Credit freeze vs fraud alert: what each one blocks, and what neither stops

The letter says your Social Security number was in a breach, and it recommends a credit freeze or a fraud alert, sometimes both, as if they were two names for the same thing. They are different tools. Both are free and both are aimed at new accounts opened in your name, but one shuts the door and the other puts a sign on it.

The short answer

If you want the strongest protection against someone opening credit in your name, freeze your credit at all three nationwide bureaus. A freeze lasts until you lift it, costs nothing to place or lift, and means nobody can open a new credit account in your name, including you, until you do.^[1] Lifting one requested online or by phone has to happen within an hour.^[2]

A fraud alert is the lighter option. It leaves your report visible to lenders and requires them to take reasonable steps to confirm the applicant is you.^[2] It is easier to place, because one request covers all three bureaus, and it expires on its own. If your identity has already been stolen, an extended alert lasts seven years and can sit alongside a freeze.^[1]

Neither one does anything about a stolen card number on an account you already have, a tax return filed in your name, or an insurer, employer or landlord reading your file. Those need separate steps, covered below.

What each one actually does

A credit freeze, called a security freeze in the law, restricts access to your credit report. The CFPB describes it as preventing prospective creditors from accessing your credit file.^[3] Since most lenders will not approve an application without a report, an application in your name usually stops there. Anyone can freeze for any reason, whether or not their identity has been stolen.^[1]

A fraud alert does not restrict access. FTC guidance is direct about it: unlike a freeze, a fraud alert does not prevent businesses from seeing your credit report.^[1] What it changes is the lender’s duty. Before opening new credit, a lender that sees the alert has to use reasonable policies and procedures to form a reasonable belief that it knows who is applying. If you gave a phone number with the alert, it has to call you on it or take reasonable steps to verify your identity another way.^[2]

The request count is the practical difference people miss. A fraud alert placed at one bureau must be passed to the other two; a freeze has to be requested at Equifax, Experian and TransUnion one by one.^[1] Freeze at only one and a lender that pulls from either of the others still sees your file. A freeze is only as strong as the bureau you skipped.

Fraud alerts come in three kinds, and each one is placed by contacting a single bureau, which must tell the other two.^[1]

Federal law sets both the price and the clock. A bureau must place a freeze free of charge within 1 business day of a request made online or by toll-free phone, or 3 business days of one made by mail. It must lift one within 1 hour of an online or phone request, or 3 business days of a mailed one.^[2] You can also lift a freeze temporarily for a period you choose, at no charge.^[3]

Two things neither tool does. A freeze does not affect your credit scores in any way, according to the CFPB.^[3] And the paid “credit lock” products bureaus sell are, in the CFPB’s assessment, no more effective than the free freeze.^[3] The score itself is built from the five factors in how a FICO Score is weighted, and a freeze touches none of them.

Who can still see a frozen file

A freeze is not a wall around the whole report. The statute lists who may still read it, and the list is longer than most guides mention.^[2] The CFPB summarizes the main ones as creditors on accounts you already hold, certain government entities such as child support agencies, and companies you have hired to monitor your file, and it notes the freeze does not apply to requests for employment, tenant screening or insurance.^[3]

The tenant exception matters more than it looks. In 2024 the FTC received 17,790 identity theft reports of an apartment or house rented in someone else’s name.^[4] Because tenant screening can still read a frozen file, a freeze is not a reliable defense against that kind of fraud. Checking your reports is, and you can now get one from each bureau every week for free at AnnualCreditReport.com.^[6]

What neither one stops

Both tools act on one thing: a lender reading your credit report before opening a new account. That is the most common kind of identity theft people report. Of the 1,135,291 identity theft reports the FTC received in 2024, 449,032 involved credit cards, more than any other type.^[4] Within credit card reports, 406,110 were about new accounts and 52,428 about existing ones.^[4]

Those figures are counts of reports people filed, not a survey, and the FTC notes that 14% of identity theft reports in 2024 named more than one type.^[4] They are still a useful map of where a freeze helps and where it does not:

• Charges on cards and accounts you already have. A stolen card number needs no credit check. The defense is reading every statement, and disputing a charge you did not make through your issuer.
• A tax return filed with your Social Security number. The FTC logged 54,725 tax fraud reports in 2024.^[4] The IRS tool for this is the identity protection PIN, a six-digit number that prevents someone else from filing a return with your Social Security number. Anyone with an SSN or ITIN who can verify their identity can get one, and a new PIN is generated each year.^[5]
• Insurance, employment and rentals. All three can read a frozen report under the exceptions above.^[2]
• Your own paperwork. A freeze cannot help with numbers someone pulls out of your recycling bin. Knowing which records to keep and which to shred narrows what is lying around to be found.

For the first item, the part neither the bureaus nor the law does for you, the fastest signal is a charge you did not expect showing up on an account you already have. LumaLedger can alert you to large and unusual charges: any single charge of 500 or more in your ledger’s currency, and a charge well above what that payee usually takes from you. The unusual-charge check compares against the payee’s own history, so a charge from a merchant you have never paid before is not flagged by it; that is what reading the transaction list is for.

A worked example: from breach letter to car loan

Here is a sample timeline using the federal deadlines. On October 23, 2026, you get a letter saying your Social Security number was exposed in a breach. There is no sign anyone has used it yet.

1. 1
   October 23, 2026: freeze at all three bureaus

   Three requests, online or by phone, at Equifax, Experian and TransUnion. Each must be in place within 1 business day. Cost: $0. Keep the login details each bureau gives you; you need them to lift it.
2. 2
   Same day: pull your reports

   Free weekly reports from each bureau at AnnualCreditReport.com. You are looking for accounts and inquiries you do not recognize. None here, so no identity theft report is needed.
3. 3
   January 2027: get an IRS identity protection PIN

   The freeze does nothing for tax fraud. The IP PIN does, and the IRS issues a new one each year, so you retrieve it again each filing season.
4. 4
   April 2027: lift the freeze for a car loan

   Ask the dealer which bureau the lender pulls. Lift that one online, for a temporary window of, say, 14 days. The bureau has 1 hour. The freeze returns on its own when the window closes.

Now change one fact. In March 2027 your report shows a store card you never opened. You file an identity theft report with the FTC and place an extended fraud alert alongside the freeze. The alert runs for seven years, to March 2034, and keeps you off prescreened offer lists for five years, to March 2032. You can get two free copies of your file from each bureau within 12 months.^[2]

The cost of the freeze in this example is a few minutes of setup and a few minutes per application. The cost of the fraud alert alone would have been nothing at all, and the store card might still have been approved if the clerk took the application at face value: an alert requires reasonable steps, not a refusal.^[2]

Which one to use, and when

The choice mostly comes down to how often you apply for credit and whether anything has already gone wrong.

The child freeze is the one most people skip. A child under 16 can be frozen for free, and the freeze stays in place until you tell the bureaus to remove it; the request process differs from an adult freeze and is described on each bureau’s site.^[1]

A freeze is free, fast to lift, and aimed squarely at the most common identity theft people report. A fraud alert is a lighter signal that expires on its own. Neither one watches the accounts you already have or the tax return you have not filed yet, and those are the two gaps worth closing yourself.