, which you can generate at IdentityTheft.gov; some creditors or states may also want a police report.

Can I freeze my child’s credit?

Yes. A parent or guardian can freeze the file of a child under 16, and if the child has no credit file, the bureau must create one solely so it can be frozen. You’ll need documentation of your authority and the child’s identity.

Is a credit lock the same as a credit freeze?

No. A freeze is a legal right governed by federal law with required timeframes. A lock is a product governed by a contract with the bureau, sometimes carrying a fee. The CFPB’s position is that locks are no more effective than freezes, which are free and which you have a right to by law.

Does a freeze stop prescreened credit card offers?

Not automatically. To stop those, opt out separately through the industry opt-out service. An extended fraud alert does remove you from prescreened lists for five years, and an active duty alert for two.

Can a landlord or employer still check my credit if it’s frozen?

Generally not, if they use one of the frozen bureaus, so lift the freeze before an application that involves a credit check. The one-hour electronic lift makes this manageable, but it does need to happen first.

What if I lose my freeze PIN?

Each bureau has a recovery process requiring identity verification, which takes longer than a normal lift. Store the credentials in a password manager rather than relying on finding a letter later.

Should I freeze my credit if I’ve never had a problem?

For most people, yes. It’s free, has no effect on your score, lifts in about an hour when needed, and the main cost is a small amount of friction on the rare occasions you apply for new credit.

Does freezing my credit stop existing lenders from lowering my limit?

No. Existing creditors can still review your file for account management, which includes decisions about limits and terms. A freeze governs access by prospective creditors.

I froze all three bureaus. Why was an account still opened?

The most likely explanations are that the creditor used a bureau or specialty agency you didn’t freeze, or that the account isn’t credit at all — a bank account, utility connection, or phone contract opened through a different reporting agency. Check the specialty agencies and report the fraudulent account immediately.

Can I place a freeze if I don’t have a credit file yet?

Yes. If a bureau has no file for you, it must create one solely so the freeze can be applied — the same rule that lets a parent freeze a young child’s non-existent file. That record can’t be used for credit while frozen.

Does a freeze affect my ability to get a job?

It can, where an employer runs a credit check as part of background screening and uses a frozen bureau. Employment screening generally requires your written authorization, so you’ll know it’s coming — lift the freeze before you sign the authorization rather than after a delay appears.

What if a bureau refuses to place or lift my freeze?

The timeframes are set by federal law, not company policy. Document the request and the refusal, escalate within the bureau, and file a complaint with the Consumer Financial Protection Bureau, which forwards complaints to the company and requires a response.

Should I freeze my credit before or after I dispute fraudulent accounts?

Before. The freeze stops additional accounts from being opened while you work through the disputes, and disputing takes weeks. Freezing first also means the fraudulent activity you’re cleaning up is the complete set rather than a moving target.

Do I need to lift the freeze to refinance with my current lender?

Usually yes. A refinance is a new loan and involves a new credit pull even with the same institution, so treat it like any other application and lift the freeze first.

How to Verify These Numbers Yourself

Everything in this guide traces back to three official sources. The Consumer Financial Protection Bureau publishes consumer guidance on security freezes, including the required timeframes for placing and lifting them and its position on credit locks. The Federal Trade Commission’s consumer site sets out the three fraud alert types and their durations and runs IdentityTheft.gov, which generates the identity theft report that unlocks the extended alert and the right to block fraudulent information. The CFPB also publishes a list of consumer reporting companies, including the specialty agencies, with contact details and which ones accept freeze requests.

The durations and timeframes described here are set by federal statute and regulation rather than by company policy, so they’re stable. What changes more often is the specialty-agency landscape — names, ownership, and freeze procedures — so use the CFPB’s current list rather than a saved copy when you get to that step.

Key Terminology

Sources

• Consumer Financial Protection Bureau — What Is a Credit Freeze or Security Freeze?
• Consumer Financial Protection Bureau — Free Credit Freezes Are Here
• Federal Trade Commission — What to Know About Credit Freezes and Fraud Alerts
• Federal Trade Commission — IdentityTheft.gov
• Federal Trade Commission — Free Credit Freezes and Yearlong Fraud Alerts (September 2018)
• Consumer Financial Protection Bureau — List of Consumer Reporting Companies
• AnnualCreditReport.com — Free Credit Reports From All Three Bureaus
• Internal Revenue Service — Get an Identity Protection PIN

Methodology

Freeze timeframes — placement within one business day and removal within one hour for phone or secure electronic requests, and no later than three business days for mail requests — together with the statements that freezes are free and do not affect credit scores, and the rules permitting a parent or guardian to freeze the file of a child under 16, are drawn from Consumer Financial Protection Bureau consumer guidance accessed in September 2026. Fraud alert durations of one year for an initial alert, seven years for an extended alert, and one year renewable for an active duty alert, together with the rule that contacting one bureau for an alert obliges it to notify the other two, are drawn from Federal Trade Commission consumer guidance. The September 2018 effective date for free freezes and yearlong initial alerts reflects the Federal Trade Commission’s announcement of the federal law change. The CFPB’s comparison of credit locks and security freezes is quoted from its published guidance. Descriptions of specialty consumer reporting agencies are deliberately generic because names, ownership, and freeze procedures in that sector change; consult the CFPB’s current published list of consumer reporting companies for contact details and procedures rather than a saved copy. Nothing in this guide is a description of any specific bureau’s current web interface or phone menu, which each company controls and changes independently. This guide is educational and does not constitute legal advice; identity theft victims with significant losses may want to consult an attorney or a legal aid organization.