There is one free tool that stops most new-account identity theft cold, and the majority of Americans have never used it. A security freeze on your credit reports means that when a thief walks into a dealership or fills out an online card application with your Social Security number, the lender pulls your file, finds it locked, and declines the application. End of story.

The freeze used to cost money in many states, which is part of why it never became a habit. That changed with a 2018 federal law: today, placing, lifting, and removing a freeze is free at all three nationwide bureaus, by law, for everyone. If you are not actively shopping for credit, there is very little reason to leave your file unlocked. Here is how the whole thing works, in the time it takes to drink a cup of coffee.

What a freeze actually does, and doesn’t

A freeze restricts access to your credit report, which is what most lenders check before opening a new account. No report, no new loan, card, or line of credit in your name. That is the protection.

Just as important is what a freeze does not touch. Your existing accounts keep working: your current cards, your mortgage, your autopay. Your credit score is not affected. Your current creditors can still see your file, and so can certain screeners allowed by law. You can still get your own free reports from the three bureaus through AnnualCreditReport.com, freeze or no freeze. The federal government’s plain-language rundown at USA.gov covers the same ground if you want a second reference.

One gap worth knowing: a freeze blocks new credit accounts, not everything a thief can do. It will not stop misuse of cards you already hold, tax-refund fraud, or benefits fraud. It is one strong lock, not a whole security system.

You have to do it three times

The bureaus do not share freeze requests, so a full lockdown means contacting Equifax, Experian, and TransUnion separately. Each has an online freeze page, a phone line, and a mail option. Online or by phone, the bureau must place the freeze within one business day. When you need to open credit later, lifting the freeze online or by phone must happen within an hour, and you can lift it temporarily, for a set window or for a specific creditor, instead of removing it for good.

Set aside 15 minutes, have your Social Security number and address history handy, and create an account at each bureau. Write down or save the PINs and passwords somewhere you will actually find them again. That is the single most common freeze headache: people lock their file, then can’t remember the credentials when they are sitting at the car dealer two years later.

Freeze vs. lock vs. fraud alert

Three similar-sounding tools, three different things. The freeze is the one backed by federal law, free forever, with the legal timing rules above. A credit lock is a bureau’s own product that does something similar through an app; some lock products are free, some are bundled into paid monitoring subscriptions, and the terms are set by contract rather than by statute. You do not need to pay for a lock to get freeze-level protection, because the freeze itself is free.

A fraud alert is lighter-touch: it stays on your file for one year (longer for identity-theft victims and service members), it is free, and it tells lenders to take extra steps to verify your identity before opening an account, rather than blocking access outright. You only need to contact one bureau to place it, and that bureau must tell the other two. The FTC’s comparison of freezes and fraud alerts lays out the differences; the short version is that the freeze is stronger and the alert is more convenient.

Who should freeze, and when to bother thawing

A freeze makes the most sense for anyone who is not planning to apply for credit soon, which describes most people most of the time. It is especially worth it for older adults on fixed incomes, who are heavily targeted for new-account fraud, and for anyone whose information has appeared in a data breach, which by now is nearly everyone. Parents can also freeze a minor child’s file, a step worth taking since children’s clean credit records are attractive to thieves and the fraud can go unnoticed for years.

When you do need credit, ask the lender which bureau it pulls from, then lift the freeze just at that bureau, just for a week or two. It is a small chore, and it is the entire cost of the protection.

If a thief already got through

If you find accounts you never opened, start at IdentityTheft.gov, the FTC’s recovery site. It generates a personal recovery plan, the dispute letters, and the official identity theft report you will need to clear fraudulent accounts, and it will walk you through placing the extended seven-year fraud alert that victims are entitled to. Then freeze all three bureaus, if you hadn’t already. The lock works just as well after a break-in as before one; it is simply cheaper to install it first.

This article was produced with AI assistance and reviewed by a human editor. Figures are linked to their primary sources; where a claim could not be verified from the public record, we say so.