A credit freeze is placed separately at each of the three nationwide credit reporting bureaus (Equifax, Experian, and TransUnion) and, for fuller protection, at the smaller specialty bureaus that feed lending decisions. Under federal law (the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018, which amended the Fair Credit Reporting Act), the freeze is free at all three nationwide bureaus, with no fee to place, lift, or remove. Once placed, the freeze blocks new lenders from accessing the credit file, which stops most new account identity theft before it can be reported.
Placing a freeze at all three nationwide bureaus typically takes about 15 minutes online and goes into effect within one business day at each bureau. The freeze remains active until it is lifted, either permanently (a thaw) or temporarily for a specific application window. Existing creditors, debt collectors, government agencies, and the consumer's own access to the credit report are not affected. The credit score is not lowered, and the file continues to update normally.
The sections below walk through the freeze process at each nationwide bureau, the specialty bureau freezes that consumer advocates also recommend, the differences between a freeze, a fraud alert, and a credit lock, the lift process, and the situations a credit freeze does not cover. Identity theft cleanup typically begins with a freeze, followed by an FTC identity theft report and disputes at each bureau where fraudulent accounts have appeared.
What a Credit Freeze Does Under the FCRA
A credit freeze, formally called a security freeze, restricts a credit bureau from releasing the credit report to most third parties. When a lender requests a report on a frozen file, the bureau returns a response indicating the file is frozen, and the application is typically declined or held pending a thaw. The legal framework comes from the Fair Credit Reporting Act and its 2018 amendments, which made the freeze free at all three nationwide bureaus nationwide.
The freeze prevents the credit report from being pulled for new account applications, which is the most common vector for new account identity theft. A criminal who has obtained a Social Security number cannot open a credit card, auto loan, or mortgage in the victim's name without first lifting the freeze, which requires the bureau-issued PIN or login credentials known only to the consumer.
A freeze does not prevent existing creditors from continuing to report account activity, does not prevent debt collectors from pulling files for collection purposes, does not stop prescreened credit offers (a separate opt-out process at OptOutPrescreen.com), and does not affect insurance score pulls in states that allow them. It also does not lower the existing credit score.
Equifax Credit Freeze: Step by Step
Equifax offers a security freeze through its website, by phone, or by mail. The online process at the Equifax credit freeze portal requires the consumer's Social Security number, date of birth, current address, and two security verification items drawn from the credit file. Once verified, a freeze can be placed immediately with no fee, and a confirmation is generated for the consumer's records.
The phone option at 1-800-685-1111 walks the consumer through identity verification before placing the freeze. The mail option requires a written request that includes proof of identity (a copy of a driver's license or passport) and proof of address (a utility bill), and Equifax has up to three business days to process a mailed request after receipt.
Equifax has historically experienced the most reporting incidents of mishandled freezes, including the 2017 data breach that exposed the data of 147 million Americans. A freeze placed at Equifax is legally independent of the same consumer's freezes at Experian and TransUnion, even though all three bureaus draw on similar account-level information. Each bureau must be frozen separately.
Experian Credit Freeze: Step by Step
Experian's freeze is accessible online at the Experian Freeze Center, by phone at 1-888-397-3742, or by mail. The online process verifies identity through name, address, Social Security number, and date of birth, plus knowledge-based authentication questions drawn from the credit file itself. A login is created for future thaws and lifts.
Once placed, the Experian freeze is managed through the same online account, and a temporary lift can be requested for a specific date range or a specific creditor by name. Experian also markets a free CreditLock product that operates similarly to a freeze but is governed by Experian's terms of service rather than the FCRA, so the legal protections differ even when the user experience looks similar.
Identity verification through Experian's knowledge-based authentication occasionally fails on thin files or on files with significant recent activity. When this happens, Experian routes the request to a manual review process that can take up to three business days. The freeze can also be placed by phone or mail if the online verification fails repeatedly, and these alternate routes do not depend on knowledge-based authentication.
TransUnion Credit Freeze: Step by Step
TransUnion's security freeze is set up through the TransUnion Service Center website or by phone at 1-888-909-8872. The online portal requires Social Security number, date of birth, address, and verification of recent credit activity. A login is created so the consumer can manage future thaws and lifts directly from the same account.
TransUnion sometimes prompts users toward its TrueIdentity service or premium credit monitoring during the freeze flow. The actual security freeze is free under federal law, and consumers do not need to enroll in any paid product to place, lift, or remove the freeze. Any paid upsell during the process is optional and unrelated to the freeze itself.
Innovis and NCTUE: The Often-Forgotten Bureaus
Beyond the three main bureaus, two specialty consumer reporting agencies also feed information into many lending and account-opening decisions. Innovis is a fourth credit reporting bureau used primarily for fraud screening, and NCTUE (the National Consumer Telecom and Utilities Exchange) tracks telecommunications, utility, and pay-television account information used when these accounts are opened.
Innovis freezes are free and can be placed online at the Innovis security freeze portal or by phone at 1-800-540-2505. NCTUE freezes are placed by phone at 1-866-349-5355. Identity theft prevention is meaningfully strengthened by adding these two freezes, since many phone, internet, and utility accounts are opened with NCTUE data rather than a tri-bureau pull.
Credit Freeze vs. Fraud Alert vs. Credit Lock
A fraud alert is a notation on the credit file that asks any lender pulling the report to take extra steps to verify identity before opening a new account. Initial fraud alerts last one year and can be placed at one bureau, which is required to notify the other two. Extended fraud alerts last seven years and require an FTC identity theft report from IdentityTheft.gov.
A credit lock is a bureau-marketed product that performs a similar function to a freeze but is governed by the bureau's terms of service rather than federal law. Locks can typically be toggled instantly through a mobile app, which is more convenient than a thaw, but consumer protections under the FCRA do not extend to locks. Locks also sometimes require a paid subscription depending on the bureau.
The credit freeze offers the strongest protection under federal law and is free at all three bureaus. The fraud alert is a lighter-weight option that allows new credit but requires verification. The credit lock prioritizes convenience over legal protection. Most consumer advocates recommend a freeze as the default for identity theft response and a fraud alert for lower-risk situations such as a lost wallet.
Temporarily Lifting a Credit Freeze
A temporary lift, sometimes called a thaw, allows a specific lender or a specific date range to access the credit file without permanently removing the freeze. Each of the three nationwide bureaus offers temporary lifts free of charge under the 2018 federal law. The lift can be by lender (one named creditor only), by date range (a window of days the freeze is open), or full removal.
Online lifts typically go into effect within one hour at all three bureaus. Phone and mail lifts take up to three business days. A consumer applying for an auto loan, mortgage, or new credit card needs to know which bureau the lender will pull from. Mortgage applications typically require tri-merge files from all three bureaus, in which case all three freezes need to be lifted.
After the application is complete, the freeze does not need to be re-placed manually if a date range or single-lender lift was used. The freeze automatically resumes at the end of the specified window or after the named lender pulls. A full removal, by contrast, leaves the file open until a new freeze is placed.
When a Credit Freeze Cannot Block Activity
A credit freeze does not stop existing creditors from continuing to report activity on accounts already open. An identity thief who opened a fraudulent account before the freeze was placed can continue to run up charges on that account, and those charges will appear on the credit report. The freeze blocks new accounts, not activity on accounts already in place.
A freeze also does not stop debt collectors from pulling reports for collection purposes, does not stop government agencies enforcing child support or court orders, and does not block pre-existing creditors from running periodic account reviews. Insurance companies in states that allow credit-based insurance scoring may also still pull a frozen file in limited circumstances depending on state law.
Freezing a Child's Credit Under Federal Law
The same 2018 federal law that made credit freezes free for adults also created a free child credit freeze program. Under federal law, parents and legal guardians can place a freeze on a minor's credit file, even before any credit file has been generated for the child. If no file exists, the bureau creates a record specifically for the purpose of the freeze.
Child identity theft is among the hardest forms of fraud to detect because minors typically do not check their credit reports. A criminal can use a child's Social Security number to open accounts that go undiscovered until the child applies for credit at 18. A protective freeze placed in childhood eliminates this vector entirely until the freeze is lifted.
To place a child freeze, parents send each bureau a written request with proof of identity for the parent, proof of authority over the child (a birth certificate or court order), and the child's Social Security number. The freeze remains in place until the child turns 16, at which point the child can manage or remove it on their own under bureau procedures.
Common Errors When Placing a Freeze
The most common error is freezing only one bureau instead of all three. Lenders pull from whichever bureau the lender prefers, and freezing only Equifax leaves Experian and TransUnion open to new account fraud. All three nationwide bureaus need to be frozen for the protection to be complete, and adding Innovis and NCTUE extends coverage to specialty bureau pulls.
Losing the bureau-issued PIN (for freezes placed before 2018) or losing access to the online account used for newer freezes can complicate future lifts. Each bureau has a recovery process, but recovery can take days or weeks and may require mailed documentation. Storing freeze credentials in a password manager or a secure paper file is recommended at the time of placement.
Another error is treating a credit lock as equivalent to a credit freeze. The lock product is not governed by federal law, can be discontinued by the bureau at any time, and may carry a subscription fee. For consumers focused on legal protection rather than convenience, the FCRA-governed freeze remains the stronger option even when the lock is marketed alongside it in the same app.
The Bottom Line on Credit Freezes
A credit freeze is the strongest federally-protected tool for preventing new account identity theft. It is free at all three nationwide bureaus, free for children's files, and can be placed in about 15 minutes online. Adding freezes at Innovis and NCTUE extends the protection to specialty bureau pulls that handle telecommunications, utility, and pay-television accounts not always covered by the big three.
A freeze is not a substitute for monitoring existing accounts, disputing inaccurate items, or filing an FTC identity theft report when fraud has already occurred. It is the front-end shield, while disputes, account closures, and FTC reports handle cleanup of any damage already done. Most identity theft response plans begin with the freeze and then move outward to address fraudulent accounts already on the file.
Results may vary. No specific outcome is guaranteed. The procedures and contact information above reflect current bureau practices as of 2026 and may change over time. Consumers should verify current procedures with each bureau directly before placing or lifting a freeze.
