Two federal tools let consumers make it harder for a thief to open credit in their name: the credit freeze and the fraud alert. This article explains how each one works, what changed in 2018 to make them free, and where each falls short.
Two tools, one goal
Both protections attach to your credit files at the three nationwide credit reporting companies: Equifax, Experian and TransUnion. Lenders usually check one of those files before approving a loan or card, so tampering with that check is the point of leverage.
The two tools pull on that lever differently. According to the Consumer Financial Protection Bureau (CFPB), a security freeze “prevents new creditors from accessing your credit file,” and because most businesses will not open a credit account without checking a report, a freeze can stop an identity thief from opening accounts in your name. A fraud alert, by contrast, leaves the file open but requires creditors who check it to take steps to verify your identity before opening a new account, issuing an additional card or raising a credit limit.
What does a credit freeze actually do?
A freeze locks the door to your file. The Federal Trade Commission (FTC) describes the effect this way: no one, including the consumer, can access the credit report to open a new account while the freeze is in place. Since lenders generally will not extend credit without seeing a file, new applications, including legitimate ones you make yourself, will usually stall until the freeze is lifted.
A few details from the CFPB are worth knowing:
- A freeze has no effect on your credit scores.
- You can still request and review your own credit files while frozen.
- It does not stop companies that already hold an account with you, certain government entities such as child support agencies, or companies you have hired to monitor your file from seeing it.
- It does not apply to requests made for employment, tenant-screening or insurance purposes.
That last point matters. A freeze is aimed at new credit, not at every kind of background check.
What does a fraud alert do instead?
A fraud alert is a flag on your file. When a business pulls your report, the flag tells it to try to verify your identity before extending new credit. The FTC notes that a business “must try to verify a consumer’s identity before extending new credit.” Verification might mean a phone call to a number you supplied.
An alert is lighter-touch than a freeze. Because the file stays accessible, you generally do not have to unlock anything when you apply for a loan yourself. The trade-off is that an alert relies on the lender actually following the verification step, while a freeze blocks access at the source.
There are two main types of alert:
- Initial fraud alert: Free, and since September 21, 2018, it lasts one year instead of the previous 90 days. It expires automatically unless renewed.
- Extended fraud alert: Lasts seven years and is available only to identity theft victims, who must mail or upload an Identity Theft Report. According to the FTC, that report can be created at IdentityTheft.gov.
Freeze versus alert at a glance
| Feature | Credit freeze | Initial fraud alert |
|---|---|---|
| Cost | Free | Free |
| How it works | Blocks new creditors from accessing the file | Requires creditors to verify identity |
| Duration | Until you lift or remove it (in almost all states) | One year, then renewable |
| Where to place it | Each of the three bureaus separately | One bureau, which notifies the other two |
| Effect on your own applications | Must temporarily lift first | Lenders may ask extra verification questions |
| Effect on credit scores | None | Not described as affecting scores |
The FTC adds one caveat on duration: in a few states, a freeze expires after seven years, while in almost all states it lasts until the consumer lifts or removes it.
How do you place or lift a freeze?
The process runs through each bureau’s own website or phone line, and it has to be repeated at all three. A freeze at one bureau does nothing at the others, which is why a thief who is turned away at one company might simply be approved by a lender that checks another.
Federal timing rules, as described by the FTC and the CFPB, are:
- Placing a freeze: By phone or secure online request, the bureau must act within one business day. By mail, it has up to three business days.
- Confirmation: You should receive written confirmation within five business days, including instructions for removing the freeze.
- Lifting a freeze: By phone or secure online request, the bureau must act within one hour. By mail, it can take up to three business days.
- Temporary lifts: You can lift a freeze for a period you choose, at no charge, on the same timelines.
The FTC adds that a consumer typically receives a PIN to freeze, unfreeze and refreeze the file. Keeping that PIN somewhere safe is part of the cost of using the tool.
What changed in 2018, and does it still matter?
Before September 21, 2018, freezes were free for identity theft victims in most states, but elsewhere the FTC reported fees of about $5 to $10 per freeze or unfreeze with each bureau, depending on state law. With three bureaus, those fees could add up quickly, which discouraged people from using the tool.
A federal law that took effect on that date made freezes free for everyone and lengthened initial fraud alerts from 90 days to one year, according to the FTC. It also allowed parents to freeze the file of a child under 16 for free, and guardians, conservators and holders of a valid power of attorney to do the same for dependents.
The CFPB confirms that today freezes are free, and that “credit locks,” which bureaus may offer for a fee, are no more effective than freezes. Locks are a product marketed by the companies, whereas a freeze is a right set out in federal law.
Can a child or an older relative be protected too?
Yes. The CFPB says children under 16, incapacitated persons, and people with an appointed guardian can be frozen, and a parent or guardian can request it. If no credit file exists for the child, the bureau creates a record in order to freeze it, and that record cannot be used for credit purposes.
This is worth considering because a child’s file is normally empty, so misuse can go unnoticed for years. A freeze keeps any such file closed until the child is old enough to use credit.
When does a freeze get in the way?
The main cost of a freeze is friction. If you are about to apply for a mortgage, car loan, student loan or even a new credit card, you will need to lift the freeze at whichever bureaus the lender uses, and re-freeze afterward. The FTC says consumers planning to apply for new credit soon should weigh the hassle of unfreezing and refreezing.
Illustrative arithmetic helps show the practical shape. Suppose a household plans a car loan in three months and does not know which bureau the lender will check. Lifting the freeze at all three takes three separate requests. If those are made online, each must take effect within an hour under the federal timing rules described above. After the loan closes, three more requests re-freeze the files. That is six requests in total, and they cost nothing, but they take planning. If the lender names its bureau in advance, a single temporary lift might be enough.
A fraud alert avoids most of that effort, but it also offers weaker protection, because it asks lenders to verify identity rather than preventing access.
What neither tool can do
Neither protection is a complete shield. The FTC points out that fraud alerts and freezes do not stop someone from extending credit; they affect whether a lender checks the file or is told to verify identity. Neither covers existing accounts either. If a thief takes over your current card or bank login, a freeze on new credit does nothing to stop that.
Account takeover and impostor schemes are a separate threat. Readers can see how that works in coverage of how fake security alerts fuel billions in imposter scams and in what FTC data shows about social media scams. Paying close attention to statements still matters, especially for accounts that carry balances, as discussed in what a 22% credit card APR really costs.
Households that build a cash cushion also have more room to absorb a fraud loss while a dispute is resolved, a point covered in a practical guide to building an emergency fund.
Choosing between them: a framework, not a verdict
Based on the features above, the general logic looks like this:
- No known theft, low appetite for friction: An initial fraud alert is free, takes one contact, and is easy to renew.
- Wanting the strongest block on new credit: A freeze at all three bureaus stops creditors from accessing the files at all, at no cost.
- Confirmed identity theft: The extended seven-year alert becomes available with an Identity Theft Report, and a freeze can be used alongside it.
The two tools are not mutually exclusive. The CFPB describes them as distinct options with different mechanics, and consumers can place either or both depending on their circumstances.
Conclusion: free protection with a small admin bill
Since 2018, cost is no longer the obstacle to using these tools. What remains is attention: three bureaus to contact for a freeze, one year before an alert needs renewing, and a PIN to keep safe. A freeze gives the stronger lock on new credit, a fraud alert the lighter touch, and neither replaces watching your accounts. Readers weighing the options can find current instructions on each bureau’s website and at IdentityTheft.gov.
This article is general information, not financial or legal advice.
Sources: Consumer Financial Protection Bureau; Federal Trade Commission
