Credit Freezes and Fraud Alerts: Protecting Your Credit Profile
Credit freezes and fraud alerts are two distinct protective mechanisms established under federal law that restrict unauthorized access to consumer credit files. Both tools are administered through the three major national credit reporting agencies — Equifax, Experian, and TransUnion — and are governed primarily by the Fair Credit Reporting Act (FCRA). Understanding how each mechanism functions, when to use each, and how they differ is essential for anyone managing exposure to identity theft or unauthorized credit activity.
Definition and Scope
A credit freeze, also called a security freeze, restricts credit reporting agencies from releasing a consumer's credit file to new creditors without explicit consumer authorization. Under 15 U.S.C. § 1681c-1 (FCRA Section 605A), amended by the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018, credit freezes became permanently free for all consumers — a change from the prior model in which states set their own fee schedules, with charges reaching $10 per bureau in some jurisdictions.
A fraud alert is a notice placed on a credit file that instructs creditors to take additional verification steps before extending credit. The FCRA defines three categories:
- Initial fraud alert — Lasts one year; can be placed by any consumer who reasonably suspects fraud or identity theft.
- Extended fraud alert — Lasts seven years; available only to confirmed victims of identity theft who file an identity theft report with a law enforcement agency.
- Active duty military alert — Lasts one year; available to service members on active duty away from their usual duty station, as recognized by the Consumer Financial Protection Bureau (CFPB).
The CFPB and the Federal Trade Commission (FTC) jointly oversee consumer compliance and enforcement in this space. The FTC maintains IdentityTheft.gov as the federally designated platform for filing identity theft reports, a prerequisite for extended fraud alerts.
How It Works
Placing a credit freeze requires contacting each of the three major credit reporting agencies separately. Under the 2018 FCRA amendments, agencies must implement a freeze within one business day of a request made online or by phone, and within three business days for requests made by mail (FTC: Credit Freeze FAQs). When frozen, a consumer's credit report cannot be accessed by most new creditors, effectively blocking new account openings. Existing creditors and certain government agencies retain access.
To temporarily lift a freeze — called a "thaw" — consumers must contact each bureau individually. Thaws take effect within one hour for online or phone requests. Freezes can be permanent until explicitly removed.
Placing a fraud alert requires contacting only one of the three bureaus. That bureau is then legally required to notify the other two. This single-contact process distinguishes fraud alerts from freezes administratively. Once active, fraud alerts do not block access to the credit file but require potential creditors to use "reasonable procedures" to verify the applicant's identity before issuing credit.
The structured process for a freeze placement is:
- Gather identity verification documents (Social Security number, date of birth, current address).
- Contact Equifax, Experian, and TransUnion — each separately — via their online portals, phone lines, or certified mail.
- Record the unique PIN or confirmation code provided by each bureau.
- Store PINs securely; they are required to lift or remove the freeze.
- Notify lenders of any anticipated credit applications, then thaw the freeze before applying.
For context on how credit report data is structured and why protection at the report level matters, see the Credit Report Explained resource.
Common Scenarios
Identity theft following a data breach: A consumer whose Social Security number appears in a confirmed breach (such as those cataloged through the FTC and HHS) may place an initial fraud alert immediately and subsequently file with IdentityTheft.gov to qualify for an extended seven-year alert. An immediate credit freeze across all three bureaus provides the strongest short-term barrier against new fraudulent account openings.
Unauthorized credit inquiries without confirmed theft: When a consumer notices hard inquiries on a credit report from creditors they never contacted, a fraud alert alone may be sufficient to trigger additional creditor verification without the administrative burden of managing freeze PINs across three bureaus.
Proactive protection for minors: Parents or guardians can place a credit freeze on a minor child's file under FCRA provisions. The bureaus must create a file for the minor and freeze it, a protection that prevents the increasingly common crime of child identity theft.
Military deployment: Active duty service members can use the military fraud alert, which also removes their name from prescreened credit offer lists during the alert period (CFPB: Active Duty Alerts).
For consumers already dealing with collections activity, the interaction between credit protections and collections and credit solutions is an important parallel consideration.
Decision Boundaries
Choosing between a freeze and a fraud alert depends on the confirmed or suspected level of exposure and the consumer's anticipated credit activity.
| Factor | Credit Freeze | Fraud Alert |
|---|---|---|
| Blocks new creditor access | Yes | No — flags for verification |
| Contact required | All 3 bureaus separately | 1 bureau (notifies others) |
| Duration | Indefinite until lifted | 1 year (initial) / 7 years (extended) |
| Cost | Free (federal law, post-2018) | Free |
| Affects existing accounts | No | No |
| Requires identity theft report | No | Only for extended alert |
Consumers with confirmed identity theft who are pursuing resolution through formal channels — including filing disputes under the Fair Credit Reporting Act — typically benefit from combining an extended fraud alert with a full freeze. Consumers monitoring preventively without confirmed theft often find the one-year fraud alert sufficient.
It is also important to recognize that neither mechanism corrects existing fraudulent tradelines on a credit file. Removing unauthorized accounts requires a formal disputing credit report errors process with the bureaus, governed separately under FCRA Section 611. The relationship between protective tools and longer-term credit score fundamentals is direct: unresolved fraudulent accounts can suppress scores for years if dispute procedures are not initiated separately from the freeze or alert.
The CFPB's supervisory authority under the Dodd-Frank Wall Street Reform and Consumer Protection Act (12 U.S.C. § 5491 et seq.) extends to credit reporting agency compliance with these protective mechanisms, providing a federal enforcement layer above state-level consumer protection statutes.
References
- Federal Trade Commission — Credit Freezes and Fraud Alerts
- Consumer Financial Protection Bureau — Fraud Alert Key Terms
- FTC IdentityTheft.gov — Official Federal Identity Theft Resource
- 15 U.S.C. § 1681c-1 — Fair Credit Reporting Act, Section 605A (Security Freezes and Fraud Alerts)
- Economic Growth, Regulatory Relief, and Consumer Protection Act (S. 2155, 2018)
- CFPB — Active Duty Alerts for Military Consumers
- Equifax Security Freeze Center
- Experian Security Freeze
- TransUnion Credit Freeze