Credit Freeze, Fraud Alert, or Credit Lock: Which One to Use, and When

A data-breach notice arrived, and buried in it is a list of things you “may wish to consider.” A credit freeze. A fraud alert. Maybe a credit lock, if the company offering it happens to sell one. They are presented as interchangeable. They are not, and one of the three is not even a legal right.

The distinction is not academic. A credit freeze is a federal right with statutory deadlines attached; a fraud alert is a warning to lenders; a credit lock is a product you buy, governed by a contract rather than a statute. Choosing the wrong one can leave you either less protected than you think or paying for something the law gives you free.

The three tools, compared

	Security freeze	Initial fraud alert	Extended fraud alert	Credit lock
What it does	Blocks the bureau from releasing your file to a new creditor	Tells lenders to verify your identity first	Same as initial, with stricter contact requirement	Whatever the contract says
Blocks new accounts	Yes	No — it flags the file	No — but contact is required	Yes, per the bureau’s terms
Who can place it	Anyone, any time, no reason needed	Anyone who suspects identity theft	Identity theft victims with an FTC or police report	Anyone who enrolls
How long	Until you lift it	1 year, renewable	7 years, renewable	While enrolled
Cost	Free	Free	Free	Varies; often a paid product
How to place	Each of the three bureaus	One bureau, which notifies the other two	One bureau, which notifies the other two	The provider
Legal basis	15 U.S.C. § 1681c-1(i)	15 U.S.C. § 1681c-1(a)	15 U.S.C. § 1681c-1(b)	Contract, not statute

The freeze is the only one with a deadline the bureau must meet

This is the practical difference, and it is why the freeze is usually the right first move.

Because a security freeze is written into the statute, the timing is not a customer-service question. Under 15 U.S.C. § 1681c-1(i), a nationwide bureau must place a freeze within one business day of a request made by phone or secure electronic means, and remove it within one hour of such a request. Mail requests get three business days. These are enforceable obligations, not targets: the CFPB’s 2023 consent order against TransUnion turned in part on failures to place and remove freezes inside exactly those windows.

A credit lock has no such timetable. The bureau can define the terms, and what it can turn on quickly it can also turn off according to its own rules.

Two more facts about a freeze that people routinely get wrong:

• It does not change your credit score. The FTC states this plainly. The score keeps updating from your existing accounts, freeze or no freeze.
• It does not stop you from using existing cards. It blocks new creditors from pulling the file. Your current accounts work normally.

When a fraud alert is the better choice

The freeze is stronger, but “stronger” is not automatically “right.” A fraud alert leaves your file visible and adds a verification step — which is exactly what you want in two situations the FTC singles out.

You suspect fraud but have not confirmed it. An initial fraud alert needs no proof, no report, and no reason. If you are in the early, uncertain phase after a breach notice, it is a cheap way to raise the cost of someone opening an account while you find out whether anything actually happened. It lasts one year and renews.

You need your file to stay accessible. Applying for a mortgage, renting an apartment, or taking a job that screens credit: a freeze you have to lift and re-place around every one of those, while an alert simply makes the lender confirm you.

If identity theft has actually happened, the calculus changes. With a completed FTC identity theft report from IdentityTheft.gov (or a police report), you qualify for an extended fraud alert — seven years instead of one, plus automatic removal from the bureaus’ prescreened credit and insurance offer lists for five years. That longer duration, not the alert itself, is the main reason to file the report.

The widespread 90-day error

If you search for how long an initial fraud alert lasts, a great deal of material still says 90 days. That was the original FACT Act period. It has been wrong since September 21, 2018, when the Economic Growth, Regulatory Relief, and Consumer Protection Act extended it to a full year and simultaneously made security freezes free in every state.

Before that law, states set their own freeze rules and many allowed bureaus to charge a few dollars per action. That patchwork is gone: no bureau may charge for placing, lifting, or removing a freeze. If a page tells you an alert lasts 90 days, or quotes a freeze fee, it is working from pre-2018 law and you should check its other claims before relying on them.

A sequence that covers most situations

When a breach notice names your Social Security number, four steps in order:

1. Check your reports first. Get them free from AnnualCreditReport.com and look for accounts you do not recognize. This tells you whether anything has already been opened, which changes everything that follows.
2. Place a freeze with all three bureaus. Equifax, Experian, and TransUnion, individually — the one-bureau-shortcut applies to alerts, not freezes. It is free and takes minutes online.
3. If you suspect but cannot confirm fraud, add an initial fraud alert. It stacks with the freeze; you do not have to choose.
4. If you confirm fraud, file the report at IdentityTheft.gov. That unlocks the seven-year extended alert and produces a personal recovery plan, and the report is also what a bureau needs before it can block fraudulent information from your file.

One limit worth stating before you rely on any of this: a freeze and an alert both act on your credit file. Neither secures a bank account, an email account, or a password. If what was exposed was login credentials rather than a Social Security number, the credit tools do nothing for you — change the reused passwords and turn on multi-factor authentication, because those are separate problems with separate fixes. A credit-file tool is not an account-security tool, and treating the first as a substitute for the second is the most common mistake in this whole area.

The bottom line

If you are unsure, freeze all three files and add an initial fraud alert — both are free, both are statutory, and neither harms your score. Use a credit lock only if you specifically want the app-based convenience and understand that you are buying a product, not exercising a right. And treat any source that still says 90 days as a sign to check the rest of its numbers.

Byte is the technology site of the Omni Mundi Compendium network. How federal agencies describe their own technology work is covered in Why Federal Websites Now Say “SI”, and the scam patterns that follow a new federal service are in the America.gov scam checklist.

This article is general information about federal consumer-protection law, not legal advice. It is AI-written and independently AI-reviewed before publication; the review standard and this article’s findings are recorded in the network’s editorial review log.