Breaches & Passwords
How to Freeze Your Credit at All Three Bureaus
The short version
A credit freeze blocks lenders from pulling your credit report, which stops almost anyone from opening a new account in your name. It is free at every bureau under federal law, it does not touch your credit score, and you have to do it three times: once each at Equifax, Experian and TransUnion. Placed online or by phone, the bureau must apply it within one business day, and lift it within one hour when you need credit again.
What a credit freeze actually does
A credit freeze, also called a security freeze, tells a credit bureau not to release your credit report to new creditors. When a lender cannot see your file, it will almost never approve an application. That single restriction is what makes a freeze the strongest free defense against someone opening accounts in your name.
It is a restriction on access, not a deletion. Everything already in your file stays exactly where it is: your accounts, balances, payment history, and the addresses the bureau has on record. You are simply revoking the default permission that lets any lender who asks pull the whole thing.
Why a freeze is the strongest free move after a breach
Leaked data becomes profitable when someone converts it into credit. A name, date of birth, address and Social Security number is enough to apply for a card or a loan, and the victim usually finds out months later through a collections letter. A freeze cuts that path off before it starts.
The scale is not small. The Federal Trade Commission reported that consumers lost more than $12.5 billion to fraud in 2024, a 25 percent jump on the year before. If your information has already surfaced somewhere, the honest order of operations is to freeze first and investigate second, because the freeze takes ten minutes and the investigation does not.
If you are still working out what leaked, our guide on what to do right after a data breach covers the wider checklist, and the early warning signs of identity theft are worth knowing before you need them.
What you need before you start
Each bureau has to confirm you are who you say you are before it will touch your file, so gather the details first. Having everything to hand turns three separate sessions into one twenty-minute job rather than three interrupted ones.
- Your full legal name, date of birth and Social Security number.
- Your current address, plus any address you have lived at in the past two years.
- A working email address and phone number for identity verification.
- Somewhere safe to store the PIN or account credentials each bureau gives you back.
That last point matters more than it sounds. The PIN or login is what you use to thaw the freeze later. Losing it does not trap you, but it does turn a one-hour online thaw into an identity-verification process at the worst possible moment, usually while a mortgage officer waits.
How to freeze your credit at all three bureaus
The process is the same shape at each bureau: create or log into an account, verify your identity, then request the freeze. Do all three in one sitting. A freeze at two bureaus is not two thirds of the protection, because a lender only needs one report to approve an application.
- Equifax - equifax.com/personal/credit-report-services/credit-freeze
- Experian - experian.com/freeze/center.html
- TransUnion - transunion.com/credit-freeze
You can also freeze by phone or by post if you would rather not create online accounts. Phone and mail numbers change, so take them from the bureaus' own pages above or from the FTC's contact list at IdentityTheft.gov/creditbureaucontacts rather than from a search result, which is a common route into a fake freeze site.
How long a freeze takes to place and lift
These deadlines are set by federal law, not by the bureaus' service levels, and they are the reason a freeze is practical rather than merely theoretical. The one-hour thaw is what makes it possible to keep a freeze on permanently and still apply for credit the same afternoon.
| Request | Online or by phone | By mail |
|---|---|---|
| Place a freeze | Within 1 business day | Within 3 business days |
| Lift a freeze | Within 1 hour | Within 3 business days |
| Cost | Free | Free |
Source: Consumer Financial Protection Bureau, "Free credit freezes are here" (consumerfinance.gov).
Freezes became free nationwide on September 21, 2018, under the Economic Growth, Regulatory Relief, and Consumer Protection Act. Before that, several states let bureaus charge a fee each time you froze or thawed. Anyone quoting you a price today is either out of date or running a scam.
Freeze, fraud alert, or credit lock?
These three get used interchangeably and they are not the same thing. A freeze blocks access. A fraud alert only asks lenders to verify your identity first, which they may do well or badly. A credit lock is a commercial product that behaves like a freeze but is governed by a contract rather than by statute.
| Credit freeze | Initial fraud alert | Extended fraud alert | Credit lock | |
|---|---|---|---|---|
| Cost | Free | Free | Free | Varies; often inside a paid plan |
| Lasts | Until you lift it | 1 year | 7 years | While you keep the product |
| Bureaus to contact | All 3, separately | 1 (it tells the others) | 1 (it tells the others) | Each bureau separately |
| Blocks new credit pulls | Yes | No, verification only | No, verification only | Yes, per the product terms |
Sources: Consumer Financial Protection Bureau and the credit bureaus' published fraud alert terms. An extended alert requires an identity theft report from IdentityTheft.gov or a police report.
For most people the free freeze is the right default, with a fraud alert as a supplement rather than a substitute. The one genuine advantage of an alert is that it propagates: place it at any one bureau and that bureau must notify the other two.
What a credit freeze does not stop
A freeze is narrow by design, and knowing its edges keeps you from a false sense of safety. It governs one thing only: who can pull your credit report. Anything that does not involve a credit check runs straight past it.
- Fraud on accounts you already have. A stolen card number still works. Watch statements, and keep unique passwords and 2FA on the accounts behind them.
- Tax and medical identity theft. Neither a tax filing nor a hospital admission triggers a credit pull.
- Prescreened credit offers. Those come from marketing lists, not from a report request. Opting out is a separate process at optoutprescreen.com.
- Data brokers publishing your details. A freeze does nothing to a people-search listing. That is its own removal job.
It also does not stop you from being approved for things you actually want, once you thaw. And it has no effect on your credit score, because a score is calculated from the file's contents and a freeze changes none of them.
How to thaw your credit when you need it
Lifting a freeze is the same process in reverse, and by law it happens within an hour when you ask online or by phone. You have two options: a temporary thaw for a set date range, or a permanent removal. For a single application, always choose the temporary thaw.
Ask the lender which bureau it pulls before you thaw anything. Many pull only one, so you may only need to open one file rather than all three. If the lender does not know or uses more than one, thaw all three for a short window and let it close on its own.
Plan a couple of days of slack for anything that involves an instant-approval decision at a counter, such as a store card or a phone contract. The legal deadline is one hour, but a thaw that is still propagating through a lender's systems can still read as a decline.
The bureaus most people forget
Equifax, Experian and TransUnion are the three that matter most, but they are not the only files on you. Several smaller reporting agencies feed decisions about phone contracts, utilities, bank accounts and insurance, and each of them accepts a freeze or opt-out request of its own.
Innovis is the fourth national credit bureau. NCTUE holds telecom and utility account history. ChexSystems is what a bank checks before opening a checking account. LexisNexis and Verisk sell risk data to insurers. None of them are covered by a freeze at the big three, and each has to be handled separately.
Our opt-out guides cover the process for the credit and risk bureaus, including Innovis, LexisNexis and Experian's marketing lists, which are separate from the credit freeze itself.
How to freeze a child's credit
Children are a favorite target because nobody checks a seven-year-old's credit file for a decade. The same 2018 law gives parents, legal guardians and authorized child welfare representatives the right to freeze the file of a child under 16, free, at all three bureaus.
If the bureaus have no file on the child, they create one solely so it can be frozen, and that record cannot be used for credit. Expect to submit the request by mail with proof of your authority, such as the child's birth certificate, along with identification for yourself. It is slower than freezing your own file, and it is worth the afternoon.
Find out what is already exposed
A freeze protects your credit file. It does not tell you what leaked. Run a free exposure scan to see which breaches and data brokers are tied to you, with no account and nothing stored.
Frequently asked questions
Is a credit freeze free?
Yes. Since September 21, 2018, federal law has required the nationwide credit bureaus to place and lift security freezes at no charge, in every state. If a site asks you to pay to freeze your credit, you are on the wrong site.
Does freezing my credit hurt my credit score?
No. A freeze restricts who can pull your credit report. It does not change the contents of the report, and your score is calculated from those contents. Your existing accounts keep reporting normally while the freeze is on.
How long does it take to freeze and unfreeze my credit?
If you ask online or by phone, the bureau must place the freeze within one business day and lift it within one hour. Requests sent by mail take up to three business days to place or lift, according to the Consumer Financial Protection Bureau.
Do I have to freeze my credit at all three bureaus separately?
Yes. Unlike a fraud alert, a freeze does not propagate. Equifax, Experian and TransUnion each hold their own file on you, and a lender can pull any one of them, so a freeze at only one or two bureaus leaves an open door.
Can I still use my credit cards while my credit is frozen?
Yes. A freeze only blocks new pulls of your credit report by companies you do not already do business with. Existing cards, loans, and bank accounts work exactly as before, and you can still get your own free reports from AnnualCreditReport.com.
What is the difference between a credit freeze and a credit lock?
A freeze is a legal right that is free at every bureau. A lock is a product the bureaus sell, sometimes bundled into a paid monthly subscription, governed by that product's terms rather than by statute. For most people the free freeze is the better default.
Can I freeze my child's credit?
Yes. Federal law lets a parent, legal guardian or authorized child welfare representative freeze the file of a child under 16 for free. If no file exists, the bureau creates one purely so it can be frozen, and that record cannot be used for credit.
Does a credit freeze stop all identity theft?
No. It blocks most new credit accounts opened in your name, which is the most common and most damaging use of leaked data. It does not stop fraud on accounts you already have, tax refund fraud, medical identity theft, or misuse of your data by companies that do not pull credit reports.
Sources: Consumer Financial Protection Bureau, "Free credit freezes are here" and "New protections available for minors under 16"; Federal Trade Commission data on 2024 reported fraud losses; USA.gov credit freeze guidance; the freeze pages published by Equifax, Experian and TransUnion. More on the topic in our breaches and passwords section.