Credit freezes, fraud alerts, and credit locks are three different tools for restricting access to a credit report. They look alike, but they differ in legal status, cost, reach, and how long they last. Most people assume the paid app is the strong one. The free federal freeze is the strong one.
There is a bigger gap too. Identity theft is common: the FTC took more than 1.1 million identity theft reports through IdentityTheft.gov for 2024 (Federal Trade Commission, 2025). None of the three tools removes a fraud account already sitting on your report. That takes a dispute.
A Credit Freeze Is the Free Federal Default
A credit freeze blocks new lenders from pulling your report, and it costs nothing at any bureau. It is also called a security freeze and falls under FCRA Section 605A. Since September 2018, freezes and unfreezes have been free by federal law in every state. The bureau must place a freeze within one business day of an online request and lift it within one hour of an online lift request.
Once frozen, the bureau will not release the report to most third parties. Your existing creditors still have access to service your accounts. New creditors asking for the report to open an account are blocked. Government agencies looking into fraud or enforcing child support, and certain pre-existing relationships, are exempt.
To apply for new credit, you lift the freeze at the bureau the lender will pull. Sometimes the application names that bureau and sometimes it does not. A lift can run for a set period, commonly one to seven days, or until you turn the freeze back on. A freeze lasts until you choose to lift or remove it. Our step-by-step guide on how to freeze your credit in 2026 walks through each bureau.
A Fraud Alert Adds an ID Check and Never Blocks Access
A fraud alert leaves your report open but tells lenders to confirm it is really you before they extend credit. It also falls under FCRA Section 605A. Most lenders verify by calling a phone number you put on file with the bureau. The FCRA does not set one required method.
Placing an alert at one bureau spreads it to the other two, by federal mandate. That is different from a freeze, which you place at each bureau yourself. The alert stays until it expires or you ask to remove it. Like a freeze, it is free.
Which Fraud Alert Fits You, and How Long Each One Lasts
There are three fraud alerts, and the right one depends on what has happened to you. Each has its own length and its own entry rule.
- Initial fraud alert. Lasts one year. Any consumer who thinks they may be an identity theft victim can place one.
- Extended fraud alert. Lasts seven years. It requires an identity theft report, usually filed with the FTC at identitytheft.gov. Our guide to the extended fraud alert under FCRA Section 605A covers the steps.
- Active-duty military alert. Lasts one year. It is for service members deployed away from their usual duty station. It also takes you off lists for unsolicited credit and insurance offers for two years.
That last perk matters for a deployed service member. Fewer mailed credit offers means fewer preapproved forms for a thief to steal from a mailbox while you are away.
A Credit Lock Runs on the Bureau’s Terms of Service
A credit lock blocks your report much like a freeze, but a bureau’s commercial contract governs it instead of the FCRA. Each of the three bureaus sells or offers one directly. Locks usually run through a bureau’s phone app and can often flip on and off in seconds. That beats the one-hour online lift rule for a freeze.
Cost varies. Experian and TransUnion offer free basic locks bundled with consumer accounts. Equifax offers a free lock through its Lock and Alert service. Fuller locks that cover all three bureaus in one app are usually part of a paid monitoring plan, often priced from $10 to $30 per month. A lock stays on until you toggle it off in the app or on the website.
Because locks are commercial products, the bureau can change the terms, the price, or the access without the protections a federal freeze carries. If you rely on a lock alone and skip the freeze, you are counting on the bureau to keep honoring the lock on today’s terms.
How Freezes, Alerts, and Locks Compare Side by Side
A freeze and a fraud alert are free federal rights, and a lock is a bureau product that is sometimes free. Here is how the three line up on the points people ask about most.
| Tool | Cost | How long it lasts | Legal basis | Reach across bureaus |
|---|---|---|---|---|
| Credit freeze | Free at all three bureaus by federal law | Until you lift or remove it | FCRA Section 605A | Placed at each bureau separately |
| Fraud alert | Free at all three bureaus by federal law | 1 year initial, 7 years extended, 1 year active duty | FCRA Section 605A | One request reaches all three bureaus |
| Credit lock | Free basic locks; paid tri-bureau plans | Until you toggle it off in the app | Bureau terms of service | Only the bureau where you turn it on |
Lifting works differently too. A freeze must lift within one hour for online requests under the FCRA. A lock usually lifts instantly in the app. A fraud alert never needs lifting, since it does not block access.
The effect on an application differs as well. A freeze or an active lock stops the report from being released, which usually means a denied application. A fraud alert adds an ID step that can slow approval. None of the three hurts your underlying credit score.
Which Tool to Use for Identity Theft Prevention
To stop fraud accounts from being opened in your name, freeze all three bureaus. Add an extended fraud alert if you are already a documented identity theft victim. The freeze blocks new accounts outright. The alert adds a check for any access that still gets through.
| Your situation | Put first | Add |
|---|---|---|
| No known theft, want the strongest free block | Freeze at all three bureaus | Freeze at Innovis and NCTUE |
| Documented identity theft victim | Freeze at all three bureaus | Extended fraud alert, after an identitytheft.gov report |
| Think you might be a victim | Initial fraud alert at one bureau | Freeze at all three bureaus |
| Deployed service member | Active-duty alert | Freeze at all three bureaus |
| Shop for credit often, want app control | Credit lock through a bureau app | A freeze underneath, for the federal right |
Locks can stand in for freezes when you value app convenience and trust the bureau’s terms. If you lift and replace restrictions often, a lock in an app can be simpler day to day, even though the protection works about the same way.
How to Protect a Child’s Credit With a Free Freeze
Freeze your child’s file, because a thief can use a minor’s Social Security number for years before anyone notices. Minors usually have no credit report. The bureaus will create a file and freeze it for a parent or guardian under FCRA Section 605A(j). The fraud often stays hidden until the child applies for credit as an adult.
Child credit freezes are free under federal law. Each bureau has its own process, usually asking for proof of guardianship plus the child’s birth certificate and Social Security card. Credit locks are not generally offered for minors, since the product assumes an adult account holder. Our guide on how to freeze a child’s credit covers each bureau’s paperwork.
How to Lift or Remove Each Protection
A freeze lifts within one hour online and within three business days by mail. You can lift it for a set period or for good, and you can place it again at any time for free. Before you apply for credit, find out which bureau the lender will pull. Lifting the wrong one will not unblock the application.
A lock lifts through the bureau’s app, usually with one tap, and turns back on the same way. You can remove a fraud alert at any time by request. Otherwise it ends on its own after one year for an initial alert and seven for an extended one. Done online, removing any of the three takes minutes instead of days.
Three Common Misunderstandings About Freezes, Alerts, and Locks
Most of the confusion comes from three wrong beliefs, and each one can cost you.
- “A freeze lowers my score.” It does not. Scoring models do not use freeze status. Your accounts, payment history, and utilization keep updating while the freeze is on. A freeze only affects new applications by blocking the report pull.
- “A fraud alert blocks new accounts.” It does not. The alert asks lenders to verify you. That can deter fraud, but an account still opens if the lender completes the check, or skips the alert, which has been a repeat problem in enforcement actions.
- “A lock carries the same legal protection as a freeze.” It generally gives similar practical protection, but the bureau’s terms can change. Choose a lock over a freeze and you give up FCRA-based enforcement rights for app convenience and faster lifts.
Check Your Free Reports, Because a Freeze Only Guards the Future
Every tool above blocks what happens next, so you still need to read your reports for what already happened. Errors are common. In the FTC’s national accuracy study, 1 in 5 consumers had an error on at least one of their three credit reports (Federal Trade Commission, 2013). An account you do not recognize is the clearest early sign of identity theft.
Mixed-up identities show up constantly in complaints. Of 3,482,718 complaints recorded in the CFPB’s public Consumer Complaint Database under “Incorrect information on your report” from July 2025 through June 2026, 66.9% said the information belonged to someone else, in our own read of that database. Complaints are unverified consumer allegations.
If you find an account that is not yours, you have a federal right to dispute it. A bureau that receives a dispute must reinvestigate and generally finish within 30 days (Fair Credit Reporting Act, Section 611). Victims can also ask the bureau to block fraud items outright, which our guide to blocking identity theft items under FCRA Section 605B explains.
None of the Three Tools Touches Existing Accounts or Old Errors
Freezes, fraud alerts, and locks all work at the credit report level, so they do nothing about fraud on accounts you already have. A thief who steals a card number in a data breach can use the card without ever touching your report. Card freezes, virtual card numbers, and two-factor login work at a different level and are separate concerns. Fraud losses are large: consumers reported losing more than $12.5 billion to fraud in 2024 (Federal Trade Commission, 2025).
None of the three blocks specialty reports like ChexSystems, used by banks for deposit accounts, or LexisNexis, used by insurers and landlords. If you worry about identity theft across that wider system, you can place freezes or alerts with those specialty bureaus too, each with its own process.
And none of them removes a fraud account already on the report. That item keeps reporting until you dispute it or it ages off. Most negative items can be reported for seven years, and a Chapter 7 bankruptcy for ten (Fair Credit Reporting Act, Section 605). Our full guide to identity theft and credit reports covers the recovery steps.
Tools that promise to do the dispute work draw their own complaints. One DisputeBee customer wrote, “Letters generated by AI are easily recognizable that it has been written with the help of chatgpt or such Ai apps, makes your account flag fraudulent by the credit bureaus.” (Balraj G., 1-star Trustpilot review of DisputeBee, June 28, 2025.) That is the reviewer’s claim, and it is why you should read and sign every letter that goes out in your name.
The Practical Setup Costs Nothing and Takes One Afternoon
For most consumers, the simplest setup that works is a freeze at all three major bureaus, plus a freeze at Innovis and NCTUE for wider coverage. It blocks new credit access by default, costs nothing, and stays until you lift it. Lifting takes only an hour when a new application truly needs it.
If you have already been targeted, add an extended fraud alert on top of the freeze, after filing a report at identitytheft.gov. You get a hard block at the report level plus an ID check if any access gets through. The cost is zero, and the upkeep is one or two website visits a year.
What to Use When Fraud Already Landed on Your Report
A freeze, an alert, or a lock stops the next fraud account, and a dispute is the tool for the one already there. Here is how the dispute options compare on price, what you get for it, and how many bureaus they reach.
| Tool | What you pay | What that buys | Bureaus | Trustpilot |
|---|---|---|---|---|
| CreditRefresh | $49.99/mo, no setup fee, cancel anytime. Mail letters yourself free, or pay RushMail per letter | Scans all three reports and drafts an FCRA letter per flagged item for you to sign | All three | 4.3 (9 reviews) |
| Dispute Beast | From $49.99/mo for required monitoring. Mail letters yourself free, or pay Sprint Mail per letter | AI dispute letters inside a paid monitoring bundle | All three | 4.2 (2,067 reviews) |
| DisputeBee | $49/mo personal, $129/mo business | Letter templates; you print, mail, and track bureau replies yourself | All three | 3.2 (68 reviews) |
| The Credit People | $99/mo standard, $119/mo premium, or $599 for 6 months | Done-for-you service; you do not approve each letter | All three | 1.7 (17 reviews) |
| Lexington Law | $139.95/mo, invoiced at the end of each service period | Attorney-run service; letters are not shown to you | All three | 3.2 (624 reviews) |
| Credit Karma | Free, paid for by lender referrals | Free monitoring; its Direct Dispute works with TransUnion only | TransUnion | 1.1 (912 reviews) |
Every price is that company’s own published rate, read off that company’s own site on September 15, 2026. Trustpilot scores and review counts as published on September 24, 2026.
How CreditRefresh Drafts a Dispute for Every Flagged Item Across 3 Bureaus
A freeze guards what comes next, and CreditRefresh handles what the freeze missed: the items already on your reports. In CreditRefresh’s September 18, 2026 member-data extract, 2.3% of disputed bureau-level items in mailed rounds had a recorded outcome. Within that subset, 47.9% were no longer reported on a newer pull of the same bureau, while 52.1% remained reported with a changed balance, status or negative flag.
Here is how it works. We pull your Equifax, Experian, and TransUnion reports through Refresh Monitoring and flag items that look inaccurate, incomplete, unverifiable, or too old to report. For each one you pick, we draft a print-ready FCRA dispute letter. You read it and sign it, and nothing goes out without you. Mail it yourself, or hand the round to RushMail for a small per-letter fee, then track each bureau’s reply against the roughly 30-day window.
It costs $49.99 a month, with no setup fee, no per-dispute charge, and no contract. The bureaus decide dispute outcomes, and your score depends on the rest of your file.
It is backed by our 100% money-back guarantee: members who work the full program and see no bureau score rise above where they started can claim back every Refresh Monitoring payment. It is a refund promise, never a score promise.
Frequently Asked Questions
Can I have a credit freeze and a fraud alert at the same time?
Yes. The freeze blocks new report pulls, and the alert adds an ID check for any access that still comes through, which is the pairing we suggest for documented theft victims.
Do I need to freeze Innovis and NCTUE too?
It widens your coverage beyond Equifax, Experian, and TransUnion. Each one takes a separate request, and freezes are free.
What happens if I lift the wrong bureau before applying?
The lender still cannot pull your report, so the application usually gets denied. Ask the lender which bureau it uses before you lift anything.
Will a fraud alert slow down a car loan?
It can, because the lender has to verify you before approving credit. Keep the phone number on your alert current so that call reaches you.
Can I dispute a fraud account while my credit is frozen?
Yes. A freeze limits who can pull your report for new credit; it does not take away your FCRA right to dispute what is already on it.
Is a paid credit lock worth it when a freeze is free?
Only if fast app toggling matters to you. The free freeze carries the federal right, and a paid lock runs on terms the bureau can change.
How do I get an extended fraud alert?
File an identity theft report, usually at identitytheft.gov, then send it to one bureau. The alert lasts seven years and reaches the other two bureaus.
Results may vary. No specific outcome is guaranteed. The information here is general information about credit freezes, fraud alerts, and credit locks under federal law and bureau practice, not legal or financial advice. CreditRefresh helps consumers identify potential FCRA violations and generate dispute letters, but does not place freezes, alerts, or locks on behalf of any consumer. Consumers concerned about ongoing identity theft should also consult identitytheft.gov and, where appropriate, a licensed consumer protection attorney.
CreditRefresh drafts the FCRA dispute letters for the fraud accounts and errors a freeze, alert, or lock cannot remove, and you sign each one before it goes out. Backed by a 100% money-back guarantee.
