Your Social Security number just showed up in a data breach notification. Your first instinct is right — act immediately. Your second instinct — Googling "what do I do now" and drowning in contradictory advice — is where most people lose precious time.

In our practice at McCray & Associates, we walk clients through this exact situation every week. The two tools you need to understand first are a credit freeze and a fraud alert. They are not the same thing, they are not interchangeable, and choosing the wrong one for your situation can leave you either overexposed or locked out of credit you legitimately need.

The Two Tools at a Glance

Before we go deep on either one, here is an honest side-by-side — including a third option, the "credit lock," that the bureaus will happily sell you and that you should understand clearly before paying for anything.

Credit Freeze Fraud Alert Credit Lock
Cost Free (federal law) Free (federal law) Often free in basic form; sometimes bundled into a paid monitoring product
What it does Blocks all new-account pulls on your report Flags your report; lenders must verify identity before extending credit Restricts new-account pulls, similar to a freeze
Legal protection Yes — grounded in the FCRA Yes — grounded in the FCRA No — it is a bureau product governed by their terms of service
Duration Stays in place until you lift it Initial: 1 year; Extended: 7 years; Active-duty: 1 year Varies by bureau/product
How many bureaus Must freeze all three separately Contact one; it notifies the other two Must lock at each bureau separately
Effect on credit score None None None
Best for Maximum protection; preventing new fraud entirely Light ongoing protection; verified identity-theft victims; active-duty military Convenience if you're already a bureau subscriber — not a substitute for a freeze

The short version: if you want the strongest legal protection available, use a credit freeze. If you want a lighter layer that's easier to manage across multiple applications, use a fraud alert. Do not let a bureau upsell you on a paid lock when the free federal freeze does the same job with stronger legal backing.

How a Credit Freeze Works

A credit freeze — sometimes called a security freeze — is a right granted to every American consumer under the Fair Credit Reporting Act (FCRA), as strengthened by the Economic Growth, Regulatory Relief, and Consumer Protection Act that took effect in September 2018. Before that law passed, bureaus could charge up to $10 per freeze. Now it is free, permanently, no exceptions.

When a freeze is active on your file, a lender or creditor who runs a hard inquiry to open a new account will receive a response indicating the file is frozen and the pull cannot be completed. No new credit card, no new auto loan, no new mortgage — not until you lift the freeze yourself. Your existing accounts are completely unaffected. Your current creditors can still report to your file and access it for account-management purposes. You can still pull your own report at AnnualCreditReport.com. And your credit score does not move one point because of a freeze.

The one thing to know going in: you must freeze your file at all three bureaus separately. Freezing at Equifax does nothing to your Experian or TransUnion file. A fraudster who wants to open an account only needs to find one bureau that isn't frozen.

Step-by-Step: How to Freeze Your Credit at All Three Bureaus

Plan about 15–20 minutes total. Have your Social Security number, date of birth, address history, and a valid email address ready. Each bureau will give you a PIN or account login to manage future lifts.

Equifax

  1. Go to equifax.com/personal/credit-report-services/credit-freeze or call 1-800-685-1111.
  2. Create or log in to your myEquifax account.
  3. Select "Add a Security Freeze" and complete the identity verification steps.
  4. Save or screenshot your confirmation. Equifax uses account login (not a separate PIN) to manage lifts.

Experian

  1. Go to experian.com/freeze/center.html or call 1-888-EXPERIAN (1-888-397-3742).
  2. Follow the prompts to place a freeze; you'll create an account or receive a PIN by mail.
  3. Confirm the freeze is active before leaving the site.

TransUnion

  1. Go to transunion.com/credit-freeze or call 1-888-909-8872.
  2. Create a TransUnion account if you don't have one, then select "Add Freeze."
  3. Save your PIN or login credentials.

To lift (thaw) a freeze temporarily — say, before applying for a mortgage — log in to each bureau's portal or call the number above. You can lift it for a specific date range or indefinitely, then refreeze. This takes minutes online and up to three business days if done by phone or mail, so plan ahead when you know you'll be applying for credit.

How a Fraud Alert Works — and the Three Types

A fraud alert is a different tool with a different mechanism. Instead of blocking access to your report, it leaves your report accessible but places a flag that tells any lender pulling it: "Extra verification required before extending credit." The lender is supposed to take reasonable steps — usually a phone call to the number you specify — to confirm the applicant is really you.

The key advantage of a fraud alert over a freeze: you only need to contact one bureau. By law, that bureau must notify the other two, who must then place alerts on your files as well. That makes initial setup faster than a freeze.

There are three types:

Initial Fraud Alert (1 Year) Anyone can place this. You do not need to be a confirmed victim. It lasts one year, is renewable, and is appropriate after a breach or any time you suspect your information may be exposed.

Extended Fraud Alert (7 Years) This is for confirmed identity-theft victims who have filed an official report with the FTC at identitytheft.gov. With that report in hand, you can request an extended alert that lasts seven years and cannot be placed by just anyone — the bureau will require your FTC Identity Theft Report. An extended alert also requires that your name be removed from prescreened credit offer lists for five years.

Active-Duty Alert (1 Year) Available to active-duty military members who want to protect their credit while deployed. It lasts one year and can be renewed for the length of the deployment. It also triggers removal from prescreened offer lists for two years.

To place an initial fraud alert, contact any one of the three bureaus:

Credit Freeze vs. Credit Lock: Don't Get Upsold

This distinction matters, and the bureaus know most consumers don't make it.

A credit freeze is a right under federal law — specifically the FCRA. If a bureau violates the rules around your freeze, you have legal recourse. A credit lock is a bureau product, governed by that bureau's terms of service. It can be revoked, changed, or bundled into a subscription. The bureaus market locks heavily because they can charge for them or use them as an upsell to monitoring services.

In our practice, we tell clients: if you want protection, use the free federal freeze. It costs nothing, it has legal teeth, and it does everything a lock does. If you are already subscribed to a bureau monitoring service and find the lock convenient, that is fine — just understand it is not the same protection, and do not pay for a lock thinking you are buying something stronger than a freeze.

When to Use Which Tool

Use a credit freeze when:

  • Your SSN, date of birth, or full credit file was exposed in a data breach
  • You have already confirmed accounts were opened fraudulently in your name
  • You are not planning to apply for new credit in the near future and want maximum protection
  • You want to protect a child's credit file (more on this below)
  • You are in an ongoing identity-theft recovery and want to prevent new fraud while you clean up existing damage

Use a fraud alert when:

  • You suspect your information may be compromised but haven't confirmed fraud yet
  • You want a lighter layer of protection while still being able to apply for credit without the friction of lifting a freeze
  • You are active-duty military
  • You have filed an FTC identity-theft report and want the extended seven-year protection

Before applying for credit, if you have a freeze:

  • Log in to all three bureau portals and schedule a temporary lift for the date of the application
  • Give yourself a two-day buffer; online lifts are usually instant but mail/phone lifts can take up to three business days
  • Confirm with the lender which bureau they pull from so you can target the lift — though lifting all three is the safest move

For more on how to read your credit report and understand what lenders actually see, we have a full breakdown in our resource library.

Protecting Children's Credit Files

Minor children do not have credit files — until someone creates one fraudulently using their SSN. This is more common than most parents realize, because a child's clean SSN with no attached credit history is valuable to fraudsters and the fraud often goes undetected for years.

Every consumer reporting agency is required by law to allow parents and legal guardians to place a security freeze on a minor's credit file. If no file exists, the bureau creates one and immediately freezes it. Each bureau has a specific process for minors requiring documentation (birth certificate, your government-issued ID, and proof of address). Contact each bureau directly for their current minor freeze procedure. This is one of the most proactive things a parent can do.

What a Freeze and a Fraud Alert Do NOT Do

This is the part that trips people up. A credit freeze or fraud alert does not:

  • Remove fraudulent accounts already opened in your name
  • Dispute inaccurate information already on your report
  • Stop debt collectors who already have your account
  • Fix the underlying damage to your credit score from past fraud

Those fraudulent accounts and the resulting negative marks require a formal dispute process under the FCRA, and in cases of confirmed identity theft, a recovery plan through the FTC's identitytheft.gov portal. That portal walks you through creating a personal recovery plan, filing an FTC report you can use to request an extended fraud alert, and disputing fraudulent accounts directly with creditors and bureaus.

For the dispute process specifically, see our guides on how to dispute credit report errors and how to remove hard inquiries from your credit report. And for the full legal framework behind all of this — what the FCRA, FDCPA, and CROA actually give you the right to demand — our know your credit rights post is a good foundation.

Know Your Rights Under the FCRA

Everything discussed in this post — your right to a free freeze, your right to a fraud alert, the bureau's obligation to notify its counterparts, the extended protections for identity-theft victims — is grounded in the Fair Credit Reporting Act. These are not policies the bureaus can revoke at will. They are federal law.

If a bureau charges you for a freeze, refuses to place a fraud alert you are entitled to, or fails to forward your fraud alert to the other bureaus, they have violated the FCRA and you have the right to file a complaint with the Consumer Financial Protection Bureau (CFPB) and, in some circumstances, pursue civil remedies.

In our practice, we see clients who were charged for freezes before 2018 and clients who were sold paid lock products under the impression they were getting legal-grade protection. Neither should happen to you.

The Bottom Line

A credit freeze is the strongest free tool available to stop new fraudulent accounts from being opened in your name. It costs nothing, does not affect your score, and is backed by federal law — but you must place it at all three bureaus separately. A fraud alert is lighter, easier to set up (one bureau notifies the other two), and appropriate for suspected exposure or active-duty military situations. A credit lock is a bureau product, not a federal right — don't pay for one when the freeze is free.

Neither tool, however, undoes damage that's already been done. If fraudulent accounts are already on your report, that requires a formal dispute and, in confirmed identity-theft cases, a recovery plan through the FTC.

If you are not sure which tool fits your situation — or if you are dealing with existing fraudulent accounts alongside future protection — we can help you map out the right sequence of steps.

Book a free 30-minute consultation and let's walk through your specific situation together.