Credit freeze vs. fraud alert vs. credit lock: what each one stops

Most people reach this question right after a breach notice or a weird text from their bank, and the bureaus’ own websites don’t make the choice easier. The free freeze sits on the same pages as paid monitoring plans and branded lock products, and the names sound interchangeable.

The three tools work at different points in the same process. When you apply for credit, the lender asks a bureau for your report. A freeze makes the bureau refuse that request. A lock does nearly the same thing under a product agreement. A fraud alert lets the report go out, but with a flag attached telling the lender to confirm it’s really you before saying yes.

What happens to a lender’s request under each one

A frozen file can’t be released to a new creditor. Federal law defines a security freeze as a restriction that stops the bureau from disclosing your report to anyone who requests it, with a list of exceptions covered below (15 U.S.C. 1681c-1(i)). The lender’s pull fails, and in practice the application stalls until you lift the freeze.

A fraud alert doesn’t block anything. The lender sees your full report plus the alert. For an initial alert, the law says the lender can’t open a new account or raise a limit unless it has reasonable procedures to confirm your identity, and if you listed a phone number with the alert, it must call that number or take reasonable steps to verify you (15 U.S.C. 1681c-1(h)). An extended alert goes further: the lender has to contact you in person or by the method you designated.

A lock blocks pulls the way a freeze does. Experian, for example, describes its CreditLock as blocking new credit inquiries on your Experian file, and adds alerts and scheduled windows when the file opens back up. Where the two part ways is the rulebook. Freezes are a statutory right with deadlines. Locks are products you enroll in, and the enrollment terms set the rules.

Side by side

Durations, costs and prescreen periods come from 15 U.S.C. 1681c-1 and the FTC’s freeze and alert guide. Lock details come from the bureaus’ own pages.

Why the law behind a freeze matters

Free freezes are a fairly recent right. The Economic Growth, Regulatory Relief, and Consumer Protection Act, signed May 24, 2018, added the federal security freeze to the Fair Credit Reporting Act and stretched the initial fraud alert from 90 days to one year. Those changes took effect 120 days after enactment, on September 21, 2018.

The freeze statute puts the bureaus on a clock. A freeze requested by phone or online must be in place within one business day, or three business days for a mailed request. The bureau must send confirmation within five business days. When you ask to lift it, a phone or online request must be honored within one hour; a mailed request gets three business days. None of this costs anything (15 U.S.C. 1681c-1(i)).

A lock carries no statutory clock. If the app is down the morning a car dealer is waiting, your remedy is whatever the product terms say. Locks work fine for plenty of people; just read what you agreed to. The CFPB’s own wording is blunt: credit locks “are no more effective than security freezes, which are free and which you have a right to by law.”

There’s also the bundling issue. Locks often come packaged with credit monitoring or identity protection plans. Equifax says its plans, which include a credit report lock, “start at FREE,” while Experian lists CreditLock as “included in a paid membership.” If what you want is a closed door, the free freeze gets you there without a subscription.

What a freeze does not block

A freeze is narrower than people expect. Under 15 U.S.C. 1681c-1(i)(4), the bureau can still release your report to:

• Lenders you already have accounts with, for account reviews and collection, plus their agents and collectors
• Government agencies, courts and child support agencies acting under their legal authority
• Prescreened-offer marketers using information as allowed under 1681b(c)
• A credit monitoring service you signed up for
• You, when you request your own report or score
• Insurers for underwriting
• Employment, tenant and background screening
• Identity verification and fraud prevention that isn’t tied to granting credit

The CFPB makes the same point from the other side: the free-freeze law doesn’t apply to someone requesting your report for employment, tenant screening or insurance. And a freeze at the three big bureaus does nothing at the specialty agencies that banks, phone carriers and insurers also check. That gap is covered in freezing every bureau, including the ones nobody mentions.

When an alert is the better fit

A fraud alert makes sense when you need to keep applying for credit in the near term. Say you’re midway through buying a house or financing a car and your email was just compromised. Lifting and re-placing freezes at three bureaus during underwriting is doable but fiddly. An initial alert keeps the report visible while forcing an extra identity check on any new application.

The trade-off is that an alert relies on the lender’s procedures. The law requires “reasonable” verification, which leaves room for a sloppy creditor. A freeze doesn’t rely on anyone’s judgment: no release, no account.

Many victims stack them: freezes at every bureau, plus an extended alert backed by an identity theft report from IdentityTheft.gov. The extended alert also gets you two free reports from each bureau within 12 months and removes you from prescreened offer lists for five years. If you’re past the “suspect” stage, start with identity theft recovery, step by step.

Example: applying for a car loan with frozen files

Say you’ve frozen Equifax, Experian and TransUnion. You find a car on Saturday morning, and the dealer’s finance office says its lenders pull Experian.

1. Ask the finance manager which bureau or bureaus its lenders will pull. Dealers often send applications to several lenders, which can mean more than one bureau.
2. Log in at the bureau they name and schedule a temporary lift, for example two days. Under the statute, an online or phone lift must happen within one hour of your request. Experian says freezes placed online take effect in real time.
3. Leave the other bureaus frozen unless the dealer confirms a lender needs them.
4. When the temporary window ends, the freeze is back on without any action from you.

Compare the same Saturday with an initial fraud alert instead. Nothing needs lifting, but the lender must verify you, often by calling the number on the alert. If you listed an old number or you’re in a dead zone at the dealership, approval waits.

The hard inquiry from the car loan lands on your report the same way whether or not you had a freeze. Freezes, alerts and locks all leave your scores alone; the CFPB says freezes don’t affect them “in any way whatsoever.”

What to set up this week

1. Place a free freeze at Equifax, Experian and TransUnion through each bureau’s freeze page, not a lock signup page. Save each confirmation and PIN or login in a password manager.
2. If you have a specific reason to suspect fraud, add an initial fraud alert at any one bureau. It’s free and lasts a year.
3. If you already hold a lock and want a freeze instead, TransUnion lets you replace a lock with a freeze in its online service center. Check the other bureaus’ account pages for the same option.
4. Pull your reports at AnnualCreditReport.com, which offers free weekly reports from all three bureaus, and look for accounts and inquiries you don’t recognize. A freeze stops new damage; it doesn’t fix existing damage.
5. Before your next credit application, find out which bureau the lender uses and lift only that one, for only as long as needed.