Most credit-related identity theft comes down to one thing: someone opening accounts in your name. The strongest free defense, a security freeze, stops most of that cold. Fraud alerts and bureau locks add other layers. And if theft has already happened, federal law gives you specific recovery tools that regular disputes don't.
This guide covers prevention and recovery, built on the FTC's guidance at IdentityTheft.gov and the protections in FCRA §§ 605A and 605B.
Key takeaways
- A security freeze is free at each bureau by federal law and blocks most new-account fraud.
- You must freeze separately at Equifax, Experian, and TransUnion, and lift temporarily when you apply for credit.
- Fraud alerts are free, last one year (seven years for extended alerts), and one bureau must notify the other two.
- Freezes, alerts, and locks don't affect your credit scores.
- If you're a victim, an FTC Identity Theft Report lets you block fraudulent information from your reports.
Freeze vs. fraud alert vs. lock
| Security freeze | Fraud alert | Credit lock | |
|---|---|---|---|
| What it does | Restricts access to your report so most new creditors can't see it | Tells creditors to take extra steps to verify your identity | Restricts access, like a freeze, under the bureau's own terms |
| Cost | Free by federal law | Free | Set by the bureau; sometimes part of a paid product |
| Where to place | Each bureau separately | One bureau; it must notify the other two | Each bureau's product separately |
| How long | Until you remove it | 1 year (initial), 7 years (extended, for victims) | Per the product's terms |
| Legal basis | FCRA § 605A | FCRA § 605A | Contract |
| Effect on score | None | None | None |
More detail in credit freezes vs. credit locks.
Credit freeze
- Cost
- Free by federal law
- Stops
- Most new-credit pulls
- Where
- Each bureau, separately
- Lifting
- Temporarily, when you apply
Credit lock
- Cost
- Often part of a paid product
- Stops
- Similar to a freeze
- Where
- Bureau app or service
- Rules
- Set by contract, not the FCRA
Fraud alert
- Cost
- Free
- Does
- Asks lenders to verify it's you
- Where
- One bureau tells the other two
- Length
- 1 year; 7 years for ID theft victims
CreditGod shows each bureau's status and links to the official flow; we only say “locked” when a bureau confirms it.
How to freeze your credit at all three bureaus
- 1Go to each bureau's official freeze page (Equifax, Experian, TransUnion). The FTC links to them from its freeze and fraud alert guide. Type addresses yourself rather than clicking links in emails.
- 2Verify your identity. You'll typically create an account or answer questions to prove who you are.
- 3Request the freeze. By law, a bureau must place it within one business day of an online or phone request, or within three business days of receiving a mail request.
- 4Save your PIN or login. You'll need it to lift or remove the freeze.
- 5Repeat at the other two bureaus. A freeze at one doesn't freeze the others.
- 6When you apply for credit, lift it temporarily at the bureau(s) the lender uses, or at all three. Online or phone lift requests must be processed within one hour.
Freezing a child's credit is free too. Parents and guardians can request freezes for children under 16, and guardians for certain incapacitated adults.
What a freeze doesn't do
- It doesn't stop fraud on accounts you already have; watch statements and set alerts.
- It doesn't stop your existing creditors, debt collectors acting for them, or certain government agencies from accessing your report.
- It doesn't affect prescreened offers on its own; you can opt out of those separately for five years or permanently.
- It doesn't cover specialty reports (like checking-account or tenant screening reports) unless you freeze with those companies too.
Fraud alerts and active duty alerts
An initial fraud alert lasts one year and asks businesses to take reasonable steps to verify your identity before opening credit. An extended fraud alert lasts seven years and requires an identity theft report; it also removes you from prescreened offer lists for five years. Active duty alerts for service members last one year. Place any of them with one bureau, which must notify the others (FTC).
Signs your identity may be compromised
- Accounts or hard inquiries you don't recognize on your reports.
- Bills or collection calls for debts you don't owe.
- Mail that stops arriving, or a change-of-address you didn't make.
- A tax return rejected because one was already filed with your SSN.
- Denial of credit you expected to get.
If it happens: the recovery steps
The FTC's recovery steps at IdentityTheft.gov:
- Call the companies where fraud occurred. Close or freeze affected accounts and change passwords and PINs.
- Place a fraud alert with one bureau and get your free reports from all three.
- Report it to the FTC at IdentityTheft.gov to get an Identity Theft Report and a personalized recovery plan. File a police report if needed.
- Freeze your credit at all three bureaus.
- Block fraudulent information. With your Identity Theft Report and proof of identity, a bureau generally must block information resulting from identity theft within 4 business days (FCRA § 605B) and notify the furnisher.
- Dispute fraudulent accounts and inquiries with the bureaus and the companies involved.
- For tax identity theft, get an IRS Identity Protection PIN.
Keep a log of every call and letter. Step-by-step detail is in identity theft: what to do.
Everyday habits that help
- Keep freezes on by default; lift only when applying.
- Use unique passwords and multi-factor authentication on financial accounts and email.
- Check your reports regularly; weekly free access is at AnnualCreditReport.com.
- Turn on account alerts for transactions and balance changes.
- Be skeptical of calls, texts, or emails asking for your SSN or codes. Legitimate companies won't pressure you.
Protecting children and deceased family members
Children's identities are attractive to thieves because the theft can go unnoticed for years. Federal law lets a parent or guardian request a free security freeze for a child under 16 at each nationwide bureau (15 U.S.C. § 1681c-1). Each bureau will ask for documents proving your identity and your authority to act for the child.
When a family member dies, notifying the bureaus and the deceased person's creditors helps prevent new accounts from being opened in their name. Keep a copy of the death certificate handy, since bureaus and creditors will typically ask for it.
How CreditGod helps
CreditGod shows per-bureau lock status and guides you through each bureau's official freeze flow. We never claim a bureau is locked unless it actually is. Membership includes dark-web, SSN, and address-change alerts and up to $1M identity restoration through our identity partners (partner terms apply). Freezes are always free to do yourself. See credit lock.
Prefer help with the legwork? CreditGod reads all three reports, flags items that may be inaccurate, and drafts disputes for your approval. You can always dispute for free on your own.
Frequently asked questions
Is freezing my credit free?
Yes. Federal law makes placing and lifting a security freeze free at each nationwide bureau.
Do freezes, locks, or fraud alerts lower my credit score?
No. Freezes, fraud alerts, and locks don't affect credit scores. You can still check your own credit.
How long does it take to unfreeze credit?
A bureau must lift a freeze within one hour of an online or phone request, and within three business days of a mail request.
Should I freeze or place a fraud alert?
A freeze is stronger because it blocks access to your report. A fraud alert is easier to live with but relies on lenders verifying identity. Many people use both after a breach.
Can I still use my credit cards when my credit is frozen?
Yes. A freeze affects new credit applications, not existing accounts.
What's an identity theft block?
Under FCRA § 605B, if you give a bureau an identity theft report, proof of identity, and identify the fraudulent information, the bureau generally must block it within 4 business days.
Do I need to pay for identity theft protection?
Not necessarily. Freezes, fraud alerts, weekly free reports, and FTC recovery help are all free. Paid services add things like ongoing monitoring, alerts, and restoration help. Compare what's included with what you can already do for free.
Sources and further reading
- FTC: Credit Freezes and Fraud Alerts
- 15 U.S.C. § 1681c-1 (FCRA § 605A): Fraud alerts and security freezes
- 15 U.S.C. § 1681c-2 (FCRA § 605B): Block of information resulting from identity theft
- IdentityTheft.gov (FTC)
- IdentityTheft.gov: What To Do Right Away
- FTC: What To Know About Identity Theft
- IRS: Get an Identity Protection PIN
- AnnualCreditReport.com (official free reports)
This guide is general educational information, not legal or financial advice, and CreditGod is not a law firm. You can dispute inaccurate information with the credit bureaus yourself, for free. Only inaccurate, incomplete, or unverifiable information can be disputed; results vary. Rules change, so check the CFPB, FTC, or a qualified professional about your situation. Read our editorial standards.