The envelope looks like junk mail. Thin paper, a return address you don't recognize. Inside is a letter explaining that a company you barely remember got breached, and your name, address, and Social Security number were in the file that walked out the door.
Or maybe it's the other version. You pulled your credit report and there's an auto loan on it. Not yours. Opened four months ago in a state you've never lived in.
Either way, you land at the same fork: credit freeze vs fraud alert. Both are free, both are federal rights, and both are genuinely useful. They just do different jobs, and picking the wrong one either leaves you exposed or quietly wrecks the loan application you're planning for next month. Here's how to tell which lever belongs in your hand right now.
The Short Answer: Which One You Need Right Now
Was your data exposed but nothing has happened yet? Freeze your credit at all three bureaus. If someone has already opened an account in your name, file an identity theft report at IdentityTheft.gov, place an extended fraud alert, and freeze on top of it. Applying for a loan in the next few weeks? Freeze now, and schedule a thaw a few days before you apply.
What a Credit Freeze Actually Does
A credit freeze (sometimes called a security freeze) locks your credit report so a new lender can't pull it. When a thief applies for a card or a loan using your name, the lender's request comes back blocked, and almost every lender treats a blocked report as a stop sign. No report, no approval.
It is free to place, free to lift, and free to remove permanently. Under the Fair Credit Reporting Act, the bureau has one business day to place a freeze you request by phone or online, and three business days if you mail it in. Lifting is faster: one hour for phone and online requests, three business days by mail. Written confirmation follows within five business days, according to the Consumer Financial Protection Bureau.
A freeze stays put until you lift it. There's no expiration date, no renewal reminder, nothing to keep track of. And it does not touch your credit score. The CFPB states that plainly, which is worth knowing because it's the single most common fear people have before placing one. Protecting your file is separate from the moves that lift a score in 60 days.
Now the catch: you have to do it three times. A fraud alert spreads on its own; a freeze does not. You contact Equifax, Experian, and TransUnion separately, and if you skip one, that's the one a lender might pull.
What a freeze will not stop
- Misuse of accounts you already have. If someone gets your existing card number, a freeze does nothing. That's account takeover, a different problem with a different fix.
- Your current creditors. Companies you already owe can still see your file, and so can debt collectors working on their behalf.
- Government agencies acting under legal authority. A court order, a subpoena, or child support enforcement gets through.
- Tax and medical identity theft. A fraudulent tax return or a hospital bill in your name never runs through a credit bureau at all.
- Someone using your name at an arrest or on a job application. Nothing about that runs past a credit bureau either.
One wrinkle in the other direction: a freeze does block employment background check pulls, so lift it before a new employer runs one.
What a Fraud Alert Actually Does (and the Part Almost Nobody Explains)
A fraud alert is a flag on your credit file telling any lender who pulls it to take extra steps before opening credit in your name. You place it with one bureau, and that bureau is required to pass it to the other two. One phone call or one web form covers all three.
Now for the part that gets glossed over everywhere else. Federal law sets two completely different duties for lenders, depending on which type of alert you placed. The distinction lives in FCRA section 605A(h), codified at 15 U.S.C. 1681c-1.
Under an initial fraud alert, nobody has to call you
The statute says a lender must "utilize reasonable policies and procedures to form a reasonable belief that the user knows the identity of the person making the request." If you gave the bureau a phone number, the lender either calls that number or takes other reasonable steps to verify you.
Read that last part again. Other reasonable steps. In practice, lenders often lean on what they already run: a knowledge-based quiz about addresses you lived at years ago, or an automated document upload. A phone call is one option among several, not a requirement, and plenty of lenders never make it.
Under an extended fraud alert, contact is mandatory
Same statute, different subsection, completely different rule. With an extended alert on file, a lender may not open the account, issue an additional card, or raise a credit limit unless it contacts you in person or at the phone number you designated. Not "reasonable steps." Contact.
To get an extended alert you need an identity theft report, which means either a police report or the free federal report you generate at IdentityTheft.gov. That form is the gate. It costs nothing, and it's what gets you the stronger version of nearly every protection in this article.
How Long Does a Fraud Alert Last, and Why the 90-Day Number Won't Die
An initial fraud alert lasts one year, not 90 days. The statute reads "not less than 1 year, beginning on the date of such request" at 15 U.S.C. 1681c-1(a)(1), and the Federal Trade Commission confirms it on its consumer page about credit freezes and fraud alerts.
The 90-day figure was correct once. Section 301 of the Economic Growth, Regulatory Relief, and Consumer Protection Act changed it, effective September 21, 2018, in the same stroke that made credit freezes free nationwide. Plenty of pages written after that date still say 90 days anyway. If one tells you an alert expires in 90 days or that a freeze costs money, it's running on pre-2018 information and the rest of it deserves the same suspicion.
Here's the full set of durations, all from 15 U.S.C. 1681c-1:
- Initial fraud alert: one year, renewable. Entitles you to one free credit report from each bureau.
- Extended fraud alert: seven years. Also removes you from prescreened credit and insurance offer lists for five years, and gets you two free reports from each bureau over the following 12 months.
- Active duty alert: one year, for deployed servicemembers, with prescreened offers suppressed for two years.
- Credit freeze: indefinite. It ends when you end it.
Situation 1: A Breach Notice, but Nothing Has Happened Yet
Freeze all three. This is the clearest case in the whole article.
Your data is out there, no one has used it yet, and the thing you're trying to prevent is exactly the thing a freeze prevents: a stranger opening new credit in your name. The FTC's Consumer Sentinel Network Data Book for 2024, published in March 2025, logged 406,110 reports of fraudulent new credit card accounts against just 52,428 for existing accounts. New-account fraud is the overwhelming majority of the problem, and it's the one a freeze shuts down cold.
Skip the initial fraud alert here. It gives you weaker protection than a freeze while creating similar friction, and the free credit reports that come with it are nice but not decisive. Freeze, then check your reports at AnnualCreditReport.com, which the FTC identifies as the only federally authorized source for those free copies.
Situation 2: A Loan or Account Is Already Open in Your Name
You're past prevention now, so the steps change. Loan-specific identity theft is a real and growing category: the FTC recorded 176,400 loan or lease identity theft reports in 2024, including 95,689 involving a business or personal loan, up 18 percent over the prior year.
- File the identity theft report at IdentityTheft.gov. Everything below depends on it. The FTC report is free, and it's what turns a complaint into a legal document.
- Place an extended fraud alert. Seven years, and lenders must contact you before opening anything new. One bureau passes it to the other two.
- Freeze all three anyway. The alert and the freeze do different work, they don't conflict, and the FTC recommends using both after actual identity theft.
- Demand a block of the fraudulent information. Under FCRA section 605B (15 U.S.C. 1681c-2), once a bureau receives your identity theft report and the required documentation, it has four business days to block that information from your report.
- Ask the lender for the fraudster's actual application. FCRA section 609(e) (15 U.S.C. 1681g) requires a business to give an identity theft victim a free copy of the application and related transaction records within 30 days of a valid request. That paperwork shows what address, phone number, and email the thief used. Save it with your notes, since knowing your rights after a loan denial letter is easier when the timeline is already in front of you.
Situation 3: You're About to Apply for a Loan Yourself
A freeze creates a clean, predictable obstacle. In the seconds after you apply, the lender can't pull your report, so you get denied or stalled, and you fix it by lifting the freeze. Annoying but solvable, usually within the hour.
An initial fraud alert creates a messier obstacle, because it depends on a lender's verification process working. When it doesn't, you're stuck without knowing why. A consumer told the CFPB in May 2025 that they got pre-approved for a personal loan, applied, then heard the application was delayed by a fraud alert. The verification call never came, and they suspected their phone carrier had flagged the lender's number as spam. The fix they were offered was to remove the alert entirely.
That version keeps repeating. More than 15,000 complaints were filed with the CFPB in 2025 under the issue category "problem with fraud alerts or security freezes," and the database is public if you want to read them yourself.
How to thaw a credit freeze before applying for a loan
- Start three to five days out, not the morning of. Online lifts are usually near-instant, but account recovery is not. If you've moved, changed your number, or lost an old PIN, you'll need that buffer.
- Find your logins first. Experian's freeze center works without a PIN and lets you schedule a thaw with a start and end date. Equifax and TransUnion run their own systems, so check each one rather than assuming they match.
- Lift at all three unless you know which bureau the lender uses. The FTC suggests asking the lender and lifting only there. Good advice when you can get an answer. Many online lenders won't tell you, and some pull two.
- Apply inside a tight window. Rate shopping is fine, but keep it compressed, since how lenders pull your credit when you shop rates affects how those inquiries get counted.
- Re-freeze once you're funded. It's free, and the bureau has one business day to put it back in place.
The specialty bureau trap
Freezing Equifax, Experian, and TransUnion doesn't cover every report a lender might pull. The CFPB maintains a public list of consumer reporting companies beyond the big three and notes that short-term lenders, rent-to-own companies, and subprime auto lenders often pull from those specialty companies instead.
In July 2025, a consumer told the CFPB that a freeze sitting on a specialty consumer report, one they'd never thought about, was blocking a vehicle purchase. If you're shopping with a lender that serves borrowers with thin or damaged credit, ask which reports it uses before you assume your three thaws covered it.
Credit Freeze vs Fraud Alert, Side by Side
Here's what each one does to you on application day:
- Credit freeze: you have to thaw first, and nothing moves until you do. Predictable, and usually handled within the hour.
- Initial fraud alert: expect a delay you can't predict and a verification call nobody guarantees.
- Extended fraud alert: expect a real hold, because the lender has to reach you before it opens anything.
All three are free. Any company charging a monthly fee to place a freeze or an alert is billing you for a federal right you already have, which is worth remembering the next time an unsolicited "credit protection" pitch lands in your inbox alongside the warning signs that a loan offer is a scam.
If You Only Do One Thing Today
The worst outcome of acting today is a slightly more annoying loan application next month. The worst outcome of waiting is a loan you never applied for showing up on a report you'll spend a year cleaning.
Frequently Asked Questions
Does a credit freeze hurt your credit score?
No. The CFPB states directly that security freezes do not impact credit scores. A freeze controls who can pull your report; it doesn't change your payment history, balances, or credit age. Lifting and re-placing one has no score effect either.
How long does an initial fraud alert last?
One year, and you can renew it. Federal law at 15 U.S.C. 1681c-1(a)(1) requires "not less than 1 year." The old 90-day figure changed on September 21, 2018, when the Economic Growth, Regulatory Relief, and Consumer Protection Act took effect. Any source still saying 90 days is outdated.
Is a credit freeze or fraud alert better?
A freeze is stronger for preventing new-account fraud because it blocks lenders from pulling your report at all. An initial fraud alert only requires reasonable verification steps, which lenders can satisfy without ever calling you. If someone has already used your identity, use an extended fraud alert plus a freeze.
Will a lender really call me if I have a fraud alert?
Only if it's an extended alert. Under 15 U.S.C. 1681c-1(h), a lender cannot open an account under an extended alert without contacting you. Under an initial alert, it only needs reasonable procedures to believe it knows who's applying, so a call is optional and often skipped.
How long does it take to lift a credit freeze before applying for a loan?
One hour by phone or online, and up to three business days by mail, under federal law. Online lifts are usually immediate in practice. Start three to five days early anyway, because losing account access or an old PIN is the delay that actually catches people.