Credit freeze + fraud alert — the layered identity defense

Identity theft in the United States is a low-frequency but high-severity risk. About 23.9 million people, 9 percent of US residents age 16 or older, were victims of identity theft in 2021, with total losses of $16.4 billion, according to the Bureau of Justice Statistics; the median household-level damage when a theft does succeed runs into tens of hours of remediation work plus measurable credit-score damage that can persist for 12-24 months. The cost-benefit math of preventive defense at the credit-bureau level is so lopsided that consumer-protection regulators (CFPB), federal agencies (FTC), and security researchers (Krebs on Security and similar) universally recommend that every US adult place credit freezes at the three major bureaus, regardless of whether they have ever been hit.

This guide walks through the two free CFPB-mandated tools that defend at the credit-bureau level — credit freeze and fraud alert — explains how each works mechanically, how they stack as a layered defense, the 30-minute setup protocol across the three bureaus, and the typical operational moments when each tool kicks in.

The two tools and how they differ

Credit freeze (sometimes called “security freeze”) is a federally mandated no-cost lock on your credit file at each of the three major US credit bureaus (Experian, Equifax, TransUnion). Once frozen, the bureau refuses to release your credit file to any new lender — meaning a thief cannot open new credit cards, loans, or accounts in your name even with your full identity information, because the lender cannot underwrite without file access. The freeze does NOT affect:

• Your credit score
• Existing creditors’ periodic reviews
• Existing accounts (continue to function normally)
• Insurance underwriting (life, auto)
• Employment background checks (require separate consent)

The freeze persists until you actively lift it. Free at all three bureaus since September 2018 under the Economic Growth, Regulatory Relief, and Consumer Protection Act. Each bureau requires its own freeze request — there is no single point that freezes all three at once. Do not confuse a freeze with a credit lock (sometimes marketed as locking, blocking, or putting a “hold” on your credit): a lock is a separate, usually app-based product each bureau sells on its own terms, occasionally inside a paid subscription, while the freeze is the free, federally-backed equivalent — the two are compared in the FAQ below.

Fraud alert is a free flag on your credit file requiring lenders to take additional verification steps before extending new credit. Typically: the lender must call the phone number on file to confirm the applicant is the real account holder. The alert does NOT block credit access — it adds verification overhead. Three tiers:

• Standard fraud alert (1 year, free, anyone) — recommended for any household that has experienced or suspects identity theft.
• Extended fraud alert (7 years, free, requires identity-theft report from FTC or local police) — for households with confirmed identity-theft damage.
• Active-duty military fraud alert (1 year, free, for deployed service members) — adds protection during deployment when monitoring is hard.

Placing a fraud alert at ONE bureau automatically extends to the other two (under federal law), so this is a single phone call or web form to enable across all three.

The layered defense

Use both. The freeze is the always-on barrier; the fraud alert is the verification layer during the periods when you intentionally lift the freeze to apply for credit. The combined protection:

• Day-to-day (freeze in place + fraud alert): thieves cannot open new accounts in your name because the lender cannot access your file. Even if they could, the fraud alert requires phone verification.
• During a planned credit application (freeze temporarily lifted at one bureau + fraud alert still active): the lender you authorized can pull your file. But the fraud alert still requires them to verify your identity via phone, which thwarts the scenario where a thief learned of your application timing and tries to open competing accounts the same week.
• After the application is complete (freeze auto-reapplies after the temporary lift expires): back to the always-on protection.

The combined cost is zero (both tools are free since 2018) and the combined operational overhead is roughly 30 minutes of initial setup plus 15 minutes of “lift” work each time you apply for new credit (rare for most households — 1-3 times per year typical).

The 30-minute setup protocol

Step 1 — Set up your fraud alert (5 minutes). Call any one of the three bureaus or visit their fraud alert page; the alert auto-extends to the other two.

• Experian: experian.com/fraud — online, no account needed
• Equifax: equifax.com/personal/credit-report-services — online or 1-888-298-0045
• TransUnion: transunion.com/credit-help — online or 1-800-680-7289

Set a 1-year standard alert. Set a calendar reminder for 11 months later to renew (alerts are not auto-renewed; if you forget, the alert expires).

Step 2 — Place credit freeze at Experian (10 minutes). Go to experian.com/freeze. Create an Experian account if you don’t have one (free). Verify your identity via knowledge-based questions (previous addresses, account balances, etc.). Place the freeze. Save the PIN/password (Experian uses a PIN historically; current process may require login).

Step 3 — Place credit freeze at Equifax (10 minutes). Go to equifax.com/personal/credit-report-services. Create an Equifax account. Verify identity. Place the freeze. Save the PIN.

Step 4 — Place credit freeze at TransUnion (10 minutes). Go to transunion.com/credit-freeze. Create an account. Verify identity. Place the freeze. Save the PIN.

Step 5 — Document and store the PINs/passwords. Save all three bureau PINs in your password manager (1Password, Bitwarden, Apple Keychain). Loss of the PIN can be recovered via identity verification call but adds significant friction (30-60 minute call).

After Step 5, you have universal freeze coverage plus fraud alert overlay. This is the level of identity defense recommended by every major US consumer-protection organization.

Temporarily lifting the freeze

When you need to apply for new credit (mortgage, auto loan, new credit card, apartment lease, sometimes employment background check), you must temporarily lift the freeze at the bureau the lender or screener will pull.

Step 1 — Identify the bureau. Ask the lender or application form which credit bureau they use. Most credit card issuers favor Experian or Equifax; mortgages typically pull all three; auto loans vary; apartment screeners typically use Experian or TransUnion. If unsure, lift at all three bureaus to be safe.

Step 2 — Lift at the specific bureau(s) for the specific time window. Log into the bureau’s account, navigate to the freeze section, choose “temporary lift” for a specific number of days (typically 1-30, your choice). The bureau lifts within 1 hour (online) and the freeze auto-reapplies at the end of the window.

Step 3 — Complete the credit application within the lift window. The lender pulls your file successfully, underwrites, and decides.

Step 4 — Confirm the freeze reapplied. Most bureaus send an email confirmation when the freeze reapplies. If you don’t see one within 24 hours of the lift window expiration, log in and verify the freeze status manually.

The lift mechanism is the operational cost of the freeze protection. For most households, this is 1-3 events per year for typical credit applications. The cost in time (15-30 minutes per lift) is trivial compared to the universal protection the freeze provides.

What the freeze does NOT block

The freeze is powerful but not omnipotent. Specific things it does NOT prevent:

• Existing creditor activity — your existing credit cards, mortgage, auto loans continue to function normally regardless of the freeze. Existing creditors can request your file for periodic reviews (credit limit changes, account closures, soft pulls).
• Pre-approved credit offers — these are handled via a separate opt-out at optoutprescreen.com. The freeze does not automatically opt you out of pre-approved offers, which are driven by creditors’ pre-screening of credit bureau data via “firm offer of credit” exemption.
• Tax refund identity theft — a thief filing a fraudulent federal tax return in your name to claim a refund does not require credit-bureau access. The defense is the IRS Identity Protection PIN (IP PIN), a separate 6-digit code issued annually by the IRS via irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin.
• Account takeover of existing accounts — if a thief gains access to your existing online banking or credit card account credentials, the freeze does not stop them. Multi-factor authentication (MFA) on every financial account is the relevant defense.
• Phone / SIM swap attacks — moving your phone number to a thief’s SIM to intercept MFA codes. The defense is “port out PIN” or “account PIN” at your carrier (T-Mobile, Verizon, AT&T) plus moving MFA from SMS to authenticator apps.

The credit freeze + fraud alert combination covers the new-credit-application attack vector specifically. Comprehensive identity protection requires the additional layers above.

What to do if you’re hit anyway

If despite the protection you discover identity theft (e.g., a new account opened in your name appears on a credit report you pull):

1. File an FTC identity theft report at identitytheft.gov. This produces a personalized recovery plan and the official report needed for extended fraud alert (7-year tier).
2. Place an extended fraud alert using the FTC report at any one bureau (auto-extends).
3. Place credit freezes if not already in place.
4. Block the fraudulent accounts. With the FTC identity theft report from step 1 in hand, you can demand a 15 U.S.C. 1681c-2 identity-theft block, which forces the bureau to delete a fraudulent tradeline within four business days — faster and more surgical than a generic dispute, which the lenders must otherwise resolve within 30 days.
5. Monitor monthly via annualcreditreport.com (free weekly reports, made permanent in September 2023) for any further fraudulent activity.
6. Consider Identity Theft Insurance — sometimes included in homeowners or credit-card benefits; covers monitoring services and lost time during remediation.

Our dispute guide at /credit/disputing-credit-report-errors/ walks through the FCRA dispute process in detail, and the full set of consumer rights the Fair Credit Reporting Act guarantees — dispute deadlines, the 7-year rule, permissible purpose — has its own explainer.

What this guide does not cover

This guide focused on US-resident credit-bureau-level identity defense via freeze and fraud alert. It does not cover:

• IRS Identity Protection PIN — separate tax-related identity defense
• Phone carrier port-out PIN — separate phone-account defense
• MFA / authenticator apps — separate account-takeover defense
• Dark web monitoring services — supplementary tools sold by Experian, LifeLock, and credit-card benefit programs, marginal additional value beyond the freeze + alert + IRS PIN basics
• Identity theft remediation after a hit — full process beyond the brief overview above

For preventive defense at the credit-bureau level, the framework above is complete.

What to verify

• CFPB freeze guide: consumerfinance.gov/ask-cfpb/what-is-a-security-freeze-en-1353/
• CFPB fraud alert guide: consumerfinance.gov/ask-cfpb/what-is-a-fraud-alert-en-1349/
• FTC identity theft resource: identitytheft.gov
• Bureau freeze portals: experian.com/freeze, equifax.com/personal/credit-report-services, transunion.com/credit-freeze
• Free credit reports (weekly, made permanent in September 2023): annualcreditreport.com
• BJS — Victims of Identity Theft, 2021 (23.9 million victims, 9% of US residents 16+, $16.4 billion in losses): bjs.ojp.gov/library/publications/victims-identity-theft-2021

The structural mechanics in this guide are stable. What occasionally changes: specific bureau portal URLs (rarely), FTC remediation form layout. Verify links before relying on them for an actual freeze setup; the bureaus reorganize their consumer-facing pages periodically.