Security Freeze vs. Credit Lock: The Complete Playbook for Shutting Out Identity Thieves

01Why Identity Theft Is Everyone's Problem Now

Every two seconds, someone in the United States becomes a victim of identity theft. Hackers, data brokers, dark-web marketplaces, and even old-fashioned mail theft feed a multi-billion-dollar fraud economy. The most damaging form—new-account fraud—happens when a thief uses your Social Security number and personal details to open credit cards, auto loans, or even mortgages in your name. By the time you notice, the damage to your credit report can take months to undo.

The good news? Congress handed consumers a remarkably powerful countermeasure. Under the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018, every American has the right to place a free security freeze on their credit file at any of the three major bureaus. It costs nothing to add, nothing to temporarily lift, and nothing to remove. If you haven't done it yet, finishing this article and then logging onto all three bureau websites is one of the highest-ROI hours you'll ever spend on your financial life.

02Security Freeze vs. Credit Lock vs. Fraud Alert: Know the Difference

These three tools sound similar but work very differently. A **security freeze** (also called a credit freeze) is a legal right under the FCRA. It instructs a bureau to refuse the release of your credit report to most new potential creditors. No report, no new account—it's that simple. It remains in place indefinitely until you lift or remove it.

A **credit lock** is a product—usually a paid subscription or app feature—offered by the bureaus themselves. Locks are typically easier to toggle on your phone but are governed by the bureau's terms of service, not federal law. That distinction matters: a security freeze has federal enforcement teeth; a credit lock does not.

A **fraud alert** is a softer tool. It asks (but does not require) lenders to take extra steps to verify your identity before opening an account. An initial fraud alert lasts one year; an extended alert for confirmed victims lasts seven. Fraud alerts are useful but far less airtight than a freeze. For maximum protection, use a freeze. Layer in a fraud alert if you've already been a victim.

03Step-by-Step: Freezing Your Credit at All Three Bureaus

You must contact each bureau separately—there is no single master switch. Here's exactly how to do it:

**Equifax:** Visit equifax.com/personal/credit-report-services or call 1-800-685-1111. Create a myEquifax account, navigate to "Security Freeze," and follow the prompts. You'll receive a confirmation and a PIN (save it somewhere safe).

**Experian:** Go to experian.com/freeze or call 1-888-397-3742. Experian lets you manage freezes through a free account or by phone. You'll verify your identity with personal information and may be issued a PIN.

**TransUnion:** Head to transunion.com/credit-freeze or call 1-888-909-8872. TransUnion's online process is straightforward; like the others, freeze confirmation is immediate online.

Once confirmed, each freeze takes effect within one business day for phone requests and is typically instant online. Keep a record of your PIN or confirmation number from each bureau—you'll need it to lift the freeze later.

04Don't Forget the Other Databases

The big three aren't the only credit data repositories that matter. **ChexSystems** collects banking history—if a fraudster tries to open a checking or savings account in your name, the bank may check ChexSystems instead of Equifax. You can freeze your ChexSystems file for free at chexsystems.com.

**Innovis** is a lesser-known fourth credit bureau used by some lenders and insurers. Freeze it for free at innovis.com/personal/securityFreeze. **NCTUE** (National Consumer Telecom & Utilities Exchange) tracks telecom and utility payment history—freeze it at nctue.com. And **LexisNexis Risk Solutions** aggregates public records and is checked by insurers and landlords; request a freeze at consumer.risk.lexisnexis.com.

Freezing only the big three leaves side doors open. Ten minutes covering ChexSystems and Innovis closes the most common ones.

05How to Temporarily Lift a Freeze When You Need Credit

A freeze doesn't mean you can never apply for credit again—it just means you control the timing. When you're ready to apply for a mortgage, car loan, or new credit card, you'll need to lift (thaw) the freeze temporarily or permanently.

To lift, log back into each bureau's website, navigate to your freeze settings, and choose either a temporary lift (you specify the dates, e.g., 3–5 days) or a permanent removal. A temporary lift is usually the smarter choice—once the lender has pulled your report, you can let the freeze snap back. Lifts must often be done bureau by bureau, so ask your lender which bureau they pull from to avoid unnecessary thaws.

Lifts take effect within one hour online and within three business days by mail, under federal law. Plan ahead: if you're closing on a home next Friday, don't wait until Thursday afternoon to unfreeze. And remember—lifting a freeze does NOT affect your credit score in any way.

06What a Freeze Does—and Doesn't—Protect

A security freeze is excellent at stopping **new-account fraud**—the most common and financially devastating form of identity theft. It does not, however, protect your existing accounts. If a fraudster already has your debit card number, a freeze won't stop an unauthorized charge. For that, you need account-level monitoring and strong unique passwords with two-factor authentication.

A freeze also won't stop all third-party access. Government agencies, certain debt collectors, landlords conducting tenant screening (with your consent), and your current creditors can still access your report. Employers may access a version of your report with your written consent as well. Insurance companies in some states may also have access. These exceptions are defined by the FCRA and are limited in scope—they don't allow opening new credit lines.

Finally, a freeze doesn't repair damage that's already done. If fraudulent accounts already appear on your report, you'll need to dispute them under the FCRA's Section 611 process—ideally with documentation like a police report or FTC identity theft report from IdentityTheft.gov.

07Building a Complete Identity Theft Defense Strategy

A credit freeze is the cornerstone, but it works best inside a layered strategy. Here's a simple framework:

**Monitor regularly.** You're entitled to free weekly credit reports from all three bureaus at AnnualCreditReport.com. Review them for accounts you don't recognize, unfamiliar addresses, or hard inquiries you didn't authorize.

**Use strong, unique passwords and enable two-factor authentication** on every financial account. A password manager makes this realistic.

**Shred sensitive mail**—pre-approved credit offers, old tax documents, and medical bills are goldmines for low-tech thieves. Consider opting out of pre-screened credit offers at OptOutPrescreen.com.

**File your taxes early.** Tax-related identity theft—where someone files a return in your name to steal your refund—is a growing problem. The IRS offers a free Identity Protection PIN (IP PIN) at irs.gov/identity-theft-central.

**Set up account alerts.** Most banks and credit card issuers let you trigger text or email notifications for any transaction over a set threshold. A $1 test charge is often the first sign a card number has been stolen.

No single measure is foolproof, but a credit freeze combined with regular monitoring and good digital hygiene significantly raises the cost and difficulty of targeting you. Identity thieves are opportunists—make yourself the hard target.