Credit Freeze or Fraud Alert? How to Choose After a Data Breach

If a data breach exposed your Social Security number, or you suspect someone is using your identity, the two main tools for protecting your credit are a credit freeze and a fraud alert. Both are free, both are fast to set up, and they work very differently.

The short answer: a credit freeze is the stronger protection. It stops anyone, including you, from opening new credit in your name until you lift it. A fraud alert is lighter: lenders can still see your report but must verify your identity before approving new credit. If you don’t plan to apply for credit soon, a freeze usually offers more protection. If you need to keep applying for credit, or want a quick first step, a fraud alert helps. You can also use both.

Credit freeze vs. fraud alert: the key differences

How a credit freeze works

A credit freeze, also called a security freeze, stops the credit bureaus from releasing your credit report for new credit without your permission. The FTC puts it plainly: “While a credit freeze is in place, nobody can open a new credit account in your name, including you” (FTC). Since most lenders won’t approve credit without checking your report, a freeze stops most new-account fraud before it starts.

What to know before you freeze

• It’s free and doesn’t affect your credit score. Anyone can freeze their credit, for any reason, even if their identity hasn’t been stolen (FTC).
• You need to contact all three bureaus. Equifax, Experian, and TransUnion each keep a separate file, so a freeze at one doesn’t cover the others. The FTC links to each bureau’s freeze page (FTC).
• It’s fast. Federal law requires a bureau to place a freeze within one business day of a phone or online request, and to lift it within one hour. Requests by mail can take up to three business days (15 U.S.C. § 1681c-1).
• You can lift it temporarily. When you apply for a loan, an apartment, or a job that involves a credit check, you can lift the freeze for a period you choose, then let it return.
• It lasts until you lift it. There’s no expiration date to track.

What a freeze doesn’t block

A freeze doesn’t apply to companies you already have accounts with, or to collection agencies acting for them, when they check your report to review or collect your account (CFPB). It also doesn’t stop someone from misusing an account you already have, filing a tax return in your name, or using your health insurance. That’s why the FTC also recommends checking your credit reports and filing your taxes early after a breach (FTC).

How a fraud alert works

A fraud alert doesn’t lock your report. Instead, it tells lenders to take extra care: “Fraud alerts make lenders verify your identity before they grant new credit in your name,” according to the FTC. Unlike a freeze, a fraud alert “doesn’t prevent businesses from seeing your credit report” (FTC).

There are three types, and all are free:

• Initial fraud alert. For anyone who is or suspects they may be affected by identity theft. It lasts one year and can be renewed. Placing one entitles you to a free copy of your credit report from each of the three bureaus.
• Extended fraud alert. For identity theft victims who have completed an FTC identity theft report or filed a police report. It lasts seven years, and the bureaus must remove you from marketing lists for prescreened credit and insurance offers for five years, unless you ask them not to.
• Active duty alert. For active duty servicemembers. It lasts one year and can be renewed for the length of a deployment.

For any of these, you contact just one bureau. It must notify the other two (FTC).

Which one fits your situation

Your situation	A sensible approach
A breach exposed your Social Security number, and you don’t plan to apply for credit soon	Freeze your credit at all three bureaus. Lift it temporarily when you need to.
You’re about to apply for a mortgage, car loan, or apartment	Place a fraud alert now. Freeze after the application, or freeze now and lift it temporarily for the lender’s check.
Someone has already used your identity	Report it at IdentityTheft.gov, place an extended fraud alert with the identity theft report, and freeze your credit.
Your child’s information was exposed	Request a free credit freeze for a child under 16. The process differs from an adult freeze.
You’re an active duty servicemember	Consider an active duty alert, and a freeze if you won’t need new credit during deployment.

The FTC notes that “even if you already have a credit freeze in place, you can also place a fraud alert” (FTC). If you aren’t sure, using both covers more ground.

How to freeze your credit

1. Go to each bureau’s freeze page from the links on the FTC’s credit freeze page, rather than through ads or search results.
2. Request the freeze online or by phone at Equifax, Experian, and TransUnion.
3. Save the confirmation and any PIN or account login the bureau gives you. You’ll need it to lift the freeze.
4. Add a reminder in the place you keep important documents that your credit is frozen, so a future application doesn’t surprise you.

How to place a fraud alert

5. Contact one of the three bureaus, online or by phone.
6. Ask for an initial fraud alert, or an extended alert if you have an FTC identity theft report or police report.
7. The bureau you contact must notify the other two. Check your reports afterward to confirm the alert appears on all three.
8. Note the expiration date for an initial alert and renew it if you still need it.

Keep watching your reports either way

Neither a freeze nor an alert shows you what’s already happened. You can check your credit reports from all three bureaus for free every week at AnnualCreditReport.com, the only site authorized to provide the free reports (FTC). Look for accounts, inquiries, or addresses you don’t recognize.

If you find any, follow our first steps after identity theft and report it at IdentityTheft.gov. If a breach notice prompted all this, our guides on verifying a data breach letter and what a breach notice actually tells you explain what the exposure means.

Frequently asked questions

Is a credit freeze or fraud alert better after a data breach?

A credit freeze gives stronger protection because it blocks new credit until you lift it. A fraud alert is easier if you need to keep applying for credit. Many people use both.

Does a credit freeze hurt my credit score?

No. The FTC says a credit freeze doesn’t affect your credit score.

How long does a fraud alert last?

An initial fraud alert lasts one year and can be renewed. An extended fraud alert, for identity theft victims, lasts seven years.

How fast can I lift a credit freeze?

Federal law requires the bureau to lift it within one hour of a phone or online request, or within three business days of a request by mail.

Do I have to contact all three credit bureaus?

For a freeze, yes, because each bureau keeps a separate file. For a fraud alert, no: the bureau you contact must notify the other two.

Can I freeze my child’s credit?

Yes. The FTC says you can request a free credit freeze for a child under 16. The process is different from an adult freeze.

Sources

• Federal Trade Commission, What To Know About Credit Freezes and Fraud Alerts
• Consumer Financial Protection Bureau, What is the difference between a fraud alert and a security freeze?
• Consumer Financial Protection Bureau, A Summary of Your Rights Under the Fair Credit Reporting Act
• 15 U.S.C. § 1681c-1 (identity theft prevention; fraud alerts and security freezes)
• Federal Trade Commission, Data Breaches: What to Know, What to Do
• Federal Trade Commission, Free Credit Reports

This guide is general information, not legal or financial advice. Read how we research and update our guides in our Editorial Standards, and see our Corrections Policy to report an error. More coverage: Identity Theft.