Credit Locks and Identity Theft: How Access Restrictions Fit Into the Picture
A credit lock restricts access to a credit file held by one credit reporting agency, which can make new-account fraud harder to carry out. It is not identity theft protection on its own: a lock does not stop misuse of existing accounts, fraudulent tax filings, or information already reported.
This guide is general educational information for U.S. readers. It is not financial advice and does not describe your individual credit file. Figures such as score ranges and timeline estimates are typical examples, not promises.
Key takeaways
- A credit lock restricts access to a credit file at one credit reporting agency, but it is a company product governed by that company's terms rather than a right created by federal law.
- A lock can make new-account fraud harder to carry out, yet it does not stop misuse of accounts that already exist, fraudulent tax filings, or identity misuse outside the credit reporting system.
- A security freeze is free to place, temporarily lift, or remove under federal law, an initial fraud alert lasts one year, and an extended fraud alert lasts seven years.
- A lock is not a scoring factor; most credit scores, including FICO and VantageScore, use a range of 300 to 850, and FICO weighs payment history at about 35% and amounts owed at about 30%.
- An identity theft report can be filed at IdentityTheft.gov, and tax-related cases can be reported to the IRS using Form 14039.
A credit lock is a tool that a credit reporting agency offers to restrict access to a consumer's credit file, which makes it harder for someone to open a new account using that person's identity. It is not identity theft protection by itself. A lock does not stop a thief from using a card or account that already exists, does not stop a fraudulent tax return, and does not remove information that is already in a credit file. It is one layer among several, sitting alongside the fraud alert and the security freeze that federal law covers.
A credit lock is a feature that a credit reporting agency offers to its customers. When the lock is active, that agency's system is set to decline certain requests for the consumer's credit file, most often requests that come from a lender reviewing a new application. Because a lock is a company product rather than a right granted by statute, it is governed by the terms the company writes: how it is switched on and off, what it covers, and what happens if the product changes. Those terms are not uniform across the three nationwide credit reporting agencies, Equifax, Experian, and TransUnion.
The closest relative to a lock is the security freeze. A freeze is a legal right rather than a product, and under federal law a security freeze is free to place, temporarily lift, or remove. The Federal Trade Commission explains how freezes and fraud alerts work on its page about credit freezes and fraud alerts. A freeze is spelled out in federal law; a lock is spelled out in a company's agreement, even when the two are used for the same purpose.
Does a credit lock prevent identity theft?
Not on its own. Identity theft is a broad category that includes new accounts opened with stolen identifiers, takeover of accounts that already exist, fraudulent tax filings, and misuse of personal information in medical or employment settings. A credit file lock addresses only the part of that list that depends on a lender pulling a credit file.
New-account fraud is where a lock has the most direct relevance. If a lender cannot obtain a file from the agency where the lock is in place, an application generally cannot be underwritten on the strength of that file alone. But an access restriction covers one path out of many. A thief who already holds account credentials can move money through accounts that exist, and no credit file request is required. A fraudulent refund claim needs a Social Security number, not a credit inquiry. Because damage can occur outside the credit reporting system, the FTC's identity theft resources cover recovery steps that have nothing to do with locking a file.
How locks, freezes, and fraud alerts differ
These tools are often grouped together, but they are not interchangeable. The table below separates them by who provides the tool, what it limits, and how long it lasts.
| Tool | Who provides it | What it restricts | How long it lasts |
|---|---|---|---|
| Credit lock | A credit reporting agency, as a company product | Access to that agency's credit file, on the terms the company sets | Determined by the company's terms |
| Security freeze | The credit reporting agency, as a right under federal law | Access to the credit file; free to place, temporarily lift, or remove | Stays in place until the consumer lifts or removes it, as described by the FTC |
| Initial fraud alert | The credit reporting agencies, under FCRA section 605A | It does not block access; it tells businesses to take steps to confirm identity before extending credit | 1 year |
| Extended fraud alert | The credit reporting agencies, under FCRA section 605A | The same verification signal, available after an identity theft report is filed | 7 years |
Two points in that table carry weight. First, a fraud alert does not block access to a credit file; it tells businesses to confirm identity before extending credit, which is a different mechanism from a lock or a freeze. Second, a lock or freeze placed at one nationwide agency does not extend to the other two. A lender chooses which agency or agencies to pull from, so a restriction at a single agency leaves the other files open.
What federal law provides
The Fair Credit Reporting Act was enacted in 1970 and amended by the Fair and Accurate Credit Transactions Act in 2003. Two sections of the act deal directly with identity theft. Section 605A (15 U.S.C. section 1681c-1) covers fraud alerts, and section 605B (15 U.S.C. section 1681c-2) covers the blocking of information that results from identity theft.
Under the FCRA, a consumer is entitled to a free credit report from each nationwide agency every 12 months, and the three agencies currently provide free reports weekly through AnnualCreditReport.com. When a consumer disputes an item, an agency generally must investigate within 30 days; that period can extend to 45 days if the consumer provides additional information during the initial 30-day period.
Other timing rules shape what a file contains. Most negative information, including late payments, stays on a credit report for seven years. A Chapter 7 bankruptcy stays for ten years, and a Chapter 13 bankruptcy stays for seven. A hard inquiry typically remains for two years. The Consumer Financial Protection Bureau, created by the Dodd-Frank Act in 2010 and operating since 2011, publishes consumer guidance on credit reports and scores.
Freezes, alerts, and the dispute process are described in more detail on the pages for credit freeze and credit reports.
What a lock does not do
- It does not stop spending or transfers on accounts that already exist.
- It does not remove inaccurate or fraudulent items that are already in the file; the FCRA dispute process and the identity theft blocking provisions handle those separately.
- It does not prevent tax-related identity theft, which can be reported to the IRS on Form 14039.
- It does not extend to the other two nationwide agencies unless a restriction is placed there as well.
- It does not replace a police report or an identity theft report filed at IdentityTheft.gov.
Why monitoring is used alongside locking
A lock is a barrier; monitoring is an observation. Credit monitoring watches a credit file for changes and sends an alert when something new appears, such as a new account, a new inquiry, or a new address. A lock reduces who can obtain the file, but activity that gets through, or activity that never needed the file, still shows up in the record. Reading reports regularly is the other half of the picture: a credit check of a personal file can surface an account or inquiry that was not authorized. More on this appears on the pages for credit monitoring and the credit profile.
How locks relate to credit scores
Most credit scores, including FICO and VantageScore, use a range of 300 to 850. FICO's published factor weights are payment history at about 35%, amounts owed at about 30%, length of credit history at about 15%, new credit at about 10%, and credit mix at about 10%. VantageScore uses its own weighting and does not publish fixed percentages.
A lock is not one of those factors. It changes who can obtain a credit file, not how the contents of that file are evaluated. Inquiries generated by new-account applications fall under the new credit factor, and a hard inquiry typically remains on a report for two years. The mechanics are covered in the guides on how credit scores are calculated, FICO versus VantageScore, payment history, and credit utilization.
If identity theft has already happened
An identity theft report can be filed at IdentityTheft.gov, and tax-related cases can be reported to the IRS using Form 14039. Those filings support requests for an extended fraud alert and for blocking under FCRA section 605B. The identity theft page covers the sequence in more detail, and the credit score page explains how the factors above are weighed. A lock placed after the fact does not remove fraudulent items that are already reported; the dispute and blocking provisions do that work.
This page is for education only and is not financial advice.
Compare three-bureau credit scores and reports from a single place. Educational links, disclosed below.
Three Bureau Credit Scores and ReportsCreditMonitored.com may earn a commission from partner links at no additional cost to you.
Frequently asked questions
Does a credit lock prevent identity theft?
A credit lock restricts access to a credit file at one credit reporting agency, so it can make new-account fraud harder to carry out. It does not stop misuse of accounts that already exist, fraudulent tax filings, or use of personal information outside the credit reporting system. Identity theft covers all of those areas, which is why locks, fraud alerts, and freezes are treated as separate tools.
Is a credit lock the same as a security freeze?
No. A security freeze is a right under federal law and is free to place, temporarily lift, or remove. A credit lock is offered by a credit reporting agency as a company product and is governed by that company's terms, including how the lock is switched on and off and what it covers.
How long does a fraud alert last?
An initial fraud alert lasts one year. An extended fraud alert lasts seven years and is available after an identity theft report is filed.
Does a credit lock change a credit score?
No. A lock is not a scoring factor. Most credit scores, including FICO and VantageScore, use a range of 300 to 850, and FICO's published weights are payment history at about 35%, amounts owed at about 30%, length of credit history at about 15%, new credit at about 10%, and credit mix at about 10%. A lock changes who can obtain a credit file, not how its contents are evaluated.
Does a lock at one credit reporting agency cover the other two?
No. Each of the three nationwide agencies, Equifax, Experian, and TransUnion, maintains its own file, and a restriction placed at one does not extend to the others. A lender chooses which agency or agencies to pull from.
What is the difference between a credit lock and credit monitoring?
A lock limits who can obtain a credit file. Credit monitoring observes the file and sends alerts when something changes, such as a new account or a new inquiry appearing. The two do different jobs and are often used together.
Related guides
- How Credit Scores Are Calculated
- Fico Vs Vantagescore
- Payment History And Credit Scores
- Credit Utilization Explained
- Credit Freeze
- Identity Theft