Spend five minutes on a credit bureau’s website looking for the freeze page and you will probably be steered, somewhere along the way, toward a “lock” instead. Same padlock icon. Similar promises. Often an app with a friendly toggle, sometimes bundled with monitoring you pay for monthly. It is easy to come away believing a lock is the freeze, just with better software.
It isn’t. The two tools do similar work day to day, but they rest on completely different foundations — and foundations are what you stand on when something breaks. Here is the difference, plus where fraud alerts fit, what none of these tools can do, and the legal rights that take over if you’re already an identity theft victim.
The short version
- A security freeze is a creature of federal law — free at all three bureaus since 2018, free to place and free to lift, and it blocks most new-account credit checks.
- A credit lock is a bureau product. Your protection is whatever the contract says, and it’s sometimes bundled with paid monitoring.
- Fraud alerts are the lighter tool: one year and renewable, or a seven-year extended alert for identity theft victims with a report.
- If fraud has already happened, the FCRA’s block — generally within four business days of a proper request with an identity theft report — is the remedy that cleans the file.
The security freeze: a legal right, not a product
A security freeze (often just “credit freeze”) restricts who can pull your credit file. Because nearly every new credit account starts with a credit check, a freeze stops most new-account fraud cold: the thief applies, the lender tries to pull your frozen report, and the application dies right there.
What makes the freeze special is its legal status. Since 2018, federal law has required all three nationwide bureaus — Equifax, Experian, and TransUnion — to offer security freezes free of charge: free to place, free to lift temporarily when you apply for credit, free to remove. The bureaus don’t get to decide whether you deserve one, charge for the privilege, or change the terms when it suits them. Your rights come from the statute, not from a subscription.
That statutory footing matters precisely when things go wrong. A freeze mishandled is a legal obligation mishandled — and the conversation that follows is about what the law requires, not about what a terms-of-service document permits.
The credit lock: a contract dressed as a feature
A credit “lock” does roughly the same daily job: it restricts access to your file, usually through an app, often with an instant on/off toggle. The convenience is real. The difference is underneath. A lock is a product the bureau offers on its own terms. Your relationship is contractual — governed by a user agreement the bureau wrote and can rewrite — rather than statutory. Some locks are free; some are part of paid monitoring bundles; what happens if the lock fails is whatever the agreement says, and those agreements are not written to favor you.
We are not telling you a lock is useless. For some people the app convenience means the protection actually stays on, which counts for something. But understand what you are choosing: a freeze gives you a federal right that must be free; a lock gives you a feature. If you are picking one, pick the freeze. If you already pay for monitoring that includes a lock, nothing stops you from placing the free statutory freeze too — the right doesn’t expire because you also bought a product.
Fraud alerts: the lighter tool
A fraud alert doesn’t block access to your file. It flags it: a lender who pulls your report is told to take extra steps to verify that the applicant is really you before opening credit. Your file stays reachable — useful if you’re actively shopping for credit and don’t want to manage thaws — but the protection depends on the lender actually doing the extra verification.
There are two versions. The standard alert lasts one year and is renewable, and you only have to contact one bureau — it must tell the other two. Identity theft victims who have an identity theft report can place an extended alert lasting seven years. Alerts are free, and they stack perfectly well with a freeze: the freeze blocks the pull, and the alert warns any lender who reaches your file through one of the freeze’s gaps.
| Security freeze | Credit lock | Fraud alert | |
|---|---|---|---|
| What it rests on | Federal law | The bureau’s contract with you | Federal law |
| Cost | Free by law — place, lift, and remove | Varies; sometimes bundled with paid monitoring | Free |
| What it does | Blocks most new-account credit checks | Restricts access on the product’s terms | Tells lenders to verify identity before opening credit |
| Duration | Until you lift or remove it | While the product is active | 1 year renewable; 7-year extended for victims with a report |
| Where to set it | Each bureau separately | Each bureau’s own product | One bureau notifies the others |
What a freeze does not do
A freeze is the best preventive tool available, but it is not a force field, and knowing its limits keeps you from a false sense of safety.
- It doesn’t protect existing accounts. A freeze blocks new credit checks. A thief who has your card number or bank login doesn’t need a credit pull — watch your statements regardless.
- It doesn’t stop every kind of report pull. Treatment of things like insurance or employment-related checks varies, and your existing creditors can still review your file. The freeze targets new-account credit checks, which is where most of the damage happens — not all access of every kind.
- It doesn’t clean up fraud that already happened. Accounts a thief already opened stay on your report until you remove them through the dispute and block process — the freeze just stops the next one.
- It doesn’t cover what you don’t freeze. Each of the three bureaus must be frozen separately. Freezing one leaves two open doors.
The practical how-to
Setting this up is an afternoon, not a project.
- Freeze at all three bureaus — Equifax, Experian, and TransUnion, each one separately, online or by phone or mail. Save the confirmation and any PIN or credentials each bureau gives you; you’ll need them to lift the freeze later.
- Plan for thaws. When you apply for credit — a car loan, a card, a refinance — ask the lender which bureau it pulls from, then lift the freeze temporarily at that bureau, for a window of time, for free. Build in a little lead time rather than thawing at the dealership counter.
- Add a fraud alert if you’ve had a scare — a breach notice, a phishing incident, a wallet gone missing. One year, renewable, one call.
- Consider freezing family files. Protective freezes are available for minors under 16 — a parent or guardian can place one free at each bureau, a federal right since 2018 — and an older relative who will never apply for new credit is an ideal candidate for a permanent freeze.
- Keep checking your reports. Federal law guarantees free reports through AnnualCreditReport.com. A freeze reduces new fraud; it doesn’t notify you of anything.
If you do only one thing after reading this: place the free security freeze at all three bureaus. It is the single most effective step against new-account fraud, it costs nothing by law, and it is fully reversible whenever you actually need credit pulled.
When prevention is too late: the FCRA block
Everything above is about stopping the next fraud. If a thief has already opened accounts in your name, you need the cleanup tools — and they are stronger than most victims realize. Under the FCRA (§ 605B), when you give a credit bureau a proper request with an identity theft report and identify the information that resulted from the theft, the bureau generally must block that information from your file within four business days. Not investigate for a month first. Block it. The furnisher gets notified and must not keep reporting information it knows came from identity theft.
Four business days is the law’s expectation, and it tells you how seriously Congress took this. When bureaus drag a proper block request out for months, “verify” fraudulent accounts back onto the file, or ignore the identity theft report entirely, that’s not bad customer service — it’s potentially a violation of federal law. The FCRA lets victims recover actual damages and attorney’s fees, which means a lawyer can usually take a solid case without billing you by the hour. This is where we come in: not to place your freeze, which you can do yourself in an afternoon, but to hold a bureau or furnisher accountable when you did everything right and they didn’t. The full sequence — freeze, report, block, dispute, document — is laid out in our identity theft recovery playbook, and our identity theft practice handles the cases where the system fails.
Frequently asked questions
Does a freeze or a lock hurt my credit score?
No. Neither affects your score in any way. They restrict who can pull your file; they don’t change what’s in it. You can freeze today and lift it next month for a mortgage application with no scoring consequence at all.
I already pay for monitoring with a lock. Should I bother with a freeze?
Yes. The freeze is free and rests on federal law rather than a user agreement, so there is no real downside to having both. Monitoring tells you something happened; a freeze makes it far less likely to happen. They’re a smoke detector and a lock — you want the lock either way, and the law says this one costs nothing.
Won’t a freeze make it a hassle to get credit when I need it?
A small one, honestly — and a manageable one. Lifting a freeze is free and can be done for a temporary window at whichever bureau your lender uses. The realistic comparison isn’t “freeze vs. no inconvenience”; it’s ten minutes of thawing before a planned application versus months of cleanup after a fraudulent one.
I froze my credit, but fraudulent accounts are already on my report. Does the freeze remove them?
No — the freeze only prevents new pulls going forward. Existing fraud comes off through the FCRA process: an identity theft report, a proper block request (generally honored within four business days), and written disputes, all documented. If the bureaus won’t comply after you’ve done it correctly, that’s a legal claim, not a customer-service problem.
If you’re a Virginia resident dealing with identity theft — especially if you’ve sent the bureaus a proper identity theft report and the fraudulent accounts still won’t come off — we can help you enforce the rights this article describes. Start with a free case review or call 804.592.0792.
This article is general information, not legal advice. Bureau products and procedures change; the statutory rights described here are the durable part. For advice about your situation, talk to a lawyer.