FraudCreditPrevention2026

How to Freeze Your Credit and Place a Fraud Alert Before It Matters

A credit freeze stops new accounts opened in your name at participating lenders — and that is both its whole power and its whole limit. It does nothing about the takeover of an account you already hold, and nothing about the push-payment scam where you authorise the transfer yourself. Here is the three-instrument compare, the bureau-by-bureau reality, the lift friction that is the price, and what a freeze does not replace.

General information only — not financial advice, and not a substitute for your credit bureaus' own instructions. This page explains the difference between a credit freeze, a fraud alert, and a credit lock, and what a freeze does and does not stop. The mechanics, costs, durations, and even the number of bureaus vary by country; the names and rules below are general and, where they reflect the US system, are examples — check your national equivalents and the bureaus' own sites. A freeze is one preventive layer and does not replace the account hardening in our account-recovery guide.

A plain metal padlock with a small keyhole lying on a clean light surface beside a single blank key — The padlock beside its single blank key is the freeze and the lift made physical: the lock is the protection, the key is the friction — you hold the only way to open it again when you legitimately need credit, and losing that key is the price of the peace. The key stays blank on purpose; the lift credential is yours, not a pattern to copy.

Updated September 2026By the AI Help Guide editorial team10 min read

The Overclaim

"Freeze Your Credit" Is Sold as a Shield; It Is a Filter

The advice to "freeze your credit" circulates as a kind of universal armour — do this and you are protected — and the overclaim is the reason so many people who did it feel betrayed when the fraud that actually hits them is the kind a freeze never addressed. A credit freeze is not a shield against fraud in general; it is a filter against one specific fraud — someone opening a new credit account in your name — and it does nothing about the account you already hold being taken over, nothing about a non-credit scam, and nothing about the push-payment loss where you authorised the transfer yourself. The honest framing is the whole page: know exactly what the filter catches, so you do not stand in front of the kinds it lets through believing you are covered.

This page is the pre-emption half of the money trio; its companions, the how-money-leaves guide and the recovery-scam guide, deal with the loss and the second fraud that follow. The account-recovery guide that came before explained the hub and the channel; this page explains the one additional preventive layer that sits outside your accounts entirely — the credit file — and the limit that means it cannot replace the others. The three instruments below are often blurred together, and the first service they provide is separating them.

The Three Instruments

Freeze, Fraud Alert, Credit Lock — Three Different Jobs

People use "freeze," "alert," and "lock" interchangeably, and they are three instruments with different mechanisms, different durations, and different costs. The compare below separates them across the dimensions that matter; the durations and costs are general examples of how these systems typically work and vary by country and bureau, so confirm the current rules with the bureaus and your regulator rather than treating any row as fixed.

Dimension	Credit freeze	Fraud alert	Credit lock
What it does	Restricts access to your credit report, so new accounts are harder to open in your name	Flags your file so lenders must verify your identity before granting credit	A per-bureau product that lets you lock/unlock your own file, often via an app
Typical duration	Generally stays until you lift it (example; varies)	Typically time-limited, e.g. about a year, with longer options (example; varies)	Whichever way the bureau's product is set (varies)
Cost	Generally free to place and lift (example; varies)	Generally free (example; varies)	May be free or paid, depending on the bureau (varies)
How you set it	At each bureau that holds your file	At one bureau; often propagates to the others (varies)	At the individual bureau, via its app or site
Strength	Strongest against new-account fraud	Lighter — a prompt to verify, not a block	Convenient; terms depend on the product

The compare's practical reading is that the three are not rivals but a gradient: a fraud alert is the lightest touch (a flag that asks lenders to check who you are), a freeze is the heaviest (a restriction that stops the check from happening at all), and a lock is a convenience layer that trades some of the freeze's certainty for the speed of an app. The durations and costs in the middle rows are deliberately hedged, because they are exactly the specifics that differ by country and change over time, and a guide page that stated them as fixed would be selling you a rule that may not apply to your file. Confirm at the bureau; the distinction between the three instruments is the durable lesson, not any single number.

What a Freeze Stops — and What It Does Not

The Filter and the Things That Walk Through It

The honest limit is the page's thesis, and the two columns below are its whole argument. A freeze is powerful against the fraud it was built for and silent against the frauds that actually cost most people their money — including the push-payment loss the how-money-leaves guide describes, where no credit file is involved at all because you sent the money from an account you already own.

What a freeze DOES address

New credit accounts opened in your name by someone using your identity
Some inquiries that require access to your credit report
The "open a line of credit with my stolen details" attack
Giving you a tripwire: a blocked inquiry is a signal something is wrong

What a freeze does NOT stop

Takeover of an account you already hold (the account-recovery attack)
Push-payment scams where you authorise the transfer yourself
Non-credit fraud: gift-card, crypto, wire, and marketplace losses
A fraudster who already has your credentials or your mailbox
Existing accounts being misused, or your data already being held

The attack	Does a freeze help?	Why	What actually helps
New account in your name	Yes	It restricts the credit-report access the opener needs	The freeze itself
Existing-account takeover	No	No new credit report access is involved; the attacker is already inside	Hub-hardening & channel ownership (account-recovery guide)
Push-payment scam	No	You authorise the send; no credit file is touched	Reading the payment instruction (how-money-leaves guide)
Gift-card / crypto loss	No	Irreversible push, outside the credit system entirely	Recognition & the clock (how-money-leaves guide)
Mailbox / email compromise	No	The hub is your inbox, not your credit file	Securing the hub (account-recovery guide)

The table's first row is the freeze's entire domain, and every row below it is a fraud that a freeze does not touch — which is the point of the page. The attacks that cost most people real money are the push and the takeover, and both live outside the credit file: the push because you authorised it from an account you own, the takeover because the attacker was already inside. A freeze is worth placing, and it is the right tool for new-account fraud; it is simply not the tool for the frauds this cluster is mostly about, and believing it is would be the overclaim the opening named.

The bureau-by-bureau reality — and why "freeze my credit" is rarely one action. In systems with multiple credit bureaus, your file is not in one place, so a freeze at one bureau does not restrict the others: you generally place a freeze at each bureau that holds your file, which is why the advice "freeze your credit" is really "freeze your credit at every bureau." A fraud alert is often lighter in this respect — placing one at a single bureau may propagate to the others — but the propagation rule varies, so confirm it. And the number of bureaus, their names, and the mechanics differ by country: the three-bureau structure common in the US is an example, not a universal, and elsewhere there may be one national bureau or a different arrangement. The durable lesson is the shape — the file may be held in more than one place, so the protective action may need repeating — and the specific list of who holds your file and how to reach them is a question for your national bureaus and regulator, not a guide page.

The lift is the friction — and forgetting it at the wrong moment is the price of the protection. A freeze works by blocking access to your report, which means that when you legitimately apply for credit, rent a property, take out certain insurance, or start a job that checks your file, the freeze blocks that too — until you temporarily lift or unfreeze it, often with a PIN or an online step, sometimes instantly and sometimes with a delay depending on the bureau and the rules. That lift step is the cost of the protection, and the common complaint from people who froze is not that it failed but that it worked at an inconvenient moment and they had not kept the lift credential handy. The practical discipline is to place the freeze knowing you will occasionally have to open it, to keep your lift credentials somewhere safe and findable (and not, per the survivable-passwords guide's newspaper test, written where a stranger could use them), and to weigh the friction honestly against your risk rather than treating the freeze as free.

When to Use Which

A Decision Frame, Not a Default

The three instruments suit different situations, and the honest move is to choose by risk rather than to apply a blanket "always freeze." The frame below is a starting point; your own circumstances — a recent breach, an upcoming application, a thin credit file, a high-risk profession — shift the answer, and the specifics belong to the bureaus and your regulator.

Lighter

Fraud alertA prompt to verify, less friction, often propagated from one bureau. Reasonable as a baseline or a temporary measure after a scare, when a full freeze's lift-friction is not worth it.

Stronger

Credit freezeThe heaviest filter against new-account fraud, generally free and lasting until lifted. Worth it after a breach of your identity data, or if you do not apply for credit often and can bear the lift friction.

Convenient

Credit lockA per-bureau product, often app-based, trading some certainty for speed. Useful if you need to open and close access frequently — but read its terms, because it is the bureau's product, not a statutory right.

The frame's logic is that the choice is a trade between protection and friction, not a ladder to the top. A freeze is the strongest filter but carries the lift cost; a fraud alert is lighter and easier but only asks lenders to check; a lock is convenient but is a product whose terms you must read. The right answer depends on how likely new-account fraud is for you and how much lift friction you can tolerate — and for most people the honest default is: if your identity data has been breached, freeze at each bureau; if it has not, a fraud alert plus the account hardening below is a reasonable baseline. The bureaus and your regulator confirm the current mechanics.

What a freeze does not replace — the layer it sits on top of, not instead of. A credit freeze is one preventive layer, and the frauds that cost real money usually live below it:

The hub — your email and your account logins. A freeze does nothing about a takeover of an account you already hold; that is the account-recovery guides territory, and the hub must be hardened with its own phishing-resistant two-factor.
The channel — owning the recovery path. A freeze does not stop an attacker walking you through an inbound reset; that is the channel-ownership rule, and it is a habit, not a credit-file setting.
The recognition — reading the message, the voice, and the payment instruction. A freeze does nothing about a push-payment scam where you authorise the send; that is the how-money-leaves guides territory, and the defence is seeing the method as the tell.
The succession — the break-glass and the inventory. A freeze does not protect your estate from being sealed shut; that is the digital-estate cluster, and it is the mirror risk the freeze never addresses.

The freeze is worth doing, and it is the right tool for new-account fraud. It is simply not a substitute for the four layers above, and a person who froze and stopped there has protected the one surface the trio is least about and left the four that matter most at their default.

A worked example: the breach that froze three files and missed the hub

Concretely, the filter, the bureau-by-bureau reality, and the not-replace limit meeting a person who did the freeze right and still got taken over the long way. A retail data breach exposes a persons name, address, date of birth and partial details — the kind of leak that invites new-account fraud — and the person, correctly, acts: they place a credit freeze at each of the three bureaus that hold their file, keep the lift credentials somewhere safe, and consider the identity protected.

The freeze did its job. For months, every attempt to open a new line of credit in their name is blocked at the report-access step — the first row of the table, the fraud the filter was built for, neutralised three times over because they understood that "freeze my credit" meant "freeze it at every bureau." The tripwire worked too: a blocked inquiry alerted them to attempts they would never otherwise have seen.

But the fraud that cost them money never touched the credit file. The attacker did not try to open new credit; they went for the hub — the email account, which still used SMS two-factor and a reused password — and from there walked the channel-ownership gap: a phishing message, a reset code read aloud to a "support" caller, and the email inbox fell. From inside the hub they reset the bank and the brokerage, not by opening new accounts but by taking over existing ones — the second and fifth rows of the table, the attacks a freeze does not and cannot address. The money left as a push, authorised from accounts the person already owned, and the credit file — frozen, protected, irrelevant — was never consulted at all.

The lesson is the pages thesis in one story: the freeze was correct and it worked, and it was the wrong layer for the attack that actually came. The breach justified the freeze, and the freeze stopped new-account fraud; but the hub was the real perimeter, the channel was the real door, and the recognition of the payment instruction was the real defence — the four layers the not-replace callout lists, all of which the person had left at default while feeling protected by the one setting that did not apply. The corrected version is both: freeze at each bureau and harden the hub with a phishing-resistant method, own the recovery channel, and read the push-payment instruction as the tell — because a filter on the credit file protects the file, not the person who holds the accounts.

The Check

A Sensible Default

Hold the limit: a freeze is a filter for new-account fraud, not a shield against fraud in general.
Separate the three: freeze (restrict), alert (flag to verify), lock (per-bureau product) — different jobs, different friction.
Treat durations and costs as examples that vary; confirm the current rules at the bureau and with your regulator.
Know the bureau-by-bureau reality: a freeze generally goes at each bureau; an alert may propagate — check the rule.
Price the lift friction: keep your lift credentials safe and findable, and weigh friction against risk.
Read the does-not-stop column: a freeze does nothing about takeover, push payments, non-credit fraud, or a compromised hub.
Stack the layers: freeze and harden the hub, own the channel, recognise the instruction, plan the succession — not instead of.
Route the specifics out: the bureaus and your national regulator are the authorities on mechanics, costs and duration.

The honest takeaway is that a credit freeze is worth placing and easy to over-trust, and the cost of that over-trust is standing in front of the attacks that actually drain accounts while believing a filter on the credit file has you covered. Place it for new-account fraud, especially after a breach, and repeat it at each bureau; but understand that the money lives in the hub, the channel, and the payment instruction, and that the freeze touches none of them. For the loss a freeze cannot prevent, see our how-money-leaves guide; for the second fraud that follows it, see our recovery-scam guide; for the hub and channel hardening that a freeze does not replace, see our account-recovery guide; for the recognition that stops the push before it is authorised, see our phishing and deepfake guides; and for the current mechanics, costs and durations of any instrument here, see your bureaus and your national regulator — the authorities this page keeps routing you to, because the distinctions are durable and the specifics are not ours to assert.

Three identical small lock cylinders standing side by side on a clean light surface, the middle one with a slightly different keyway — The three cylinders with one different keyway are the bureau-by-bureau reality made physical: your file may be held in more than one place, and a lock at one does not secure the others. The protective action is a repetition across holders, not a single switch — and who holds your file is a question for the bureaus, not a page.

Common Questions

Frequently Asked Questions

What is the difference between a credit freeze, a fraud alert and a credit lock?

They are three instruments with different jobs. A credit freeze restricts access to your credit report so new accounts are harder to open in your name, and generally stays until you lift it. A fraud alert is a flag on your file asking lenders to verify your identity before opening credit, typically for a limited period. A credit lock is a per-bureau product with its own terms and often an app. The mechanics, costs and durations vary by country and bureau, so confirm the current rules with the bureaus and your regulator.

Does a credit freeze stop all fraud?

No, and this is the honest limit the whole page is built around. A freeze mainly addresses new-account fraud — someone opening credit in your name. It does not stop the takeover of an account you already hold, it does not stop non-credit fraud, and it does nothing about a push-payment scam where you authorise the transfer yourself. A freeze is one preventive layer and not a substitute for hardening the account hub and owning the recovery channel.

Do I have to contact every credit bureau?

In systems with multiple bureaus, generally yes for a freeze — you place it at each bureau that holds your file, because a freeze at one does not restrict the others. Fraud alerts often propagate from one bureau to the others, but the rule varies, so confirm with the bureau. The number of bureaus and the mechanics differ by country, so check your national equivalents rather than assuming a single system.

What is the downside of freezing my credit?

The friction of lifting it. While frozen, you must temporarily lift or unfreeze — often with a PIN or online, sometimes instantly, sometimes with a delay — whenever you legitimately apply for credit, some rentals, insurance, or a job that checks your file. That lift step is the price of the protection, and forgetting it at the moment you need credit is the common complaint. Weigh the friction against your risk, and keep your lift credentials somewhere safe.

I froze my credit after a breach. Am I now safe from identity theft?

You are safer against the one fraud the freeze filters — new accounts opened in your name — and that is genuinely worth doing after a breach. But the breach may also have exposed the details used to attack your existing accounts and your email hub, and a freeze does nothing about those. The attacks that cost most people money are the takeover and the push payment, both outside the credit file. So: freeze at each bureau, and also harden the hub, own the recovery channel, and read payment instructions as tells. The freeze is a layer, not the whole defence.

Is a credit lock better than a freeze because it is faster?

Faster to open and close, often yes — that is its convenience — but "better" depends on what you are protecting against and on the products terms, which vary by bureau. A lock is a per-bureau product you opt into, not a statutory right, so read its terms rather than assuming it matches a freezes protection. If you need to open and close access frequently, a lock may suit; if you want the heaviest filter against new-account fraud and can bear the lift friction, a freeze is the stronger instrument. They are trades, not a ranking.

How long does a fraud alert last, and does it cover all my bureaus?

Both are specifics that vary by country and change over time, which is exactly why this page will not state them as fixed. Generally a fraud alert is time-limited with longer options in some systems, and placing one at a single bureau may propagate to the others — but the duration and the propagation rule are questions for the bureau and your regulator, not a guide page. The durable lesson is the distinction — an alert asks lenders to verify, a freeze restricts access — and the current mechanics live with the bureaus.

Ask our AI. Deciding whether to freeze, alert, or lock? Tap the chat icon and tell us what happened — a breach, a scare, an upcoming application — and it can place your situation on the three-instrument frame and the decision gradient, flag the lift friction before it bites, and route the current mechanics and durations to your bureaus and regulator. It will not state a rule as fixed, because the specifics are not ours to assert.

More fraud & prevention guides like this

We treat a credit freeze as a filter for new-account fraud rather than a shield against fraud in general — worth placing, easy to over-trust, and no substitute for hardening the hub, owning the channel, and reading the payment instruction that the attacks costing real money actually use.

Explore All Guides