A reader emailed me the week after her employer announced a data breach — the kind of email that mentions Social Security numbers and offers a year of free monitoring, like that settles anything. She’d done a quick search and landed on two options, credit freeze and fraud alert, with about six competing articles telling her to do both, one, or neither. Her actual question was simpler than any of them answered: “I’m not a victim yet. I just want to not become one. Which do I actually do tonight?”
Here’s the short version, and then the reasoning underneath it: a credit freeze is a lock on the door, and a fraud alert is a note taped to it asking whoever answers to check ID first. Both are free under federal law, both protect against the same threat — someone opening new credit in your name — and they work in genuinely different ways. Which one fits depends less on how scared you are and more on one practical question: are you about to apply for credit yourself?
Key Takeaways
- A credit freeze blocks anyone — including you — from opening new credit until you lift it. A fraud alert just requires a lender to verify your identity before approving anything; it doesn’t block access.
- Both have been free for everyone since a 2018 federal law (the Economic Growth, Regulatory Relief, and Consumer Protection Act). Neither affects your credit score.
- A freeze must be placed and lifted separately at each bureau — Equifax, Experian, TransUnion, and the lesser-known fourth bureau, Innovis. A fraud alert only needs one request, and that bureau must notify the other two.
- An initial fraud alert lasts one year (renewable). An extended fraud alert, for confirmed identity theft victims with a police report or FTC affidavit, lasts seven years. Active-duty military alerts last one year.
- If you’re not applying for new credit soon, a freeze is the stronger default. If you’d rather manage one request instead of four, or you’re not shopping for credit and just want a lighter layer, a fraud alert is the lower-friction choice.
- You can use both at once — they’re not mutually exclusive, and plenty of people confirmed as identity theft victims do exactly that.
What a Credit Freeze Actually Does
A credit freeze — officially a security freeze — restricts access to your credit report entirely. When it’s on, a lender can’t pull your file to approve a new account, which means nobody can open a credit card, take out a loan, or get a new phone line financed in your name, because the application can’t even be evaluated. That includes you: if you want to apply for something yourself, you have to lift the freeze first, at whichever bureau the lender will check.
It doesn’t touch your existing accounts. Your current credit cards, auto loan, and mortgage keep working exactly as they did before — a freeze only blocks new lines of credit from being opened, and it has no effect on your credit score either way.
The Part Almost Nobody Mentions: There Are Four Bureaus, Not Three
Equifax, Experian, and TransUnion get all the attention, but a fourth, smaller bureau — Innovis — also maintains credit files, and some lenders, landlords, and utility companies pull from it. Freezing only the big three and skipping Innovis leaves a real gap, so if you’re freezing your credit as a genuine security measure rather than a formality, all four need the same request.
Since September 21, 2018, federal law has required credit freezes to be free for everyone, at every bureau, with no expiration date — it stays on until you lift it, however long that takes. When you place one, you’ll get a PIN or password; keep it somewhere you’ll actually find it, because that’s what you’ll use to lift the freeze later, usually instantly online.
What a Fraud Alert Actually Does
A fraud alert doesn’t block anything. Instead, it flags your file so that a business extending credit has to take an extra step — typically contacting you directly, by phone or another method you provide — to confirm you’re really the one applying before they approve it. Your existing accounts and your ability to apply for new credit both keep working; a legitimate application just takes one extra phone call to clear.
The upside people care about most: you only have to request a fraud alert at one bureau. Under the FCRA, that bureau is required to notify the other two on your behalf, so a single request covers your file everywhere, without the four-bureau chasing a freeze requires. It’s also free, and it does not affect your credit score.
The Three Types of Fraud Alert
- Initial fraud alert — lasts one year, renewable, and anyone can place one with no documentation required. This is the default option for someone who’s simply cautious, not yet a confirmed victim.
- Extended fraud alert — lasts seven years, but requires a police report or an FTC identity theft report (filed free at IdentityTheft.gov) confirming you’ve actually been victimized. It also removes you from prescreened credit card offers for five years, which most people in this position consider a feature, not a downside.
- Active duty alert — for military members deployed away from their usual duty station, lasting one year and renewable for the length of deployment, meant to guard against fraud while you’re not around to monitor your accounts closely.
Freeze vs. Alert, Side by Side
| Credit freeze | Fraud alert | |
|---|---|---|
| What it does | Blocks any new account from being opened, period, until lifted | Requires extra identity verification before a new account is approved |
| Where to request it | Separately at Equifax, Experian, TransUnion, and Innovis | One bureau; it notifies the other two for you |
| How long it lasts | Indefinite — until you lift it yourself | 1 year (initial), 7 years (extended, victims only), 1 year renewable (active duty) |
| Cost | Free by federal law since 2018 | Free |
| Effect on your applying for credit | You must lift it first, at the bureau the lender will check | Application proceeds normally after a verification call |
| Best suited for | Maximum protection when you’re not shopping for credit | Lighter-touch protection, or confirmed victims who want the 7-year version |
“A freeze asks ‘who goes there’ and doesn’t let anyone through until you say so. A fraud alert asks the same question and lets them through once you answer.”
So Which One Should You Actually Use?
Choose a freeze if you’re not planning to apply for new credit soon. If you’re not in the market for a card, loan, or lease that requires a credit pull in the next several months, a freeze is the stronger default — it’s the only one of the two that fully blocks a new account rather than just slowing it down. The four-bureau setup is mildly annoying once, and forgotten afterward, because it doesn’t expire.
Choose a fraud alert if you want less to manage, or you might apply for something soon. One request instead of four, and no need to remember to lift anything before you shop for a mortgage or a car loan next month. It’s the better fit for someone who’s cautious after a data breach notice but not actively fighting confirmed fraud.
Choose the extended fraud alert if you’re a confirmed identity theft victim. Seven years of protection, plus removal from prescreened offers, is worth the paperwork of a police report or an FTC identity theft report if someone has actually opened something in your name. Pair it with disputing any fraudulent account directly with the creditor and the bureaus — and if a collector starts pursuing a debt that was never yours to begin with, you have the same right to demand proof before paying that applies to any disputed collection.
Use both if you want to be thorough. Nothing stops you from freezing your credit and placing a fraud alert at the same time — the alert covers the narrow window it takes you to request freezes at all four bureaus, and the freeze becomes your standing protection afterward.
What Neither One Does
It’s worth being precise about the limits, because both get oversold in places that want to scare you into a paid product. Neither a freeze nor a fraud alert stops a thief from using an existing account of yours — a stolen card number or a hacked login isn’t touched by either one, and that’s a matter of watching your statements and, ideally, reading your credit reports periodically for anything you don’t recognize. Neither one is a substitute for actually checking your file; I’ve written separately about how accurate free monitoring tools like Credit Karma really are if you want a free way to keep an eye on things month to month. And neither one prevents non-credit fraud — someone filing a fraudulent tax return in your name, for instance, runs through an entirely different process.
How to Lift a Freeze When You Actually Need Credit
This is the step that trips people up, so it’s worth spelling out. When you place a freeze, each bureau gives you a PIN or password. To apply for something later — a car loan, a new card, an apartment that runs a credit check — you’ll need to lift the freeze at whatever bureau (or bureaus) that lender pulls from, which you often won’t know in advance, so it’s simplest to lift at all four before you start shopping. Online lifts are typically instant; you can also choose a temporary lift for a set window of days rather than lifting it indefinitely. This is the entire reason freezing makes sense mainly when you’re not about to need credit — the inconvenience shows up exactly when you’re trying to move fast on an approval.
Frequently Asked Questions
Does a credit freeze or fraud alert hurt your credit score?
No. Neither one has any effect on your credit score, in either direction. A freeze and a fraud alert both change who can access or act on your file, not what’s in it, and neither shows up as a factor in any scoring model.
Can I freeze my credit myself, or do I need to be a fraud victim?
Anyone can freeze their credit at any time, for any reason, with no documentation required — you don’t need to have experienced fraud. The same is true of an initial fraud alert. Only the seven-year extended fraud alert requires proof, in the form of a police report or an FTC identity theft report.
Do I need to freeze my credit at all four bureaus, or is three enough?
For real protection, all four. Equifax, Experian, and TransUnion cover most lending, but Innovis is a legitimate fourth bureau that some lenders, landlords, and utility providers check, and it’s commonly the one people forget. Freezing only three leaves that door unlocked.
How long does it take to lift a credit freeze?
Online, it’s typically instant or close to it. Requests made by phone or mail can legally take up to an hour by phone and up to three business days by mail, so if you’re applying for something with a deadline, lift online and do it before you need the credit, not the same afternoon.
Will a fraud alert stop all identity theft?
No. It only affects new credit applications, requiring a business to verify your identity first. It doesn’t protect an existing account from being misused, doesn’t stop non-credit fraud like a fraudulent tax return, and doesn’t monitor your accounts for you — it’s one layer, best paired with checking your statements and your credit reports regularly.
Is a credit freeze the same as a credit lock?
Not quite, though they’re often confused. A security freeze is the version created and protected by federal law, free everywhere, with a PIN-based system for lifting it. A “credit lock” is typically a bureau’s own branded product, sometimes bundled with a paid monitoring subscription, using an app toggle instead of a PIN. Functionally similar, but the freeze is the one guaranteed free and government-backed; read the terms before assuming a “lock” carries the same protections.
I told my reader to place an initial fraud alert that night — free, one request, done in ten minutes — and think about a full freeze over the following week once she’d confirmed whether she needed credit for anything in the near term. She didn’t, so she froze all four a few days later and hasn’t thought about it since. That’s really the whole decision: not how alarmed you should feel about a breach notice, but a plain question about your own next few months. Answer that, and the rest picks itself.
The Paystream shares information and frameworks to help you make your own decisions; it isn’t personalized legal or financial advice. Identity theft can get legally complicated fast, especially if fraudulent accounts have already been opened — consider filing a report at IdentityTheft.gov and, if needed, speaking with a consumer law attorney.
