Bureau alerts, freezes, and locks

TL;DR

• Freezes are free, federally mandated, and block any new creditor from pulling your file. Temporarily lift them for specific applications via the bureau's app in seconds.
• Fraud alerts are less restrictive — lenders must verify your identity before approving new credit but aren't blocked outright. 1-year initial, 7-year identity theft.
• Credit locks are bureau-branded products that work like freezes but via app. Free tiers are fine; paid tiers often aren't worth it.

Freezes — the default for anyone not actively applying

A credit freeze blocks any lender from pulling your credit file. New credit can't be opened in your name (fraudulently or legitimately) without lifting the freeze first. It does not affect existing accounts, does not affect your score, and is free to place/lift at all three bureaus.

When to freeze: always, unless you're actively shopping for credit. A frozen file stops 95% of identity theft attempts without any downside.

How to freeze:

• TransUnion: transunion.com or call 888-909-8872
• Equifax: equifax.com/freeze or call 800-349-9960
• Experian: experian.com/freeze or call 888-397-3742

Each bureau takes 5-10 minutes online. You'll need to answer identity-verification questions pulled from your credit file.

How to temporarily lift (thaw):

• Each bureau's app/site lets you lift for a specific date range (e.g., "lift for 24 hours" or "lift for 7 days") or permanently.
• Lifts take effect within minutes.
• Lift specifically the bureau the lender will pull. See Who uses which score — if you're applying for an Amex card, lift Experian; for Citi, lift Equifax.

Fraud alerts — lighter touch

A fraud alert on your file asks lenders to take extra verification steps (call you, email, ID check) before approving new credit. It doesn't block the application outright — it just adds friction.

Three types:

• Initial fraud alert (1 year) — no evidence of fraud required. Free. Renew annually if you want ongoing protection.
• Extended fraud alert (7 years) — requires a police report or identity-theft affidavit. Once placed, lasts 7 years.
• Active duty alert (1 year) — for military members deployed overseas. Renewable.

You only need to place a fraud alert with one bureau — they're required to notify the other two.

When to use a fraud alert over a freeze: if you expect to apply for credit somewhat frequently and want extra verification rather than full blocking. Also if you have evidence of active fraud and want lenders flagged.

Credit locks — branded freezes with better UX

Each bureau offers a "lock" product, either free or paid:

• TransUnion TrueIdentity (free tier) / TrueIdentity Premium (paid) — free version is a basic lock, paid adds monitoring
• Equifax Lock & Alert (free) — basic lock via app
• Experian CreditLock (paid, $9.99/mo bundled with monitoring)

Functionally equivalent to a freeze for most purposes. Lock via phone app vs freeze via PIN/phone.

Key difference (legal): freezes are governed by federal law. Locks are governed by the bureau's contract with you. In a rare dispute, freezes have stronger consumer protection than locks.

Recommendation: use freezes unless you find the lock UX genuinely better. Free lock products are fine; paid lock products (Experian's $9.99/mo) usually aren't worth it — the core lock function is free, you're paying for the bundled monitoring.

Which bureau to prioritize

If you have to choose (or pay attention first):

• Freeze Experian first. Chase, Amex, Discover, BofA, Wells Fargo, US Bank, Goldman — all pull Experian most often. Freezing Experian blocks the most common issuer attacks.
• Freeze TransUnion second. Barclays, Apple Card, Comenity, some Chase pulls.
• Freeze Equifax third. Citi, Synchrony, Navy Federal, PenFed, USAA.

Ideally, freeze all three. It's free, takes 15 minutes total, and once done doesn't require maintenance.

Thawing for an application

When you're ready to apply for a specific card:

1. Identify which bureau the issuer pulls (use CardLeverage /learn/credit-scores/who-uses-which).
2. Thaw that specific bureau via its app for 24 hours.
3. Submit the application.
4. Freeze re-engages automatically after the 24-hour window, or lift ends with your set date.

If you're unsure which bureau — thaw all three. Can always re-freeze tomorrow.

Alerts vs Monitoring

Different products:

• Credit monitoring — watches your file for changes (new accounts, inquiries, major score swings). Alerts you via email/SMS. Free tier available in every bank app, Credit Karma, and Experian's free tier.
• Identity theft monitoring — broader. Watches dark web dumps, new account openings, change-of-address flags. Paid services: LifeLock, Aura, Zander, Identity Guard. $10-30/month.

For most users, free credit monitoring + a freeze is sufficient. Paid identity theft monitoring is worth it only if you've had prior identity theft events.

Common mistakes

1. Freezing only one bureau. A creditor can pull whichever bureau you didn't freeze.
2. Forgetting the PIN. Older freezes require a PIN to lift. If you lose it, you have to mail a copy of your ID to the bureau and wait ~10 days. The apps don't require a PIN — use the app-based lift.
3. Leaving freeze lifted after application. If you freeze for a date range, freeze re-engages automatically. If you leave it permanently lifted, you're unprotected.
4. Thawing the wrong bureau. Pulling up a chart of which issuer pulls which bureau before applying saves you a denial letter.

What a freeze doesn't do

• Doesn't block existing creditors from reviewing your account.
• Doesn't block account-monitoring pulls by your current issuers.
• Doesn't block insurance companies (they pull from a separate file, LexisNexis / C.L.U.E.).
• Doesn't block employment background checks (different file).
• Doesn't block utility new-service (though some utilities do pull credit and will fail if frozen — you may need to lift).
• Doesn't show on your credit report as anything negative.

Bottom line

• Freeze all three bureaus. It's free, federally mandated, and zero downside.
• Thaw individually via bureau apps before each application.
• Free lock products are fine; paid ones usually aren't.
• Fraud alerts are lighter-touch than freezes — use if you want verification without blocking.
• Know which bureau your target issuer pulls. See Who uses which score.