Credit freezes, fraud alerts, and credit locks are three different tools for restricting access to a credit report. They look similar, but they differ in legal status, cost, scope, and how quickly a consumer can lift or remove them. A credit freeze is a federal right under the FCRA, free to place and lift at all three bureaus. A fraud alert is also a federal right, also free, but does not block access. A credit lock is a commercial product offered by each bureau, sometimes free and sometimes part of a paid monitoring subscription.
A credit freeze blocks new creditors from accessing a credit file. Lenders that cannot pull a report typically deny the application, which stops most types of identity theft fraud at the point of attempted account opening. A fraud alert does not block access; it requires lenders to take extra verification steps before opening new credit. A credit lock, depending on the bureau, behaves similarly to a freeze but is governed by the bureau's terms of service rather than the FCRA.
For consumers focused on the strongest legal protection, a credit freeze at all three bureaus is the standard recommendation. For consumers who want the fastest lift-and-relift cycle through a phone app, some prefer credit locks. Fraud alerts are best understood as a complement, not a substitute, especially for consumers who have already been targeted by identity theft and want to maintain heightened verification across their reports.
Credit Freeze: The FCRA Default
A credit freeze, also called a security freeze, is governed by FCRA Section 605A. It is a federal right available to every consumer at every credit bureau. Since September 2018, freezes and unfreezes have been free of charge under federal law, regardless of state of residence. The bureau must place a freeze within one business day of an electronic request and lift it within one hour of an electronic lift request.
Once frozen, the bureau will not release the credit report to most third parties. Existing creditors continue to have access for account servicing, but new creditors who request the report for an account opening or credit decision are blocked. Government agencies investigating fraud or enforcing child support obligations, and certain pre-existing relationships, are exempt from the block.
A consumer applying for new credit must temporarily lift the freeze at the bureau the lender will pull from, which is sometimes specified on the application and sometimes not. Lifts can be set for a specific time period (commonly one to seven days) or until manually re-enabled. The bureau is required to make the lift effective within one hour of the request.
Fraud Alert: Heightened Verification, Not Blocked Access
A fraud alert, also under FCRA Section 605A, does not block credit report access. It instead places a flag on the file that requires lenders to take reasonable steps to verify the identity of the applicant before extending credit. Most lenders accomplish this by calling a phone number the consumer has placed on file with the bureau, though the FCRA does not prescribe a specific method.
There are three types of fraud alerts. An initial fraud alert lasts one year and is available to any consumer who suspects they may be a victim of identity theft. An extended fraud alert lasts seven years and requires the consumer to file an identity theft report, typically with the FTC at identitytheft.gov. An active-duty military alert lasts one year and is available to service members deployed away from their usual duty station.
Placing a fraud alert at one bureau automatically propagates to the other two, by federal mandate. This is different from a freeze, which must be placed separately at each bureau. The alert remains in effect until it expires or the consumer requests its removal.
Credit Lock: A Bureau Product, Not a Federal Right
A credit lock is a service offered by each of the three bureaus directly to consumers. The lock blocks access to the credit report similarly to a freeze, but is governed by a bureau's commercial terms of service rather than the FCRA. Locks are typically managed through a bureau's mobile app, and can often be turned on and off in seconds, which is faster than the one-hour electronic-lift requirement for a freeze.
Cost varies. Experian and TransUnion offer free basic locks bundled with consumer accounts. Equifax offers a free lock through its Lock and Alert service. More fully featured locks (covering all three bureaus through a single app) are typically part of a paid monitoring subscription, often priced from $10 to $30 per month.
Because credit locks are commercial products, the bureau can change the terms, the pricing, or the availability without the protections that apply to a federal freeze. A consumer who relies exclusively on a lock and does not also place a freeze is depending on the bureau's continued willingness to honor the lock arrangement on its current terms.
Side-by-Side Comparison
Cost: Freezes and fraud alerts are free at all three bureaus by federal law. Credit locks are sometimes free (Equifax Lock and Alert, basic Experian and TransUnion offerings) and sometimes paid (premium tri-bureau lock subscriptions). Legal basis: Freezes and fraud alerts are FCRA rights. Locks are governed by bureau terms of service.
Speed of lifting: Freezes must lift within one hour for electronic requests under FCRA. Locks typically lift instantly through a mobile app. Fraud alerts do not need to be lifted, since they do not block access. Coverage: A freeze must be placed at each bureau separately. A fraud alert placed at one bureau automatically propagates to the other two. A lock applies only to the bureau where it is enabled, unless purchased as a tri-bureau bundle.
Effect on credit applications: A freeze or active lock blocks the credit report from being released, which typically results in a denied application. A fraud alert does not block the report but adds an identity verification step that can delay approval. None of the three damages the underlying credit score.
Which to Use for Identity Theft Prevention
For consumers focused on preventing identity-theft account openings, the strongest combination is a credit freeze at all three bureaus, plus an extended fraud alert if the consumer has already been a documented identity theft victim. The freeze blocks new account openings outright; the fraud alert adds verification for any other access that does manage to come through.
Credit locks can substitute for freezes when the consumer values app-based convenience and trusts the bureau's terms. For active credit shoppers who lift and re-place restrictions frequently, a lock managed through a mobile app can be operationally simpler than a freeze, even though the underlying protection is functionally similar.
Which to Use for Children's Credit
Minors do not typically have credit reports, but the bureaus will create a file and freeze it on behalf of a parent or guardian under FCRA Section 605A(j). This is the recommended protection for child identity theft, where a thief uses a minor's Social Security number to open accounts that go undetected for years until the child applies for credit as an adult.
Child credit freezes are free under federal law. Each bureau has a separate process, typically requiring proof of guardianship and the child's birth certificate and Social Security card. Credit locks are not generally offered for minors, since the bureau-product framework assumes an adult account holder.
Lifting and Removing Protections
A freeze can be lifted temporarily (for a set period) or permanently. The bureau must complete an electronic lift within one hour and a postal request within three business days. A freeze can be re-placed at any time at no cost. A consumer applying for credit should know which bureau the lender will pull, since lifting the wrong bureau will not unblock the application.
A credit lock is lifted through the bureau's app, typically with a single tap, and re-enabled the same way. Fraud alerts can be removed at any time by request, though they otherwise expire on their own (one year for initial alerts, seven for extended alerts). Removing all three types of protection takes minutes rather than days when handled electronically.
Common Misunderstandings
A common misconception is that a credit freeze lowers a credit score. It does not. Scoring models do not use freeze status as an input, and the consumer's existing tradelines, payment history, and utilization continue to update normally while a freeze is in place. Freezes only affect new credit applications by blocking the report pull.
Another is that a fraud alert blocks new accounts. It does not. The alert requires lenders to verify the applicant's identity, which can deter fraud but does not prevent a new account from being opened if the lender completes verification (or fails to follow the alert protocol, which has been a recurring problem in enforcement actions).
A third is that a credit lock provides the same legal protection as a freeze. It generally provides similar functional protection, but the bureau's commercial terms can change. A consumer who chooses a lock instead of a freeze gives up FCRA-grounded enforcement rights in exchange for app convenience and faster lift cycles.
What None of the Three Tools Does
Freezes, fraud alerts, and locks all operate at the credit report layer. They do not prevent identity theft using existing accounts. A thief who steals a credit card number from a database breach can still use the card without ever touching the credit report. Account-level protections (card freezes, virtual card numbers, two-factor authentication) operate at a different layer and are separate concerns.
None of the three tools blocks access to specialty consumer reports like ChexSystems (used by banks for deposit accounts) or LexisNexis (used by insurers and landlords). Consumers concerned about identity theft across the broader consumer reporting ecosystem may also want to place freezes or alerts with those specialty bureaus, each of which has its own process.
Practical Recommendation
For most consumers, the simplest effective combination is a credit freeze at all three major bureaus, plus a freeze at Innovis and NCTUE for broader coverage. This blocks new credit access by default, costs nothing, and remains in effect until manually lifted. Lifting only takes an hour for any new credit application that genuinely needs it.
Consumers who have already been targeted by identity theft should add an extended fraud alert on top of the freeze, after filing a report at identitytheft.gov. This combination provides both a hard block at the report level and a verification overlay if any access does come through. The cost is zero, and the operational overhead is one or two website visits per year.
The Bottom Line
A credit freeze is the strongest, most cost-effective tool for blocking new account fraud. It is a federal right, free at every bureau, and enforced under the FCRA. A fraud alert is a useful complement that adds identity verification for any access that does occur. A credit lock is a faster but less legally grounded alternative to a freeze that can be useful for active credit shoppers who value app convenience.
The three tools are not mutually exclusive. A consumer can place a freeze at all three bureaus, also enable bureau apps for lock-style management, and add a fraud alert that propagates across all three. The combined protection is meaningful, the financial cost is zero, and the time investment is roughly one afternoon to set up.
Results may vary. No specific outcome is guaranteed. This article is general information about credit freezes, fraud alerts, and credit locks under federal law and bureau practice, not legal or financial advice. CreditRefresh helps consumers identify potential FCRA violations and generate dispute letters, but does not place freezes, alerts, or locks on behalf of any consumer. Consumers concerned about ongoing identity theft should also consult identitytheft.gov and, where appropriate, a licensed consumer protection attorney.
