Federal law makes credit freezes free, requires them to be placed within one business day and lifted within one hour. Here is the fifteen-minute process, how a freeze differs from a lock or an alert, and the fraud it does not stop.
The Federal Trade Commission’s Consumer Sentinel Network Data Book recorded 1,135,291 identity theft reports in 2024. The largest single category was credit card identity theft at 449,032 reports, followed by other identity theft at 358,993, loan or lease fraud at 176,400 and bank account fraud at 114,608. Across all fraud types, consumers reported losses of more than 12.5 billion dollars that year.
A credit freeze does not address all of that. It addresses one specific and expensive slice of it: somebody opening a new account in your name. It is free, it is required by federal law, it takes about fifteen minutes to arrange at all three nationwide bureaus, and it is close to the only meaningful protection you can put in place yourself in a single sitting.
What a freeze actually does
When a lender considers an application, it pulls your credit report. A freeze restricts access to that report, so the pull fails and the application generally cannot proceed. A criminal holding your name, date of birth and Social Security number still cannot open an account, because the lender cannot see the file it needs.
The FTC is clear that a freeze does not affect your credit score, and that it lasts until you lift it. There is no expiry date and no renewal to forget.
It is worth being precise about the mechanism, because it explains the gaps. The freeze protects the report, not the accounts. Anything that does not require a new credit pull is untouched by it.
The law that made it free and fast
Before September 2018 freezes cost money in many states and could take days to lift. The Economic Growth, Regulatory Relief, and Consumer Protection Act changed that with effect from 21 September 2018, and the deadlines it set are the reason this is now practical.
Request a freeze by phone or online and the credit bureau must put the freeze in place within one business day. Ask for it to be lifted by phone or online and the bureaus must take that action within one hour. By mail, they have three business days either way. The same law extended the duration of a fraud alert from 90 days to one year.
The one-hour figure is the one to remember, because it removes the main argument against freezing: that it will get in the way when you want credit. It will not, provided you plan an hour ahead.
Freeze, lock, fraud alert, monitoring
These get used interchangeably in marketing and are not the same thing.
| Tool | Cost | What it does | Timing | Backed by |
|---|---|---|---|---|
| Security freeze | Free | Restricts access to your credit report, blocking most new-account applications | Placed within one business day; lifted within one hour online or by phone | Federal law |
| Initial fraud alert | Free | Tells businesses to check with you before opening a new account | Lasts one year, renewable | Federal law |
| Extended fraud alert | Free | Same, for people who have completed an FTC identity theft report or filed a police report | Lasts seven years | Federal law |
| Active duty alert | Free | For servicemembers on deployment | Lasts one year, renewable | Federal law |
| Credit lock | Varies; sometimes bundled into a paid product | Broadly similar effect to a freeze | Usually instant | The provider’s contract terms, not statute |
| Credit monitoring | Frequently paid | Notifies you after something has already appeared on your report | After the fact | Nothing |
The distinction that matters most is the last column. A freeze is a statutory right with deadlines a company must meet. A lock is a service governed by terms the provider can change. Where both are offered, the freeze is the stronger instrument, and it is the one that is free by law rather than free as a current promotion.
Monitoring is not a substitute for either. It is a smoke alarm, and a freeze is a locked door.
The fifteen minutes
You must do this separately at each of the three nationwide credit bureaus, because a freeze at one does not propagate to the others. Before you start, have to hand your Social Security number, date of birth, current and recent addresses, and a means of verifying your identity.
- Go to each bureau’s own website directly. Type the address rather than following a search advertisement, which is where imitation sites sit.
- Create an account or verify your identity, and request the freeze. Expect identity questions drawn from your credit history.
- Record whatever credentials or PIN each bureau issues. Store them somewhere you will find them in three years, which is when you will next need them, not somewhere convenient today.
- Repeat at the second and third bureau.
- Consider doing the same for a spouse or partner. A freeze protects one person’s report, not a household’s.
The record-keeping step is the one people skip and regret. A freeze you cannot lift because the credentials are gone is an obstacle to you and nobody else, and recovering access takes considerably longer than the hour the law allows for a lift.
Two smaller reporting agencies, Innovis and the National Consumer Telecom and Utilities Exchange, also accept freezes and are used by some lenders and utilities. They are optional extras rather than part of the core fifteen minutes.
What a freeze does not stop
This is the section most articles omit, and it matters more than the instructions.
A freeze does nothing about your existing accounts. Someone who obtains your card number and buys things with it is committing fraud on an account that already exists, and no credit report is pulled. That is why credit card fraud remains the largest identity theft category in the FTC data despite freezes being free for years.
It does not stop account takeover, where a criminal gains access to an account you already hold. It does not stop tax refund fraud, which runs through the IRS rather than the bureaus. It does not stop medical identity theft or the misuse of your Social Security number for employment. And it does nothing whatever to prevent the data breaches that supply the underlying information; it only limits what can be done with the results.
A freeze is also not absolute even for new accounts. Existing creditors, debt collectors acting on their behalf, and certain government and court functions can still access your report, and some lenders use specialty reporting agencies you have not frozen.
None of this argues against freezing. It argues against treating a freeze as the whole answer, which is the failure mode it invites.
Lifting it when you actually need credit
You will need to lift the freeze for a mortgage, a car loan, a new credit card, most rental applications, some utility connections and some job applications. The process is deliberately manageable.
You can lift the freeze temporarily for a set period, or permanently, and you can do it at one bureau rather than all three if you know which one the lender will use. Ask the lender that question before you apply; most will tell you, and lifting one freeze rather than three is less to undo afterwards.
Plan an hour of margin. The statutory deadline is one hour for online and phone requests, which is fast but is not instant, and a mortgage application desk at four o’clock on a Friday is the wrong moment to discover the distinction.
After the application completes, refreeze. This is the step that quietly fails: people lift a freeze for a car purchase and leave it open for years.
Children and dependants
Children are attractive targets precisely because nobody checks a nine-year-old’s credit report for a decade. The 2018 law allows parents to freeze the credit of children under 16 free of charge, and guardians, conservators and holders of a valid power of attorney can obtain a free freeze for their dependants.
A child usually has no credit file at all, so the bureau creates one and freezes it. That is the intended behaviour, and it is worth the paperwork for anyone whose child’s Social Security number has appeared in a breach notification, which by now is a large share of them.
The companion habit: read the reports
A freeze stops new accounts being opened. It does not tell you whether any were opened before you froze, or whether something inaccurate is already sitting in your file. For that you need the reports themselves, and they are free.
Since October 2023 the three nationwide credit reporting companies have permanently offered one free report each, every week, through AnnualCreditReport.com. The Federal Trade Commission warns explicitly that other sites may charge you or may be fraudulent sites set up to steal your personal information. Use that address and no other.
Reading a report takes ten minutes and you are looking for four things: accounts you do not recognise, addresses you have never lived at, inquiries from lenders you never applied to, and balances that are wrong. The first two are the signatures of new-account fraud; the third often precedes it.
Weekly access is more than anyone needs. Pulling one bureau every four months rotates you through all three in a year at no cost and no effort worth mentioning.
When a breach notification arrives
Breach letters have become routine enough that most people file them unread, which is understandable and a mistake, because the letter tells you what was exposed and that determines what to do.
If the exposure includes your Social Security number or date of birth, that is new-account territory, and a freeze is the proportionate response. If it is a card number, the relevant action is with the card issuer: replace the card and check the statement. If it is a password, change it wherever it was reused, which is the real exposure.
Breach letters usually offer free credit monitoring for a year or two. Accepting it is harmless, and it is worth noticing that the company is offering you a smoke alarm rather than a lock. The freeze is still yours to place, and it does not expire when the free monitoring does.
If it has already happened
If accounts have been opened in your name, the freeze is a containment measure rather than a fix. Report it at IdentityTheft.gov, the FTC’s reporting and recovery site, which generates the FTC identity theft report used to obtain the seven-year extended fraud alert and to support disputes with creditors and bureaus.
Freeze all three reports, then work through the recovery plan the site produces. Keep a written log of every call, including dates, names and reference numbers, because the process runs on your documentation rather than theirs.
The honest assessment
A credit freeze is the best available example of a consumer protection that is free, legally enforceable, and genuinely effective at the one thing it does. It is also narrow. It prevents new accounts and nothing else, while the FTC data show that the most frequently reported identity theft involves credit cards, a substantial part of which concerns cards that already exist.
So freeze your reports, because fifteen minutes for permanent protection against new-account fraud is an unusually good trade. Then be clear-eyed that you have closed one door in a building with several, and that the remaining work, checking statements, using unique passwords and taking account alerts seriously, is ongoing and considerably less satisfying.
General information, current as of September 2026, and not personalised legal or financial advice. Procedures at each credit bureau change; use the bureaus’ own sites and the FTC resources linked above.
Frequently asked questions
Will a freeze hurt my credit score?
No. A freeze has zero effect on your score, your existing accounts, or your ability to use current cards. It only blocks lenders from pulling your file to open new credit.
What if I need a loan while frozen?
You temporarily thaw the file online or by phone, usually effective within minutes, complete your application, and the freeze resumes automatically or on the date you set.
