Credit Freeze vs. Fraud Alert: What is the Difference

A credit freeze physically blocks a lender from pulling your credit file at all. A fraud alert only requires a lender to take extra steps to verify your identity before opening new credit. Both are free at all three nationwide bureaus, but they are not the same protection, and the fraud alert itself comes in two versions with meaningfully different strength: a one-year initial alert and a seven-year extended alert. Confusing the two, or assuming an alert protects you the way a freeze does, is one of the most common and consequential mistakes people make after their information is exposed.

This page covers the legal difference between a freeze and a fraud alert, both alert tiers under federal law, and what to do if someone has already opened a new account in your name. For the exact bureau-by-bureau steps to place or lift a freeze, including phone numbers and how to freeze a child's credit, see our companion guide, how to freeze your credit at all three bureaus for free, which this page deliberately does not repeat.

The Core Difference: A Freeze Blocks, an Alert Only Warns

Both tools exist under the same federal statute, 15 U.S.C. § 1681c-1, but they do fundamentally different things. A credit freeze physically prevents a credit reporting agency from releasing your credit file to a new creditor at all. If a thief has your Social Security number, date of birth, and address and tries to open a new card or loan, the lender cannot even pull your file to evaluate the application while a freeze is active. A fraud alert takes a lighter approach: it flags your file so that a lender is supposed to take "reasonable steps" (initial alert) or actually contact you directly (extended alert) before extending credit. It does not block the lender from accessing your file, it only adds a step the lender is required to take first.

For the specific fear that drives most people to this page, someone opening new credit in your name, a freeze is the stronger tool because it removes the lender's ability to see your file in the first place rather than relying on a lender following the verification step correctly every time.

Both Are Free By Law

Placing, lifting, and permanently removing a credit freeze, and placing a fraud alert of either length, cost nothing at any of the three nationwide credit bureaus. The free nationwide freeze has been federal law since 2018, when § 301(a)(2) of the Economic Growth, Regulatory Relief, and Consumer Protection Act, Pub. L. 115-174, added subsection (i) to 15 U.S.C. § 1681c-1 and required the bureaus to place and remove a security freeze free of charge. That 2018 law did not create § 1681c-1 itself. The section was added in 2003, by § 112(a) of the Fair and Accurate Credit Transactions Act, Pub. L. 108-159, which is where fraud alerts come from; the 2018 amendment also lengthened the initial alert from 90 days to one year. The statute's express "free of charge" language attaches to the security freeze rather than to alert placement, so the honest way to put it is that no fee is authorized for a fraud alert and all three bureaus place them at no cost. A freeze placed or lifted electronically or by phone must happen within specific deadlines under 15 U.S.C. § 1681c-1(i)(2)(A) and (i)(3)(C): placement within 1 business day, and a lift within 1 hour. If anyone, including a bureau representative, tries to upsell you into a paid product to complete either action, that upsell is not required and you can decline it.

The One-Year Initial Fraud Alert

An initial fraud alert lasts "not less than 1 year" under 15 U.S.C. § 1681c-1 and also entitles you to a free copy of your credit report from each of the three bureaus. You only need to contact one bureau; federal law requires that bureau to notify the other two so the alert applies across all three files. Anyone who suspects they may become a victim, not just someone with confirmed fraud already, can place an initial alert, which makes it a reasonable precaution after a data breach notice even before you know whether your information has actually been misused.

The Seven-Year Extended Fraud Alert

An extended fraud alert, also created under § 1681c-1, lasts seven years rather than one, but it comes with a real prerequisite: you need to submit a copy of your FTC Identity Theft Report to a nationwide credit bureau to request it. One submission is what the statute requires. Under § 1681c-1(b)(1)(C) the bureau you file with must refer the extended alert to the other two, and under § 1681c-1(e)(2) those bureaus must then act on it as though the request had come from you directly. Contacting all three yourself is still a sensible way to confirm the alert actually landed everywhere, but it is a practical precaution rather than a legal condition. In exchange for that extra step, the extended alert is meaningfully stronger than the initial one. A potential creditor must actually contact you, not merely take reasonable verification steps, before issuing new credit in your name. The extended alert also excludes you from unsolicited prescreened credit offers for 5 years, which cuts off one of the more common vectors thieves use to intercept a preapproved offer addressed to you.

IdentityTheft.gov's own description of victim rights lists both alert tiers side by side as separate entitlements: the right to "place a one-year fraud alert" and, separately, the right to "place a seven-year EXTENDED fraud alert." If you already have an FTC report because you are dealing with confirmed identity theft rather than just exposure, the extended alert is generally worth the extra step over letting the initial one lapse after a year.

When a Freeze Is the Better Tool

If your specific concern is a new account being opened in your name, whether because of a data breach, a lost wallet, or any other exposure of your Social Security number, a freeze is the stronger federal protection because it blocks the lender from viewing your file rather than relying on the lender to follow a verification step. A freeze does not expire on its own and does not require an FTC report to place. The tradeoff is that you have to remember to lift it, temporarily or by bureau, whenever you actually apply for new credit yourself.

For the exact steps to place a freeze at Equifax, Experian, and TransUnion, including current phone numbers, how long a lift takes, and how to freeze a child's credit for free, see our dedicated guide: How to Freeze Your Credit After a Data Breach. That page also covers credit locks, the bureaus' own convenience products that are not the same as the federal freeze right and are sometimes bundled with a paid subscription, and credit monitoring, which alerts you after something happens rather than preventing it.

If Someone Already Opened an Account in Your Name

A freeze and a fraud alert both look forward; neither one removes an account a thief has already opened. If you discover a new credit card, loan, or other account you did not open, you have a separate right under the Fair Credit Reporting Act to dispute that specific fraudulent entry, and, if you have filed an FTC Identity Theft Report, a stronger right to get it blocked entirely rather than merely investigated. Our guide to how to report identity theft covers that blocking mechanic, under 15 U.S.C. § 1681c-2, in full, including the 4-business-day deadline once a bureau has your documentation.

In practice, most people dealing with an already-opened fraudulent account need three things at once: an FTC Identity Theft Report to dispute and block the specific account, a freeze to stop it from happening again, and, if the extended alert's stronger protection appeals to you, a copy of that report submitted to a nationwide bureau for the seven-year alert as well. These rights are not mutually exclusive, and using only one of them typically leaves a gap the others were built to close.

Myth: "A Fraud Alert Protects Me the Same Way a Freeze Does"

This is false, and the difference is not a technicality. A freeze physically removes a lender's ability to view your credit file for a new account. A fraud alert, even the stronger seven-year extended version, still allows a lender to view your file and extend credit; it only adds a verification requirement the lender is supposed to follow. A lender that skips or mishandles that verification step, whether through error or fraud on the thief's part using information good enough to pass a quick check, can still open an account with only an alert in place. A freeze does not depend on a lender following a procedure correctly, which is exactly why it is the stronger of the two tools for the specific fear of new-account fraud.

That does not make a fraud alert useless. It is faster to place with no FTC report required for the initial tier, it covers you the moment you suspect a problem, and the extended alert's actual-contact requirement is a meaningfully higher bar than the initial alert's reasonable-steps standard. The two protections work well together: many people place an alert immediately as a first move, then follow up with a freeze at all three bureaus for the stronger, longer-lasting protection.

Information last verified on 2026-08-13, drawn directly from 15 U.S.C. § 1681c-1 and IdentityTheft.gov's Know Your Rights page. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• How to Freeze Your Credit After a Data Breach (Free)
• What To Do After a Data Breach: A Step-by-Step Guide

---

Last updated: 2026-08-13.