Guide. Three tools, one of them free by law, one of them a subscription, one of them a sticky note on your file. Updated September 6, 2026.
Every breach notice ends with the same advice: freeze your credit. Then you open the bureau's site and it offers you a lock instead, for $9.99 a month, with a bigger button. The two are not the same thing, and the difference is written into federal law. Here is what each of the three tools does, which one stops a thief opening an account in your name, and the fifteen minutes that cover all three bureaus.
The security freeze: free, legal, and the one that works
A freeze blocks new lenders from pulling your report. No pull, no approval, no account. Under the federal law that took effect in 2018 a freeze costs nothing at any of the three bureaus, and the deadlines are set by statute: a bureau must place a freeze within one business day of an online or phone request, and lift it within one hour. By mail it has three business days.
What a freeze does not do: it does not stop charges on the cards you already have, it does not affect your score, and it does not block your own lenders from reviewing accounts you hold. You keep the free weekly reports and the score-tracking apps.
Parents can freeze a child's file for free until the child turns 16. A thief who takes a child's Social Security number can use it for years before anyone applies for a first card and finds a mortgage attached to it.
The credit lock: the same effect, a different promise
A lock switches access on and off from an app, often in seconds, and that convenience is real. What you give up is the legal footing. A freeze is a right under the Fair Credit Reporting Act with deadlines and penalties behind it. A lock is a service governed by the contract you accept when you sign up, and the bureau can change that contract, bundle the lock with a paid product, or cancel it.
Two rules keep this simple. If the lock is free and you want app-speed control, use it. If it costs a monthly fee, take the freeze instead and keep the money: the protection is the same and the law stands behind it.
The fraud alert: a note, not a wall
A fraud alert tells lenders to verify your identity before opening an account. It does not block the pull. A lender that skips the step still opens the account, and you argue about it afterward.
- Standard alert: one year, free, and one bureau must tell the other two.
- Extended alert: seven years for identity theft victims with an FTC report, and it also gets you two free reports from each bureau in the first year.
- Active duty alert: one year for deployed service members.
Use an alert when you want the file watched but expect to apply for credit soon. Use a freeze when nothing new should open, period.
The fifteen minutes
- Freeze all three. Equifax, Experian and TransUnion each need their own request. A freeze at one bureau leaves the other two open, and a lender pulls whichever it prefers.
- Save the PIN or the account login in your password manager, not in a note on your desk. A freeze you cannot lift becomes your problem the day you apply for a car loan.
- Freeze the two smaller bureaus most people miss: Innovis, and NCTUE for phone and utility accounts. Thieves open phone contracts where nobody froze.
- Pull all three reports at AnnualCreditReport.com, free every week, and read the accounts section line by line.
- Lift, do not remove. When you apply for something, thaw the one bureau that lender uses, for the days you need. Ask the lender which bureau it pulls; most will tell you.
Three mistakes that undo the work
- Freezing one bureau and calling it done. The most common gap of all.
- Paying for a lock that duplicates a free freeze. Read what the subscription adds beyond the lock: often it is monitoring you can get free elsewhere.
- Forgetting the freeze exists. A frozen file causes instant denials on store cards, phone upgrades and some rental applications. Thaw first, apply second.
If someone already opened an account
Start at IdentityTheft.gov. The FTC report it produces lets you block fraudulent items under the Fair Credit Reporting Act, and the bureau must act within four business days. Freeze after you file, then dispute each item in writing.
See the file the way a lender does. A Banrox three-bureau monitor tells you the day an account, an inquiry or an address appears on Experian, Equifax or TransUnion, which is how you find out a freeze slipped before a lender does. Want the letters ready? The Documents Lab has the dispute and block templates.
Sources
- CFPB: Free credit freezes are here
- FTC: What to know about credit freezes and fraud alerts
- FTC: IdentityTheft.gov
Educational content, not legal advice. Bureau procedures and lock products change; the freeze rights described here come from the Fair Credit Reporting Act.
