Credit freezes and fraud alerts: the free identity protection

What a credit freeze does

A credit freeze locks your credit reports at Equifax, Experian, and TransUnion. While it is in place, lenders cannot pull your report, and because lenders rarely grant credit without checking a report, nobody — including an identity thief — can open a new account in your name. The FTC’s guidance is blunt: “While a credit freeze is in place, nobody can open a new credit account in your name.”

The freeze does not affect your credit score, does not stop you using your existing cards, and does not prevent you from applying for credit when you need to — you just lift the freeze first, which you can do free and usually in minutes.

What a fraud alert does

A fraud alert does not block access to your credit report — it makes lenders verify you before opening a new account. The FTC explains that the alert “tells businesses to check with you before opening a new credit account in your name. Usually, that means contacting you first to make sure the person trying to open a new account is really you.”

There are three flavors. An initial fraud alert lasts one year and is available to anyone who suspects they may be affected by identity theft. An extended fraud alert lasts seven years and requires an FTC identity theft report or police report. An active duty alert covers deployed service members. All three are free.

Freeze vs. alert: which one

The FTC’s framing is that a freeze is the strongest protection and “a great place to start,” while a fraud alert is a lighter layer that does not get in your own way. Many people run both: a freeze as the permanent baseline, an alert layered on top if they have reason to believe they are a target.

If you have been in a data breach, lost a wallet, or been phished, the alert is the faster step to take while you sort the freeze out. If you simply want the strongest default, place the freeze — the FTC says anyone can do it “any time” and for any reason, without waiting for an incident.

How to place them

1. Freeze: contact all three bureaus Equifax, Experian, and TransUnion each get their own freeze request. You get a PIN or one-time code from each, which you use to lift the freeze later.
2. Alert: contact just one For a fraud alert you contact a single bureau — that bureau must tell the other two. Keep the alert’s reference number.
3. Keep your freeze PINs safe You need them to lift the freeze when you apply for credit. Store them somewhere you can find them — a password manager works.
4. Lift only what you need When applying for a card or loan, lift the freeze at just the bureau the lender checks, then re-freeze when done.

What they do not do

Neither tool stops a thief from using an existing credit card or draining your bank account — they only block the opening of new credit in your name. That is why the FTC pairs them with the rest of the routine: reviewing statements, watching for unfamiliar accounts, and reporting identity theft at IdentityTheft.gov if it happens.

The “free” part is worth repeating because the market wants you to forget it. Credit monitoring services, identity monitoring, and “protection” products sell what a freeze and a few statements accomplish at no cost. The FTC’s identity theft guidance makes the same point — the paid services are conveniences, not protections the law does not already give you.