Credit Freeze vs. Fraud Alert vs. Credit Lock: What Actually Protects You

You get the letter, or more likely the email: a company you've done business with had "a security incident," and your name, and maybe your Social Security number, was part of it. It's such a routine piece of mail now that it's easy to skim past. But buried in the boilerplate is usually a mention of three tools you're entitled to use — a security freeze, a fraud alert, and a credit lock — with almost no explanation of what any of them actually do, or which one you actually need.

That vagueness isn't an accident so much as a side effect: the three tools solve genuinely different problems, one of them is a legal right and the other is a paid product wearing similar language, and most people either do nothing or reach for the wrong one. Here's what each one actually does, in plain terms, and the order that makes sense whether you're reacting to a specific breach or just tired of wondering.

Three tools, one confusing menu

Start with the shape of the problem each tool solves, because the names alone won't tell you. A security freeze blocks the door outright — nobody, including you, can open a new account in your name until you personally unlock it. A fraud alert doesn't block anything; it just forces any lender who gets an application in your name to verify your identity a little harder before approving it. A credit lock sounds like a freeze but is a different animal entirely — a convenience feature built by each bureau into its own app, meant to toggle on and off faster than a freeze, but running on that bureau's terms instead of federal law.

None of the three require you to pick just one. A freeze is the strongest default for almost everyone, a fraud alert is a reasonable lighter-touch option for someone who doesn't want to manage a freeze, and a lock is mostly a matter of convenience layered on top of whichever of the other two you're already using.

The security freeze: blocking the door entirely

A security freeze does one specific thing: it stops any new lender, landlord, or utility from pulling your credit report at all. Since a report is exactly what an identity thief needs a business to check before approving a new account in your name, blocking that check outright is the closest thing to a guarantee that no new account gets opened without your explicit involvement — even if a thief has your full Social Security number.

A few things make a freeze the strongest option in the lineup. It's free, by federal law, at each of the three national credit bureaus. It doesn't touch your credit score, and it doesn't affect any account you already have — your existing cards and loans keep working exactly as before. And when you genuinely need new credit checked, you can lift it temporarily with the PIN you were given when you placed it, for a specific window of time or a specific requester, then let it snap back afterward. The one real friction point: there's no single switch that covers all three bureaus at once, so placing (and later lifting) a freeze means doing it separately, three times, and keeping track of three PINs somewhere more durable than memory.

The fraud alert: a lighter touch

A fraud alert trades strength for convenience. Instead of blocking a report from being pulled, it attaches a flag telling any lender who does pull it to take an extra identity-verification step — a callback, a follow-up question — before approving anything in your name. It's still free, and it has one genuine advantage over a freeze: place it at one bureau and, by law, that bureau is required to pass it along to the other two, so there's no three-times-over chore.

A standard fraud alert lasts one year and is renewable indefinitely. If you're a confirmed victim of identity theft — meaning you have an identity theft report to back it up — you can instead place an extended alert that lasts far longer, closer to seven years, with some added protections around removing you from prescreened credit-offer lists. A fraud alert is a sensible choice for someone who wants meaningfully more scrutiny on new applications without managing PINs at three separate bureaus — a spouse or an aging parent who's unlikely to keep track of them is a common real-world fit. Just go in clear-eyed that it's a speed bump, not a locked door.

Freeze, alert, or lock — side by side

The lock's asterisk matters more than it looks. Because it's a company's product rather than a statutory right, its terms — what it actually guarantees, whether it can change, what happens if the app has an outage right when you need it toggled — are set by that company, not by law. It can be a genuinely handy convenience layer once you already understand what a freeze does. It isn't a substitute for one.

What none of these actually stop

It's worth being honest about the edges, because a false sense of total coverage is its own risk. None of these three tools touch:

• Existing account misuse. A freeze stops new accounts, full stop — it does nothing for a card or account you already have. That's still on you to watch via statements and transaction alerts.
• Tax refund fraud. Someone filing a return in your name before you do runs through a completely separate system, with its own identity-protection PIN you have to request directly from the relevant tax agency.
• Medical identity theft. Someone using your information to receive care or file a claim shows up on insurance statements, not a credit report — skim your explanation-of-benefits notices, not just your credit file.
• Synthetic identity fraud. A real Social Security number stitched to a fake name and birthdate can build an entirely new credit file that a freeze on your existing file never touches, because it isn't technically your file being checked.

The post-breach playbook

1. Read the notification closely before reacting. What was actually exposed — a Social Security number, a card number, or just a login and password — changes what the right next step is, so don't skip straight to panic.
2. If a Social Security number was involved, freeze at all three bureaus. This is the single highest-leverage move on the list, and it's free.
3. If you have a confirmed identity theft report, add the extended fraud alert too. It layers a longer-lasting flag on top of the freeze at no added cost.
4. If a password leaked, change it and turn on two-factor authentication — on that account and anywhere else you reused the same password, which is usually more places than you remember.
5. Watch statements and benefit notices for the next few billing cycles, since a freeze protects against new accounts, not existing ones.
6. File your PINs somewhere durable, not just memory — a locked note, a password manager, a written copy in a safe place — because you'll need all three the next time you actually apply for credit.

A credit freeze answers a fundamentally different question than "what happened to my identity?" It answers "who's allowed to even look?" — and it answers that question before anyone ever gets far enough to try.

Mistakes that undo the protection

• Locking instead of freezing, and assuming they're the same thing. A lock is convenient; a freeze is the one with force of law behind it.
• Freezing at one bureau and assuming it covers all three. That auto-forwarding only happens with a fraud alert — a freeze has to be placed at each bureau individually.
• Forgetting to lift the freeze ahead of a real application, which can turn a routine approval into a frustrating delay right when you need it fastest.
• Confusing a freeze with credit monitoring. Monitoring tells you after something happened. A freeze is meant to stop it from happening in the first place.
• Losing the PIN and having to go through a slower identity re-verification process just to unlock your own file.