Monitoring tells you it happened. A freeze stops it happening.

The identity protection industry sells watching. A service checks your file, notices when something new appears, and sends an alert. By the time that alert arrives, an account has been opened in your name and the work of closing it belongs to you.

There is a stronger option and it is free. A security freeze locks your credit file against the checks a lender runs before opening a new account. Where it applies, a new account cannot be opened in your name because the check that would approve it cannot be run. It is not a warning system. It is a locked door, and Part 3 covers the doors it is not on.

Federal law made freezes free for everyone across all three nationwide credit bureaus, set the deadlines the bureaus must meet, and requires them to lift a freeze quickly when you want to borrow. Some states add protections on top of that, but the free freeze itself is federal and works the same everywhere.

This guide covers four separate locks, on four separate systems, none of which protects the others. All four are free, and all four can be done in one afternoon.

This guide is educational information. It is not legal, tax or financial advice.

A security freeze prohibits a credit bureau from releasing your credit report to anyone who asks. Federal law spells out the terms, and knowing them is useful because the process is designed to feel more discouraging than it is.

• It is free, to place and to remove. There is no charge at any point.
• A bureau must place it within one business day of a request made by toll-free telephone or secure electronic means, or within three business days by mail.
• A bureau must remove it within one hour of a phone or electronic request, or three business days by mail.
• Under current law it stays in place until you remove it. It does not lapse, expire or need renewing.

The one-hour removal is the answer to the objection people raise about freezes, which is that they will get in the way of borrowing. Federal law provides specifically for a temporary removal for a period you specify, so a freeze can be lifted for a window and left to close again on its own, and the law puts the bureau on the clock.

It has to be done at each of the three nationwide bureaus separately. One request does not cover the others, and a lender pulling from the one you missed sees an unfrozen file.

Who can still see a frozen file

A freeze is not a wall around your record, and federal law says so explicitly. It does not apply to a report made for a company you already owe or already hold an account with, or its agent or assignee, when they are reviewing that account or collecting on it, which expressly includes account monitoring, credit line increases and upgrades. It also does not apply to a government agency, law enforcement, a court or a collection agency acting under a court order, warrant or subpoena, to a child support agency, to a federal or state agency investigating fraud or collecting unpaid taxes or court orders, to a monitoring service you subscribed to, or to giving you your own report.

Read the first of those again, because it is the one that matters day to day. Everyone you already do business with can still look. The freeze is aimed at strangers opening something new.

For someone who cannot request one themselves

Federal law creates a category called a protected consumer: anyone under 16, and any incapacitated person or protected person for whom a guardian or conservator has been appointed. A representative with proof of authority can place a freeze for them. That second group matters for a family already managing someone's affairs, and it is rarely mentioned.

A freeze is the strongest single step available, and it is also narrower than it sounds. It stops a new credit account being opened in your name. It does nothing about any of the following.

Accounts that already exist. A frozen file does not stop someone using a card you already hold, draining an account you already own, or adding themselves to one. That is a different kind of theft with a different defense, which is watching statements and using the alerts your own bank offers.

A fraudulent tax return. Filing a return in your name requires your Social Security number and nothing from a credit bureau. A freeze is irrelevant to it, and the refund is gone before the real return is filed. Part 4 covers the lock for this one.

Your Social Security record. Someone creating an online account in your name at the Social Security Administration, or redirecting a payment, is not touching your credit file either.

The other bureaus. The free federal freeze runs to the three nationwide credit bureaus. Federal law separately recognizes nationwide specialty agencies, which hold tenant and rental history, check writing and deposit account history, medical information, employment history and insurance claims. Those files are used to approve a lease or open a bank account, and a freeze at the big three does not touch them.

An Identity Protection PIN is a six-digit number known only to you and the tax authority. Once you have one, a return filed under your Social Security number without it is rejected. A thief with your name, number and date of birth cannot file.

Four points make this more useful than it first appears:

• It is not restricted to victims. Anyone with a Social Security number or taxpayer identification number who can verify their identity may opt in, as a precaution.
• It is available even to people who are not required to file a return at all, which is a large share of retired households and exactly the group a thief prefers, because nobody is expecting a return in that name.
• Parents and legal guardians can request one for a dependent.
• It is valid for one calendar year, and a new one is generated for your account each year.

The Social Security Administration and the tax authority each allow one online account per person, and both require an identity check before granting it. That check is real, and it is not always enough. Where the space has never been claimed, someone holding enough of your details has an opening that simply does not exist once you have taken it yourself.

Creating them yourself, even if you never intend to log in again, narrows that opening considerably. It also means that when something does go wrong, you already have the access needed to see what happened rather than starting a verification process during a crisis.

The same reasoning applies to the accounts a household already has with banks, brokerages and pension providers. Any of them without online access set up is a space someone else can claim using details that are often easy to find.

Stop the prescreened offers

Credit bureaus sell lists of names to lenders and insurers for offers you did not ask for. Those preapproved envelopes are a small but real risk, because one intercepted from a mailbox is an application with your details already on it. Federal law gives you the right to be excluded from those lists. Opting out through the bureaus' shared notification system lasts five years, and a signed election form runs until you cancel it.

Read the reports

Federal law entitles you to a free copy of your credit report from each nationwide bureau once every twelve months, through a single centralized source rather than from the bureaus individually. Reading them is how you find the account you did not open.

The alert, and how it differs from a freeze

A fraud alert is weaker than a freeze but easier. On request, a bureau must place one for at least a year and must pass it to the other two, so one call covers all three. It does not block anything. What it does is put a condition on the lender: a business seeing the alert may not extend credit without taking reasonable steps to form a belief that the person applying really is you. The duty falls on them, and the consequence of ignoring it falls on them too.

Anyone who has actually been a victim and files an identity theft report can get an extended alert instead, which lasts seven years and additionally keeps them off prescreened lists for five.

Prevention is most of this guide. The rest of it matters to anyone who is already past that point, and the sequence is worth knowing before it is needed, because it is not obvious.

The document that does the work is an identity theft report. It is what turns a complaint into a set of enforceable rights, and it is the thing to obtain first rather than last.

With one in hand, federal law gives you two rights the bureaus cannot refuse in the ordinary case:

• Blocking. A credit bureau must block the reporting of information in your file that resulted from the theft, within four business days of receiving proof of your identity, a copy of the report, your identification of the specific information, and your statement that it did not come from any transaction of yours. It must then tell whoever furnished that information that a block has been requested.
• The extended alert. Seven years rather than one, plus five years off the prescreened marketing lists.

A bureau can decline or undo a block in defined circumstances, principally where it was requested in error or on a material misrepresentation, so this is a right with conditions rather than a switch. It is still far stronger than asking a company politely to remove something.

None of this costs anything. Most of it is done once and stays done.

• Place a security freeze at each of the three nationwide credit bureaus, separately. It is free and it does not expire.
• Note how to lift each one, and that the law requires removal within an hour of a phone or electronic request.
• If you manage affairs for someone under a guardianship or conservatorship, place a freeze for them as a protected consumer.
• Request an Identity Protection PIN from the tax authority, whether or not you file a return.
• Put a calendar reminder to retrieve the new PIN each year, because no reminder is sent.
• Create your online account with the Social Security Administration and with the tax authority, even if you never use them. An unclaimed account is the opening.
• Turn on the strongest second step offered on every financial account, preferring an app or a key over a text message.
• Opt out of prescreened credit and insurance offers.
• Request your free credit reports and read them, looking for accounts and addresses you do not recognize.
• Remember that a freeze at the three nationwide bureaus does not reach the specialty agencies holding tenant, check writing, medical, employment and insurance records.
• If something has already happened, obtain an identity theft report first. The blocking right and the seven year alert both depend on having one.
• Set up transaction alerts with your own bank. That is the only one of these that covers accounts you already hold.

A security freeze is free, placed within one business day by phone or secure electronic request and three business days by mail
15 U.S.C. 1681c-1(i)(2). Retrieved September 5, 2026.

Removal is free and must happen within one hour of a phone or electronic request; a freeze remains until the consumer removes it
15 U.S.C. 1681c-1(i)(4). Retrieved September 5, 2026.

A third party may treat an application as incomplete where a freeze blocks access
15 U.S.C. 1681c-1(i)(4)(D). Retrieved September 5, 2026.

Protected consumers: anyone under 16, and incapacitated or protected persons with a guardian or conservator
15 U.S.C. 1681c-1(j). Retrieved September 5, 2026.

The exceptions: a freeze does not apply to existing creditors reviewing an account, courts and agencies acting under an order, child support agencies, fraud and tax investigations, subscribed monitoring services, or your own report
15 U.S.C. 1681c-1(i)(4). Retrieved September 5, 2026.

Temporary removal for a period the consumer specifies
15 U.S.C. 1681c-1(i)(3)(E). Retrieved September 5, 2026.

Nationwide agencies and nationwide specialty agencies are separately defined
15 U.S.C. 1681a(p) and 1681a(x). Retrieved September 5, 2026.

An initial fraud alert lasts at least one year and must be referred to the other nationwide agencies
15 U.S.C. 1681c-1(a)(1). Retrieved September 5, 2026.

An extended alert lasts seven years and excludes the consumer from prescreened lists for five
15 U.S.C. 1681c-1(b)(1). Retrieved September 5, 2026.

A bureau must block information resulting from identity theft within four business days of receiving an identity theft report and the required statements
15 U.S.C. 1681c-2(a). Retrieved September 5, 2026.

When a bureau may decline or rescind a block
15 U.S.C. 1681c-2(c). Retrieved September 5, 2026.

One free credit report from each nationwide agency every twelve months, through the centralized source
15 U.S.C. 1681j(a). Retrieved September 5, 2026.

The right to be excluded from prescreened offer lists, for five years or permanently
15 U.S.C. 1681b(e). Retrieved September 5, 2026.

The Identity Protection PIN: six digits, valid one calendar year, open to anyone who can verify their identity including non-filers, and requestable by parents and guardians for dependents
Internal Revenue Service, Get an Identity Protection PIN. Retrieved September 5, 2026.