Credit Freeze vs Fraud Alert: Which Protects You More After Identity Theft?

15 Million Americans Experience Identity Theft Each Year

The Federal Trade Commission received 1.4 million identity theft reports in 2023 alone. Credit card fraud topped the list, but new account fraud — where a thief opens loans or credit lines in your name — causes the deepest damage. It can take years to undo. Two federally mandated tools exist to stop new account fraud before it happens: credit freezes and fraud alerts. They are not the same thing, and the difference matters enormously when you are trying to protect yourself.

Fraud Alerts: A Warning Flag, Not a Lock

A fraud alert places a notice on your credit file telling lenders to take extra steps to verify your identity before extending credit. Under the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018, there are three types:

• Initial fraud alert: Lasts 1 year. No documentation required. Placing it on one bureau automatically notifies all three.
• Extended fraud alert: Lasts 7 years. Requires an identity theft report filed with the FTC or a law enforcement agency. Entitles you to two free credit reports per year from each bureau in addition to the standard annual ones.
• Active duty military alert: Lasts 1 year while on active duty. Available only to servicemembers deployed away from their usual duty station.

The key limitation of fraud alerts: they ask lenders to verify identity, but verification is not mandatory. There is no federal law requiring a lender to act on a fraud alert flag. Most large banks have internal procedures for doing so, but a determined thief who can answer basic identity questions may still succeed in opening an account.

Credit Freezes: The Harder Lock

A credit freeze — also called a security freeze — restricts access to your credit report entirely. When a freeze is in place, a new creditor who pulls your credit file receives a notification that the file is frozen and cannot process the application. The credit check simply cannot be completed.

Freezes became free for all Americans under federal law in September 2018 (Section 301 of the Economic Growth, Regulatory Relief, and Consumer Protection Act). Before that change, bureaus could charge up to $10 per freeze in most states. Today, placing, lifting, and removing a freeze is free, can be done online within minutes, and remains in effect indefinitely until you remove it.

Critically, a freeze must be placed separately at each of the three major bureaus: Equifax, Experian, and TransUnion. They do not notify each other. For more complete protection, consider also freezing files at the smaller specialty bureaus: ChexSystems (used for bank account applications), Innovis, and the NCTUE (used by some utility companies).

Side-by-Side Comparison

What Neither Tool Can Do

Both fraud alerts and credit freezes protect only against new account fraud — the opening of new credit lines. Neither prevents:

• Fraudulent charges on your existing credit cards
• Theft of existing bank account credentials
• Medical identity theft (a separate category using your health insurance)
• Tax identity theft (fraudulent returns filed in your name)
• Social Security fraud

For existing account fraud, your protection comes from monitoring statements, setting up transaction alerts, and acting quickly when you spot unauthorized charges.

Temporarily Lifting a Freeze

When you apply for credit — a new card, a mortgage, a car loan — you must temporarily lift or permanently remove the freeze at the relevant bureau. Most lenders tell you which bureau they pull. Equifax, Experian, and TransUnion all allow you to schedule a temporary lift for a specific date range (e.g., lift for 48 hours) through their online portals or by calling their respective phone lines. The process typically takes minutes online but can take up to 3 business days by mail.

After Identity Theft: Using Both Together

The optimal response after confirmed identity theft is to use both tools simultaneously. File an identity theft report at IdentityTheft.gov (the FTC's official portal), which generates a recovery plan and creates documentation you can use to dispute fraudulent accounts. Then place an extended fraud alert (using your FTC report) and a credit freeze at all three bureaus. The extended alert lasts 7 years; the freeze stays until you remove it. Together, they provide overlapping layers of protection while you work through the recovery process.

Children's credit files — which technically don't exist until credit is first sought — can be frozen as a preventive measure at all three bureaus. This protects minors whose Social Security numbers are often targeted precisely because the fraud can go undetected for years.

This article is for informational purposes only and does not constitute financial advice.