Credit Freeze and Identity Theft: How Freezing a File Blocks New-Account Fraud
A credit freeze restricts access to a consumer's credit file at Equifax, Experian, and TransUnion, so most lenders cannot pull that file to approve a new account. That restriction is what makes a freeze useful against identity theft, since opening a new account usually requires a report check. It does not stop every form of identity theft.
This guide is general educational information for U.S. readers. It is not financial advice and does not describe your individual credit file. Figures such as score ranges and timeline estimates are typical examples, not promises.
Key takeaways
- A credit freeze blocks most lenders and other businesses from pulling a credit file to open a new account in the consumer's name.
- A security freeze is free to place, temporarily lift, or remove under federal law.
- A freeze must be requested separately from each of the three nationwide credit reporting agencies: Equifax, Experian, and TransUnion.
- A freeze does not stop misuse of existing accounts, tax refund fraud, or medical identity theft.
- An initial fraud alert lasts 1 year and an extended fraud alert lasts 7 years under the FCRA.
- FCRA section 605B allows a consumer who files an identity theft report to ask an agency to block information that resulted from the theft.
A credit freeze restricts access to a consumer's credit file at Equifax, Experian, and TransUnion, so most lenders cannot pull that file to approve a new account. That restriction is what makes a freeze relevant to identity theft: a common form of credit-related identity theft is a new account opened in someone else's name. A freeze does not stop every form of identity theft, and it does not erase activity that has already been reported.
How a credit freeze works
A freeze is a setting on a credit file. While it is in place, a credit reporting agency will not release the file to a business that wants to review it in connection with a new credit application. The information inside the file does not change, and the consumer keeps the right to view their own report.
Security freezes are covered by the Fair Credit Reporting Act (FCRA, 15 U.S.C. section 1681), which was enacted in 1970 and amended by the Fair and Accurate Credit Transactions Act in 2003. A security freeze is free to place, temporarily lift, or remove under federal law. Each of the three nationwide credit reporting agencies — Equifax, Experian, and TransUnion — maintains its own file, so a freeze exists agency by agency. A freeze remains in place until it is removed, or lifted temporarily for a defined window or a specific application.
Does a credit freeze prevent identity theft?
It prevents the part of identity theft that depends on a credit report — the part where a lender checks a file before approving a new account. That covers a meaningful share of credit-related fraud, because most lenders will not open a card or loan account without pulling a report first.
Situations a freeze is designed to interrupt include:
- A credit card account opened with a stolen name, date of birth, and Social Security number
- An auto loan, personal loan, or retail financing account opened the same way
- Screening by some service providers that rely on a credit report, such as certain utilities, wireless carriers, and landlords
- An instant-decision or pre-approval process that requires a fresh report pull before an account can be issued
The FTC describes freezes and alerts together, because the two tools are often used at the same time.
What a credit freeze does not stop
A freeze is not a complete barrier, and it is not designed to be. It governs new access to a credit file. It does not govern activity on accounts that already exist, and it does not cover systems that never consult a credit report.
- Charges on cards or credit lines already in the consumer's name, including account takeover through a stolen login
- Tax refund fraud, where a Social Security number is used to file a false return
- Medical identity theft, where treatment or equipment is billed to an existing health plan
- Use of a stolen identity in settings that do not involve a credit report, such as employment documents or a driver's license
- File pulls that the FCRA still permits on a frozen file, such as an existing creditor reviewing an account or a business using the file for a purpose allowed by law
Freeze, fraud alert, and credit lock compared
| Tool | What it does | How long it lasts | Legal basis |
|---|---|---|---|
| Security freeze | Blocks most new-account access to a credit file at one agency | No fixed expiration; remains until removed or temporarily lifted | FCRA security freeze provisions; free to place, lift, or remove under federal law |
| Initial fraud alert | Requires a business to take reasonable steps to verify identity before extending credit | 1 year | FCRA section 605A (15 U.S.C. section 1681c-1) |
| Extended fraud alert | Same verification step, with a longer term; requires an identity theft report | 7 years | FCRA section 605A (15 U.S.C. section 1681c-1) |
| Credit lock | A proprietary product from an individual agency, similar in effect to a freeze | Set by the agency's terms | Not a right created by federal law; governed by the agency's product terms |
Fraud alerts are set out in FCRA section 605A, which is codified at 15 U.S.C. section 1681c-1. A fraud alert does not block access the way a freeze does; it inserts a verification step that a creditor is expected to perform before opening credit. A credit lock is offered on an individual agency's terms, while a security freeze is a right established in federal law. The mechanics are covered in more detail on the credit freeze page.
Freeze, dispute, and block: three different mechanisms
These three processes are often described with the same words, but they act at different points in time. A freeze limits future access to a file. A dispute asks an agency to review the accuracy of an item that already appears. A block under FCRA section 605B (15 U.S.C. section 1681c-2) asks an agency to stop reporting information that resulted from identity theft, and it is available to a consumer who has filed an identity theft report.
The dispute process runs on its own clock. Under the FCRA, a credit reporting agency generally must investigate a dispute within 30 days; the period can extend to 45 days if the consumer provides additional information during the initial 30-day period.
Timelines that a freeze does not change
How long information stays on a report is a separate question from who can see the report. Most negative information, including late payments, stays on a credit report for 7 years. A Chapter 7 bankruptcy stays on a credit report for 10 years, and a Chapter 13 bankruptcy stays for 7 years. Hard inquiries typically remain for 2 years. A freeze alters none of those periods, because it changes access to a file rather than the contents of the file.
Reporting identity theft and using a freeze alongside it
Identity theft can be reported at IdentityTheft.gov, and tax-related identity theft can be reported to the IRS using Form 14039. The FTC explains what the reporting process covers and what an identity theft report contains. That report matters for a freeze-adjacent reason: an extended fraud alert and a section 605B block both depend on having one.
A freeze does not prevent a consumer from requesting their own report or from filing a dispute. Under the FCRA, consumers have the right to a free credit report from each nationwide agency every 12 months, and the three agencies currently provide free reports weekly through AnnualCreditReport.com. How to read those reports is covered on the credit reports page.
How a freeze relates to credit scores
A freeze is an access setting rather than a data item, so it does not appear as a factor in a scoring model. Most credit scores, including FICO and VantageScore, use a range of 300 to 850. FICO's published factor weights are payment history at about 35%, amounts owed at about 30%, length of credit history at about 15%, new credit at about 10%, and credit mix at about 10%. VantageScore uses its own weighting and does not publish fixed percentages.
Because a frozen file blocks most new-account pulls, a lender that cannot see the file will generally decline or hold an application rather than approve it. That is the intended trade-off: a consumer's own new application needs the freeze lifted first, which is why agencies provide a way to lift and re-place it. The guide to how credit scores are calculated and the FICO versus VantageScore comparison explain how the factors behind a score are assembled.
Pairing a freeze with monitoring
A freeze and a monitoring service cover different stages of the same problem. A freeze limits who can create new credit activity in the first place. Monitoring observes what has already been reported, which is how activity on existing accounts, address changes, or new inquiries becomes visible. Neither one detects tax refund fraud or medical identity theft, because neither relies on a credit file.
Related pages on this site include credit monitoring, credit checks, credit profile, identity theft, and credit locks.
This page is for education only and is not financial advice.
Compare three-bureau credit scores and reports from a single place. Educational links, disclosed below.
Three Bureau Credit Scores and ReportsCreditMonitored.com may earn a commission from partner links at no additional cost to you.
Frequently asked questions
Does a credit freeze prevent identity theft?
It prevents the part of identity theft that requires a lender to check a credit report before approving a new account, which covers most new cards and loans opened in someone else's name. It does not prevent charges on accounts that already exist, tax refund fraud, medical identity theft, or identity use in settings that never involve a credit report.
Is a credit freeze the same as a fraud alert?
No. A freeze blocks most new-account access to a credit file, is free to place, lift, or remove under federal law, and has no fixed expiration. A fraud alert leaves the file accessible but requires a business to take reasonable steps to verify identity first. An initial fraud alert lasts 1 year and an extended fraud alert lasts 7 years under FCRA section 605A.
How many agencies does a freeze have to be placed with?
Three. Equifax, Experian, and TransUnion each maintain separate files, so a freeze at one agency does not affect the others. A consumer who wants a frozen file across the board requests it from each of the three.
Can a credit freeze be lifted temporarily?
Yes. A security freeze is free to place, temporarily lift, or remove under federal law. A temporary lift is typically used when a consumer expects a specific application to be reviewed, after which the freeze can be restored.
Does a credit freeze affect credit scores?
A freeze is an access setting, not an item of credit history, so it is not a factor in scoring models. Most credit scores, including FICO and VantageScore, use a range of 300 to 850, and FICO weights payment history, amounts owed, length of credit history, new credit, and credit mix. VantageScore uses its own weighting and does not publish fixed percentages.
What happens to fraudulent accounts that already appear on a report?
A freeze does not remove them, because it affects access rather than content. A dispute asks an agency to review the accuracy of an item, and under the FCRA an agency generally must investigate within 30 days, a period that can extend to 45 days if additional information is provided. A consumer who has filed an identity theft report can also ask under FCRA section 605B to have information resulting from the theft blocked from the file.
Related guides
- How Credit Scores Are Calculated
- Fico Vs Vantagescore
- Credit Score Ranges Explained
- Credit Utilization Explained
- Payment History And Credit Scores
- Length Of Credit History Explained