This one is US-centric by necessity, because the credit freeze is a creature of US law and the US credit bureau system. If you are elsewhere, the last section covers what your equivalents look like. If you have a US credit file, this is one of the highest-value security tasks you can do this week, and unlike most advice in this space, it involves no new apps and no subscription.
Why New-Account Fraud Works
When someone applies for credit in your name, the lender pulls your credit report from one of three private companies: Equifax, Experian, or TransUnion. If the report comes back and looks good, the account opens. The lender never meets the applicant. Identity, in this system, is a Social Security number, a date of birth, and an address history, exactly the data that has been spilled repeatedly by data brokers and breaches. Equifax alone exposed the core identity data of roughly 147 million people in 2017.
The uncomfortable premise is that your "identifying" data should be assumed public. Once you accept that, the defense becomes obvious: stop making the credit report available. No report, no new account. That is all a freeze is.
Freeze, Lock, and Fraud Alert Are Not the Same Thing
Three similarly named products do different things, and the bureaus have an incentive to steer you toward the ones they monetize:
| Tool | What it does | Legal basis | Cost |
|---|---|---|---|
| Security freeze | Bureau may not release your report for new-credit checks until you lift it | Federal statute; bureaus must comply | Free, by law |
| Credit lock | Similar blocking, delivered as the bureau's own app product | Private contract; terms set by the bureau | Free or bundled with paid monitoring |
| Fraud alert | Report stays available; lenders are asked to verify identity before opening accounts | Federal statute; one year, renewable | Free |
The freeze is the strong one. Locks mostly do the same thing with a nicer interface, but your protection rides on contract terms the bureau writes and can change, and lock products have historically been the hook for upselling monitoring subscriptions. A fraud alert is much weaker: it depends on the lender choosing to verify, and it expires. Choose the statutory tool.
The Law That Made It Free
Freezes used to cost money in most states, typically a fee per bureau to place and another to lift, which suppressed adoption for years. After the Equifax breach, Congress acted: the Economic Growth, Regulatory Relief, and Consumer Protection Act made placing and lifting freezes free nationwide as of September 21, 2018. The same law lets parents freeze credit files for children under 16, which matters because a child's clean file can be exploited for years before anyone thinks to look.
Two persistent myths keep people from acting. A freeze does not affect your credit score, and it does not touch your existing accounts; your cards keep working and your current lenders can still see your file. The only thing that changes is that a new creditor cannot pull your report until you temporarily lift the freeze, which the bureaus must do quickly on request and which you can schedule for a window while you shop for a mortgage or a car loan.
Create an account and place a freeze at each of Equifax, Experian, and TransUnion, individually; a freeze at one does nothing at the other two. Store the credentials and any PINs in your password manager. When you apply for credit, ask the lender which bureau they pull from and lift only that one, only for the days you need. That is the entire ongoing cost of the strongest identity protection available.
What a Freeze Does Not Cover
A freeze blocks new credit accounts. Identity theft has other doors, and it is worth knowing which ones remain open:
- Your existing accounts. Account takeover through stolen passwords or SIM swapping is unaffected. Strong unique passwords and non-SMS two-factor authentication remain your defense there.
- Tax refund fraud. Someone filing a return in your name never touches your credit report. The IRS offers an Identity Protection PIN that blocks it; opt in.
- Phone and utility accounts. Many carriers and utilities check NCTUE, a specialty bureau most people have never heard of. It accepts freeze requests separately.
- Bank account fraud. Checking account openings often run through ChexSystems, another specialty bureau with its own freeze process.
- Government benefits fraud. Unemployment and benefits claims in your name use different verification systems entirely.
For most people, freezing the big three is the right first move, and adding NCTUE and ChexSystems freezes is a reasonable second pass if you want the doors closed properly. There is also a fourth general bureau, Innovis, that accepts freezes and takes minutes to cover.
Outside the United States
The freeze mechanism follows the credit bureau model, so its availability tracks how your country handles credit reporting. Quebec wrote a freeze right into law in 2023, and residents can freeze files with the bureaus operating there. The UK has no freeze as such; the closest tool is Cifas protective registration, which flags your identity for extra verification. Much of the EU relies on national credit registers with stricter access rules, where the new-account fraud problem is structurally smaller but not absent. The general principle transfers everywhere: find out who lenders in your country query about you, and ask what controls that registry offers you.
The freeze also illustrates a pattern worth internalizing. You cannot prevent your identity data from leaking; that has already happened, through breaches you were never told about and credential dumps that circulate for years. What you can do is make the leaked data useless at the point where it gets monetized. Controls at the point of use beat secrecy that is already lost, and the freeze is the cleanest example of that principle in everyday life.