Fraud Alert vs. Credit Freeze vs. Lock: Which and When
A freeze, fraud alert, and bureau lock are different controls; choose based on whether you need to block access, add verification friction, or use a bureau product.
A security freeze is the strongest of these three tools for restricting access to a credit file used in many new-account decisions. It is free, you place it separately at Equifax, Experian, and TransUnion, and it stays until you lift or remove it. An initial fraud alert is different: you contact one nationwide bureau, that bureau notifies the other two, and the alert normally lasts one year. An extended alert can last seven years for qualifying identity-theft victims. A “credit lock” is a bureau product, not the federal security-freeze right. None of the three reverses fraud on an account that is already open.
Start with the question you are trying to answer
If your concern is “Can a lender access my file to open a new credit account?”, a freeze directly addresses that access. If your concern is “I want a lender to take extra steps because my identity may be at risk,” a fraud alert adds a verification signal without closing access to the report. If your concern is convenience inside a bureau’s app, a lock may offer product features, but its terms can differ from a statutory freeze. Choosing by outcome prevents the common mistake of paying for or enabling a tool whose name sounds protective while leaving the actual risk unchanged.
A freeze is especially useful when an SSN and date of birth were exposed, when a new account has already appeared, or when you simply do not expect to apply for credit soon. It does not hurt your existing credit accounts and it does not prevent you from checking your own report. When you legitimately apply for a mortgage, apartment, card, or loan, lift the freeze for the bureau and time window the application requires, then let it return to frozen status.
Fraud alerts are fast and intentionally lighter
FTC guidance says an initial fraud alert lasts one year. You only need to contact one of the three nationwide bureaus, and that bureau must tell the other two. The alert tells businesses that check your report to take steps to verify your identity before opening new credit. That can be useful immediately after suspected identity theft when you are still organizing the situation, or when you want an extra identity-verification signal but do not want to manage three freezes.
An extended fraud alert is for identity-theft victims who satisfy the documentation requirements and lasts seven years. It is not simply a longer version you select because you prefer it. Review the bureau’s current instructions about the identity-theft report or other documentation needed. If you already use freezes, the alert can be redundant for some new-credit situations but may still have value as a separate signal; the tools are allowed to coexist.
A lock is not a synonym for a freeze
Bureaus market locks through apps or paid products because locks can be toggled quickly and bundled with monitoring. The problem is linguistic: consumers often say “my credit is locked” and assume they have exercised the federal freeze right. Read the product terms. Ask whether the feature affects only that bureau, whether a subscription is required, how disputes are handled, and what happens if you cancel. If your goal is the legal security freeze described by the FTC, use the bureau’s dedicated freeze flow rather than relying on a similarly named product.
| Control | Primary job | How long | How you place it | Main limitation |
|---|---|---|---|---|
| Security freeze | Restricts access to a bureau file for many new-credit decisions | Until you lift or remove it | Separately at Equifax, Experian, and TransUnion | Does not stop fraud on existing accounts |
| Initial fraud alert | Tells prospective creditors to take added identity-verification steps | Normally one year | Contact one nationwide bureau; it notifies the other two | File remains accessible to creditors |
| Extended fraud alert | Longer verification signal for qualifying identity-theft victims | Seven years under FTC guidance | Follow the bureau’s identity-theft documentation process | Not a substitute for correcting fraudulent tradelines |
| Credit lock | Bureau product or service feature | Depends on product terms | Through the specific bureau product | Not the same statutory protection as a freeze |
The right choice can change during recovery
Imagine a breach notice says your SSN was exposed but no fraudulent account exists. A three-bureau freeze may be a clean preventive move. Now imagine a card was already opened in your name: keep the freeze to reduce additional applications, but separately close the account and use the dispute or identity-theft block process for the tradeline. Finally, imagine you are shopping for a mortgage next week: you can temporarily lift the necessary freeze rather than abandoning protection for months. The control should follow the stage of the incident, not become a permanent ritual disconnected from what you are doing.
What these tools cannot protect
A freeze does not stop an attacker who already has your bank password, card number, email session, or mobile-phone account. A fraud alert does not inspect every transaction. A bureau lock does not secure your tax identity, medical records, mail, or Social Security earnings record. If evidence points to account takeover, SIM swapping, tax identity theft, or another non-credit channel, use the control for that system. Identity protection works best as a set of narrow barriers rather than one master switch.
- □ Record the status of all three bureau freezes instead of assuming one action covered the other two.
- □ Save the date an initial or extended fraud alert was placed so you know when it is scheduled to expire.
- □ Before a legitimate application, ask which bureau will be pulled and whether a temporary lift is sufficient.
- □ Keep freeze and lock credentials in a password manager or another durable recovery method, not only on one phone.
- □ After known fraud, correct the fraudulent account or report entry separately; preventive controls do not rewrite past records.
A practical default for most high-risk cases
When a person is not actively applying for credit and believes sensitive identity data may be exposed, a free freeze at all three bureaus is usually the clearest preventive baseline. Add a fraud alert when its verification signal is useful, and treat locks as optional product features rather than replacements for the statutory tool. Revisit the choice when you apply for credit or when evidence shows that the threat is actually in an existing account, tax record, telecom account, or another system a credit freeze cannot touch.
Questions specific to Fraud Alert vs. Credit Freeze vs. Lock: Which and When
Can I have a credit freeze and fraud alert at the same time?
Yes. They perform different functions. A freeze restricts access to the file for many new-credit decisions, while an alert tells prospective creditors to take added identity-verification steps. Whether you need both depends on your risk and how often you apply for credit.
Does freezing one bureau freeze all three?
No. Security freezes are placed separately with Equifax, Experian, and TransUnion. The one-contact rule applies to an initial fraud alert, not to freezes.
Will a freeze stop charges on my existing card?
No. It is a new-credit access control. If an existing card, bank account, or email is compromised, contact that provider and secure the account directly.
Why not just pay for a credit lock?
A lock may be convenient, but it is a bureau product governed by product terms. If you want the federal security-freeze right, use the bureau’s freeze process; the freeze itself is free.