How to Freeze Your Credit & Stop Identity Theft (2026 Guide)

Lock Out Identity Thieves in About 30 Minutes — For Free

Imagine a stranger walks into a bank with your name, your birthday, and your Social Security number. They open a credit card, a car loan, or a phone plan — all in your name. You never see the bills, but the damage lands on your credit. This is new-account identity theft, and it is shockingly common.[13]

The scale is hard to ignore. In 2024, the Federal Trade Commission (the "FTC") logged about 6.5 million consumer reports, including more than 1.1 million identity theft reports filed through IdentityTheft.gov. Total reported fraud losses jumped to $12.5 billion, up 25 percent from the year before. Credit card fraud was the most reported type of identity theft.[7, 8]

Here is the good news. There is one move that blocks most of this — and it is free, fast, and easy to undo. It is called a security freeze (also known as a credit freeze). When your credit is frozen, lenders cannot pull your credit report, so they will not approve a new account in your name. This guide shows you exactly how to do it. (Tax-refund fraud works differently — see our guide to tax identity theft — and if you want to understand the number a freeze protects, start with our credit score guide.)[10, 1]

What a Credit Freeze Actually Does

A security freeze restricts access to your credit report. Most lenders will not open a new account without first checking your credit. If your report is frozen, they cannot see it — so the application stalls and the fake account never gets approved. Think of it as a deadbolt on your credit file: you hold the key, and you decide who gets in.[10]

For years, freezes cost money and varied by state. That changed in 2018. A federal law — the Economic Growth, Regulatory Relief, and Consumer Protection Act — made placing and lifting a freeze free in all 50 states, effective September 21, 2018. It lives in the Fair Credit Reporting Act at 15 U.S.C. §1681c-1(i). No matter where you live, your freeze costs nothing.[5, 6, 15]

The law also sets the speed. If you ask online or by phone, the bureau must place the freeze within one business day. When you later want to lift it, they must do that within one hour by phone or online. (By mail, the window is three business days.) A freeze is not permanent or all-or-nothing: you can lift it for a single lender, for a set period, and then it snaps back on. And — this is the fear most people have — a freeze does not lower your credit score at all.[10, 1]

How to Freeze Your Credit at All Three Bureaus, Step by Step

There is one rule that trips people up: you must freeze all three nationwide credit bureaus separately. They are Equifax, Experian, and TransUnion. A lender might check any one of them, so freezing just one leaves the door open at the other two. Three quick requests, and the whole front is locked.[1, 21]

For each bureau you have three ways to ask: online (fastest), by phone, or by mail. You will need your name, birthday, Social Security number, and address history. The bureau then gives you a way to manage the freeze later — usually an online account or a PIN. Start here: Equifax (or call 888-298-0045), Experian, and TransUnion (or call 800-916-8800).[18, 19, 20]

When you need new credit later — say, a mortgage or a car loan — you do not remove the freeze for good. You temporarily lift (or "thaw") it, ideally only at the bureau that lender uses, for just the days you need. Then it locks again on its own. And freezing changes nothing about the accounts you already have: your cards, loans, and bank accounts keep working exactly as before. The government also keeps a plain-English walkthrough at USA.gov.[10, 21]

Freeze vs. Lock vs. Fraud Alert: Which One Do You Need?

These three tools sound alike but are not the same. A security freeze is the strongest. It is backed by federal law, it is free, and the bureau must follow strict timing rules. The trade-off is small: you have to remember to thaw it when you apply for new credit. For most people, the freeze is the right default.[1, 10]

A credit lock is different. It is a product the bureaus sell, usually through an app that flips your file on and off with a tap. Convenient — but a lock is governed by the company's contract terms, not by the freeze law. Some locks are free; others are bundled into paid monitoring plans, and the fine print can change. Read the terms before you rely on a lock instead of a freeze.[2]

A fraud alert is the lightest layer. It does not block access to your file — instead, it flags your report so that a lender is supposed to take extra steps to verify you are really you before granting credit. It is free, and there is a nice shortcut: you place it with just one bureau, and that bureau must tell the other two. Bottom line: a freeze is the lock on the door; a fraud alert is the note that says "check ID." You can use both at once.[1, 15]

Fraud Alerts: Initial, Extended, and Active-Duty

There are three kinds of fraud alert. The initial fraud alert lasts one year and you can renew it. Anyone worried about fraud can place one — you do not need to be a victim yet. A nice bonus: when you set an initial alert, you are entitled to a free copy of your credit report from each of the three bureaus, so you can check for anything strange.[1, 13]

The extended fraud alert lasts a full seven years, but it is only for people who have actually been victims and have filed an identity theft report at IdentityTheft.gov (or a police report). With it, you also get taken off prescreened credit and insurance offer lists for five years, which removes a common fraud target — those pre-approved offers in your mailbox.[15, 9]

The active-duty alert is built for service members who deploy. It lasts one year (renewable for the length of a deployment) and also pulls you off marketing lists for two years, so a stack of credit offers does not pile up at home while you are away. All three alert types are spelled out in the same federal law, 15 U.S.C. §1681c-1.[1, 15]

The Bureaus Most People Forget: Innovis, ChexSystems, NCTUE

The big three are not the only companies holding files on you. The CFPB publishes a list of consumer reporting companies — dozens of specialty bureaus that track your banking, telecom, insurance, and rental history. A freeze at Equifax, Experian, and TransUnion does not stop someone from opening a checking account, a phone line, or a utility in your name. For those, you freeze the matching specialty bureau.[14]

Two are worth knowing first. Innovis is often called the "fourth credit bureau" — you can freeze it at innovis.com or by phone (800-540-2505). ChexSystems is the one banks use to screen people opening new checking and savings accounts; freezing it helps stop a thief from opening a bank account in your name and writing bad checks on it.[22, 14]

Two more fill the gaps. NCTUE tracks phone, cable, and utility accounts; you can freeze it at nctue.com to block fraudulent phone or power accounts. LexisNexis Risk Solutions (and its SageStream report) feeds insurance and background checks; it offers a free security freeze too. You do not have to freeze every one — but if you have already been targeted, these extra locks are cheap insurance.[23, 24]

Freezing a Child or Protected Person Credit File

You can freeze a child's credit too, for free. The same 2018 law added protections for "protected consumers" at 15 U.S.C. §1681c-1(j): children under 16, plus adults under a guardian's or conservator's care. A parent or guardian can place the freeze on their behalf. There is no cost, and the freeze stays put until you ask to remove it.[15, 3]

Why bother for a child who has no credit? Because that is exactly what thieves want: a clean, unused Social Security number they can pair with a fake birthdate to build a brand-new identity. The abuse often goes unnoticed for years — until the child applies for a first job or student loan. Because most kids have no credit file at all, the bureau usually has to create one first, then freeze it.[3]

To set it up, contact each of the three bureaus and send proof: your own ID, proof you are the parent or guardian (a birth certificate or court order), and the child's Social Security number. The FTC keeps a clear walkthrough on its child identity theft page, and the bureau contact details live at IdentityTheft.gov.[3, 9]

What a Freeze Will Not Protect You From

A freeze is powerful, but it is not a force field. It blocks new-account credit fraud — and that is its whole job. Let us clear up the biggest myth first: a freeze does not hurt your credit score, it does not close your accounts, and it does not stop you from being approved when you thaw it yourself. Those fears keep people from a free protection they should be using.[10, 1]

Now its limits. A freeze does not stop fraud on the accounts you already have — a stolen card number or an account takeover slips right past it, because no new account is being opened. It also does not stop a thief from filing a fake tax return for your refund, claiming government benefits, or getting medical care in your name. Those run on different rails than your credit file.[11]

So treat the freeze as your front door lock, then add a few more layers. Watch your existing accounts and turn on transaction alerts. Use a password manager and two-factor login. Pull your free reports to spot trouble early. No single tool catches everything — but a freeze plus alerts plus monitoring plus strong logins is a defense most thieves will simply skip.[12, 13]

What to Do Right After a Data Breach or SSN Exposure

You got a breach notice, a dark-web alert, or you lost your wallet. Move quickly, in order. Step one: freeze all three bureaus — and if your Social Security number was in the leak, freeze the specialty bureaus too. This is the fastest way to slam the door before anyone uses the stolen data.[4, 9]

Step two: place a fraud alert (one bureau tells the other two). Step three: change the passwords on your email and financial logins, and turn on two-factor authentication. Then pull all three of your reports for free at AnnualCreditReport.com and read them line by line for accounts or inquiries you do not recognize. Catching a strange account early is how you keep a small problem small.[26, 13]

If your Social Security number itself was exposed, consider getting an IRS Identity Protection PIN to guard your tax return. But do not rush to ask for a brand-new SSN. The Social Security Administration rarely issues one, and a new number creates fresh headaches — your old credit, work, and tax history all sit under the old number. Its guide, "Identity Theft and Your Social Security Number," explains when a change is even possible.[25]

Two Sneaky Kinds: Synthetic and Medical Identity Theft

Synthetic identity theft is the fastest-growing kind, and it is strange. Instead of stealing a whole person, a thief blends a real Social Security number — often a child's or a senior's, because those go unwatched — with a made-up name and birthday to build a "person" who does not exist. They nurse that fake identity for months, then run up credit and vanish. Freezes, especially on a credit file that is otherwise empty, are the main defense.[3, 14]

Medical identity theft is the other quiet one. Someone uses your name and insurance to get treatment, prescriptions, or equipment. The catch: it usually does not show up on your credit report, so a freeze will not catch it. Instead it surfaces as a strange bill, a collection notice for care you never got, or a wrong entry in your medical file. Read every Explanation of Benefits from your insurer, and question anything you do not recognize.[11]

The lesson from both is the same: a credit freeze is the foundation, not the whole house. Pair it with child freezes for your kids, a close eye on your medical paperwork, and a quick report at IdentityTheft.gov the moment something looks off. Different frauds need different locks.[9]

If It Already Happened: Recovering With IdentityTheft.gov

If a thief already opened accounts in your name, you are not alone and there is a clear path. Go to IdentityTheft.gov, the FTC's official recovery site. Answer a few questions and it builds you a personal recovery plan, creates an official FTC Identity Theft Report, and even fills out dispute letters you can send. It is free, and it turns a scary mess into a checklist.[9, 11]

That FTC report unlocks strong legal rights. Under the Fair Credit Reporting Act, you can have the bureaus block fraudulent information from your report — they must do it within four business days of getting your documents (15 U.S.C. §1681c-2). You can also force the businesses where the fraud happened to hand over copies of the fake applications and transactions, usually within 30 days (15 U.S.C. §1681g(e)). Then dispute each fake account directly with the bureau and the creditor.[16, 17]

Keep good records of every call and letter, and file a police report if a creditor or the FTC plan asks for one. Remember that tax-refund identity theft runs on a separate track through the IRS (Form 14039 and an IP PIN), so handle that piece there. Once the fraudulent accounts are blocked, you can sort the real debts from the fake and rebuild on solid ground.[4]

Staying Protected: Free Weekly Monitoring and Smart Habits

A freeze is set-and-forget, but smart monitoring catches the rare thing that slips through. The only federally authorized free source is AnnualCreditReport.com, and the good news for 2026 is that all three bureaus now give you a free report every week — permanently. You can stagger them or pull all three at once, scanning for accounts and inquiries you do not recognize.[26, 14]

Cut off one more fraud vector while you are at it. Those "pre-approved" credit and insurance offers that arrive by mail can be stolen and used. You can stop most of them by opting out at OptOutPrescreen.com (or call 1-888-5-OPT-OUT), the official site the bureaus run for this. Fewer offers in the mailbox means fewer chances for a thief.[27]

Finally, build a few habits. Keep your freezes on by default and only thaw when you are actually applying for credit. Store your PINs and recovery codes somewhere safe. Use a password manager and two-factor login, and stay sharp about phishing texts and calls that try to trick the password out of you. Thirty minutes of setup plus a few minutes a month is a tiny price for real peace of mind.[12, 13]

Credit Freezes in 2026: Your Rights and the Key Numbers

Here are the facts to keep in your pocket. Freezing and unfreezing are free in every state and that is permanent law from 2018. A freeze must go on within one business day and come off within one hour when you ask online or by phone. An initial fraud alert lasts one year, an extended alert seven years. Child and protected-consumer freezes are free. And you get a free credit report every week from each bureau.[5, 10, 1]

The threat is not slowing down. The FTC counted $12.5 billion in reported fraud losses in 2024 and more than a million identity theft reports, while giant data breaches keep spilling Social Security numbers onto the dark web. But here is the steadying truth: your rights under the Fair Credit Reporting Act do not bend with the headlines or with which agency is staffed up this year. The law is the law, and the freeze is yours to use.[7]

So here is the whole plan in one breath: freeze the big three today, add the specialty and child freezes if you have time, set one fraud alert, opt out of prescreened offers, and pull a free weekly report now and then. Thirty minutes of work now beats months of cleanup later — and it costs you nothing but the time.[21, 9]

Frequently Asked Questions

Quick, plain answers to the questions people ask most about freezing credit and stopping identity theft in 2026.