Independent. No paid placements.Reviewed as findings changeEditorial policyNewsletter
The Credit RecordAn independent record of credit repair and debt settlement companies

Last reviewed: 14 September 2026

Home › The Library › Freezes, locks & fraud alerts

Credit freezes, credit locks, and fraud alerts: what's actually different

All three get marketed as roughly the same thing: a way to stop someone else from opening credit in your name. Only one of them is a free federal right with a legal deadline attached. The other two are real tools too, but they work differently, and one of them is a private contract you're agreeing to, not a law protecting you.

Three tools, one goal, different footing

A security freeze blocks a credit bureau from releasing your file to a new creditor at all, until you lift it. A fraud alert doesn't block anything — it just requires a business to take extra steps to verify your identity before extending new credit. A credit lock is marketed as doing roughly what a freeze does, but it's a bureau product governed by that bureau's own terms of service, not by the statute that governs a freeze. That last distinction is the one most people never hear, and it's the one that actually matters if something goes wrong.

The security freeze: free nationwide since 2018, with a legal deadline to lift it

A security freeze was, for its first 15 years, a state-by-state right, not a federal one. California passed the first state freeze law in 2003; other states followed unevenly, and by November 2007 all three bureaus had voluntarily extended freezes to every state that hadn't yet passed its own law, so freezing was available nationwide — but under a patchwork of different state rules, and in most states for a fee, commonly $5 to $10 per freeze or thaw. That changed after the 2017 Equifax breach: the Economic Growth, Regulatory Relief, and Consumer Protection Act, signed 24 May 2018, created the first federal security-freeze right. Effective 21 September 2018, it amended the FCRA (15 U.S.C. § 1681c-1) to require Equifax, Experian, and TransUnion to place and lift a security freeze free of charge, for everyone, nationwide, superseding the old state-by-state fee patchwork — no identity-theft report required, just a request.

A freeze doesn't erase anything already on your file, and it doesn't affect your credit score. It also doesn't block everyone: existing creditors you already do business with, debt collectors acting on their behalf, government agencies responding to a court order or subpoena, and your own requests for your own report can still go through. What it blocks is a new lender pulling your file to open a new account you didn't apply for.

The statute also sets a specific deadline for lifting one: once you request a freeze be removed, using the same phone number or electronic method the bureau gave you when you placed it, the bureau must lift it within one hour if the request came by phone or secure electronic means, or within three business days if it came by mail. A separate provision, added by the same 2018 law, lets a parent or guardian freeze a file for a child under 16, or a court-appointed guardian freeze one for an incapacitated adult, on the same free, no-fee basis.

To place a freeze: you have to contact all three bureaus separately — Equifax, Experian, and TransUnion each maintain their own freeze system, and freezing one does not freeze the others. Keep the PIN or login credentials each bureau gives you; you'll need them to lift the freeze later.

Fraud alerts: three different lengths, and they don't block anything

A fraud alert, also created by the FCRA (15 U.S.C. § 1681c-1) and free at every duration, works differently: it doesn't stop a new account from being opened, it requires whoever is checking your file to verify your identity — commonly by calling a phone number you provide — before granting new credit in your name. Placing an alert with any one of the three bureaus requires that bureau to notify the other two, so you only have to place it once. There are three versions:

The credit lock: convenient, but it's a contract, not a statute

A "credit lock" is a product each bureau sells (or bundles into a paid monitoring plan) that toggles access to your file on and off, often through an app, faster and with less friction than the formal freeze process. Functionally it can feel similar to a freeze. Legally it isn't the same thing: a lock exists under the bureau's own terms of service, which the bureau can write and change unilaterally, and which — depending on the specific product — can include an arbitration clause limiting your ability to sue over a failure. A freeze exists under a federal statute with a specific one-hour/three-business-day deadline written into it and a private right of action if a bureau doesn't comply. Consumer Reports and the Consumers Union have made the same point directly: a contractual protection you can be talked out of isn't as strong as a statutory one a bureau simply has to follow.

In practice: a free security freeze does everything a paid or app-based "lock" claims to do, backed by a federal law instead of a bureau's own terms of service. Before paying anything — monthly or one-time — for a "lock" or "monitoring" product, place the free freeze first and decide if you actually need more.

None of this is a substitute for a real Social Security number

All three of these are legitimate, free (or freeze- and alert-wise, entirely free) tools built into federal law for protecting the credit file you actually have. That's worth being explicit about, because it's the opposite of what a "credit profile number" pitch offers — see our CPN scams explainer for why a company selling a supposed fresh-start number is offering a federal crime, not a faster version of what a freeze already does for free.

Related: see our warning-signs checklist for what else tends to show up alongside a pitch to sell you identity-protection products you don't need, and what credit repair actually is for the separate right to dispute something already on your report.

References

  1. Fair Credit Reporting Act § 605A, 15 U.S.C. § 1681c-1 (identity theft prevention; fraud alerts and active duty alerts), as amended by the Economic Growth, Regulatory Relief, and Consumer Protection Act, Pub. L. No. 115-174, § 301 (signed 24 May 2018, freeze and alert provisions effective 21 September 2018) — both the fraud-alert framework and the new national security-freeze provisions the 2018 Act added to this same FCRA section: nationwide free security freezes, extension of the initial fraud alert from 90 days to one year, the one-hour/three-business-day freeze-removal deadline, and the free protected-consumer freeze for a minor under 16 or an incapacitated adult (§ 1681c-1(j)). (Note: 15 U.S.C. § 1681c-2, a separate FCRA section, covers only the unrelated identity-theft information-blocking procedure and is not the freeze provision.)
  2. Federal Trade Commission, "Extended Fraud Alerts and Credit Freezes" and "Free Credit Freezes Are Here" consumer guidance (mechanics of placing/lifting a freeze at each bureau separately; fraud alert duration and identity-theft-report requirement for the extended alert).
  3. North Carolina Bar Association and Consumer Data Industry Association materials on the pre-2018 state security-freeze patchwork (California's 2003 law as the first in the nation; nationwide bureau-voluntary freeze availability by November 2007; the 2017 Equifax breach as the impetus for the 2018 federal law) and Consumer Financial Protection Bureau/Federal Trade Commission guidance on the 2018 Economic Growth, Regulatory Relief, and Consumer Protection Act amendments establishing the first federal freeze mandate.
  4. Consumer Reports, "Why a Free Credit Freeze Is Better Than a Credit Lock" (contractual, bureau-set terms-of-service basis for a credit lock — including potential arbitration clauses — versus the statutory basis and private right of action for a security freeze; comments from Consumers Union staff attorney Christina Tetreault).
  5. Equifax, Experian, and TransUnion, respective published credit-lock terms of service and credit-freeze consumer guidance (confirming each bureau requires a separate freeze/lock request and that a credit lock is offered under that bureau's own service agreement, not the federal freeze statute).

Related