Credit freeze vs credit lock: what the law and bureaus say

A freeze is a right, a lock is a product

The government pages split the two by who stands behind them. The CFPB says credit reporting companies also offer “credit locks” for a fee, often bundled with other services you must pay for, and that locks are no more effective than security freezes, which are free and a right under the law. The FTC’s consumer alert from September 2018, written with the CFPB for the day the law started, says freezes and locks work in a similar way but locks may have monthly fees, and that anyone who wants a free freeze guaranteed by federal law should choose a freeze, not a lock.

Experian’s comparison page, dated 25 September 2026, draws the same line in a table. A freeze costs nothing and is your right under federal law. For a lock the cost varies, and its features and function are determined by the credit bureau that provides it. NerdWallet, whose page was updated on 23 May 2025, says locks are not governed by federal law, that the bureaus’ service agreements do not guarantee error-free or uninterrupted service, and that lock services are not always available to people under 18.

The freeze is free because of a change in 2018. WHYY, carrying an Associated Press story, says the rules used to vary by state and that a freeze could previously cost up to $10, a fee often paid again to lift it. Congress passed the law in response to the Equifax hack, which WHYY says exposed the private information of more than 145 million Americans, and the President signed it in May. In an NPR interview, Ron Lieber of The New York Times says the explanation for a Congress and White House that agreed on it is one word, Equifax. From 21 September 2018, the FTC says, you can freeze and unfreeze your credit file for free, get a free freeze for children under 16, and get one for a person whose guardian, conservator or holder of a power of attorney you are.

On what the two do, the pages agree more than they differ. Experian says a lock lets you restrict and grant access to your credit reports essentially the same way a freeze does, usually with extra features. Its example is Experian CreditLock, which turns access to the Experian report on and off instantly and also notifies you when anyone requests access to the locked report. NerdWallet says a lock usually brings alerts when the report changes or someone tries to access it. TransUnion’s blog says a freeze is managed on each bureau’s own page, while a lock, where there is one, is managed through the page or app of the subscription it comes with.

What a freeze does and what it leaves alone

USAGov says that when you place a security freeze, creditors cannot access your credit report, which keeps them from approving any new credit account in your name, whether it is fraudulent or legitimate. The FTC puts the consequence in plain terms: while a freeze is in place, a new credit account cannot be opened in your name, you included. If you need to apply for new credit, you lift the freeze temporarily and put it back when you are done. The FTC adds that a freeze does not cost anything to place or lift, and that it does not affect your credit score. The CFPB says the same about scores, and the FTC says a freeze does not stop you from using the cards you already have, applying for a job, renting an apartment or buying insurance.

The FTC also says anyone can do it, any time, for any reason, even if their identity has not been stolen. It calls a freeze always a good idea and even more important when a Social Security number or other information is exposed in a data breach. Its 2022 consumer page on the choice calls a freeze the best protection against an identity thief opening new accounts, and explains why: creditors usually will not give credit if they cannot check the report. NPR’s host introduces Lieber as saying everyone should take advantage of it, and Lieber says that thawing it with the special PIN is “a little bit of a pain but usually doesn’t take more than 10 minutes”.

The freeze is not a wall around the whole report. The CFPB lists who can still see the file while a freeze is in place: creditors of accounts you currently hold, certain government entities such as child support agencies, and companies you have hired to monitor your credit file. You can also request and review your own files. The CFPB adds that the federal law requiring free freezes does not apply to someone who requests your report for employment, tenant screening or insurance. Equifax’s list of those who can still reach its report runs longer: companies that provide you a copy of your report or score, certain government agencies and courts, insurers underwriting a policy, employers and landlords screening you, companies authenticating your identity for purposes other than granting credit, those investigating or preventing fraud, and companies making pre-approved offers of credit or insurance. It points to optoutprescreen.com for stopping those offers. Equifax also says that freezing or locking the Equifax report does not prevent access at any other credit bureau.

WHYY states two limits. A credit freeze will not protect you from some other forms of identity theft, such as a fraudulent tax return filed in your name or charges made against an existing account. And it is different from credit monitoring, which tracks your credit and alerts you to changes. The article quotes Ted Rossman, an industry analyst at Creditcards.com, who compares a freeze to a home security system that keeps intruders out and monitoring to a text from a neighbour after the window has already been smashed.

What the three bureaus say about their own locks

The three bureaus describe their locks differently, and the pages carry different dates. We set down what each says and when, and we do not settle the differences.

Equifax. Its page says a lock and a freeze have the same impact on the Equifax report, but are not the same thing. The freeze is regulated by federal law and can be placed, temporarily lifted or removed for free online, by phone or by mail. The lock is switched on and off inside a myEquifax account, as part of the Equifax Complete Family Plan, Equifax Complete Premier, Equifax Credit Monitor or Equifax Complete. The page adds that you cannot have both on the Equifax report at once: to move from one to the other you first remove the one you have.

Experian. The same page that says locks are available through Experian and Equifax, but not currently through TransUnion, says Experian CreditLock comes as part of a premium identity protection subscription for $24.99 a month. That subscription also lists monthly privacy scans, alerts to credit activity at all three bureaus, FICO Scores, dark web alerts and up to $1 million of identity theft insurance. Experian says that for a lock each bureau requires your Social Security number and identity verification at setup, and that a freeze is the only option if you want to restrict access to your minor children’s credit information. It also says a lock might be the better option if you want the added protection services in the subscription.

TransUnion. Its help page says the TransUnion Credit Lock feature has been officially deactivated in TransUnion’s products, and offers a free credit freeze instead. A TransUnion blog post, updated on 24 November 2024, says the lock would be discontinued in the first half of 2025 in TransUnion Credit Monitoring, TrueIdentity and zendough, and that someone with a TransUnion lock can replace it with a freeze for free in the TransUnion Service Center.

The pages disagree on three points. First, who still offers a lock. Experian’s page of 25 September 2026 and TransUnion’s help page both say TransUnion does not, while NerdWallet, updated on 23 May 2025, lists a TransUnion lock at $29.95 a month as part of TransUnion Credit Monitoring, and says that service offers the lock/unlock option for TransUnion and Equifax reports. Second, what an Equifax lock costs. Equifax places its lock inside paid products; NerdWallet says Equifax’s free lock product is called Lock & Alert, which Equifax says will be free for life. The Equifax page we read mentions Lock & Alert only as a sign-in link. Third, how fast a freeze takes effect. Experian says online activation is instantaneous and NerdWallet says often instantly, while the CFPB and USAGov give a maximum of one business day. These are not necessarily in conflict, since the law sets the longest allowed time, but the pages are not written to the same measure.

NerdWallet also compares the terms of service. It says Experian’s include an arbitration clause and a class action waiver, and that Equifax’s and TransUnion’s terms of service do not. It recommends freezes for most consumers and says a lock, like a freeze, is most effective in place at all three bureaus.

How to place a freeze and how to lift it

Contact each of the three bureaus. The CFPB says you must contact each nationwide credit reporting company separately through its website, and USAGov says you can submit the request online, by phone or by mail. The FTC’s 2020 consumer alert says that to be fully protected you must place a freeze with each of the three, and that you will usually get a PIN or password to use each time you place or lift it. WHYY says the PIN is assigned online.

Experian lists what the bureaus typically ask for to prove who you are: your full name, date of birth, all addresses used in the past two years, Social Security number, a copy of a government-issued identification such as a driver’s license or state ID card, and a recent utility bill, bank or insurance statement as proof of address. It says to follow the instructions of each bureau. Procedures differ somewhat from one bureau to the next. We do not copy telephone numbers here, because the FTC’s 2018 alert and TransUnion’s own FAQ list different numbers for TransUnion.

The CFPB says the bureau must place the freeze within one business day of a request by telephone or secure electronic means, or within three business days of a request by mail, and must send written confirmation no later than five business days after placing it, with instructions for removing it. The bureau’s page must also let you request a freeze, an initial fraud alert, an extended fraud alert and an active-duty fraud alert. For lifting, it must act within one hour of a toll-free phone or secure electronic request, or within three business days of a mailed one. You can also lift the freeze temporarily for a period you specify, free of charge, with the same time limits. Experian gives one day or one week as examples and says policies vary by bureau.

A freeze lasts until you lift it, the FTC says. Rather than lifting all three each time, the FTC suggests identifying which bureau a lender will use to check your credit, lifting the freeze only at that one, and putting it back once the check has passed. The pages we read do not say how to find out which bureau a lender uses.

If a bureau does not place a freeze or fraud alert properly, the FTC’s 2018 alert says you can submit a complaint online or by phone. If you think someone stole your identity, the FTC points to IdentityTheft.gov for a personalized recovery plan. Our page on what to do about identity theft, in order sets out the wider sequence.

Fraud alerts, children and who a freeze suits

A fraud alert is the FTC’s third option, and it works differently. The FTC says an initial fraud alert tells businesses to check with you before opening a new credit account in your name, usually by contacting you first, and unlike a freeze it does not prevent businesses from seeing your credit report. It lasts one year and can be renewed. You contact only one of the three bureaus, and that bureau must tell the other two. Since 21 September 2018, the FTC’s alert says, a fraud alert lasts a year instead of 90 days. An extended alert lasts seven years for people who have completed an FTC identity theft report or a police report, and an active duty alert lasts one year for servicemembers. The FTC says you can place a fraud alert even if a freeze is already in place. Experian notes that with a fraud alert you can still apply for credit without having to remember to thaw or unlock your reports.

The FTC’s 2020 alert says which fits depends on your circumstances. With a fraud alert you keep access to your credit, while freezes are generally best for people who are not planning to take out new credit, which often includes older adults, people under guardianship and children.

For a child under 16, the FTC says you can request a free credit freeze, that it stays in place until you tell the bureaus to remove it, and that the process for a minor is different from the adult one, with each bureau giving its own instructions. The CFPB adds that if the bureau has no file on the protected consumer, it creates a record to freeze, which may not be used for credit purposes. Experian calls the freeze the only option for restricting access to a minor child’s credit information, and NerdWallet says lock services are not always available under 18. Our page on child identity theft covers what to check for a child.

What the pages leave out

The pages we read do not settle what an Equifax lock costs today: Equifax places it inside paid products, and NerdWallet describes a free one. They do not measure how fast a lock acts beyond the word instant, and only the freeze has times set by law. They give no figure for how many people use a freeze or a lock. And while WHYY says a freeze does not stop charges on an existing account, the pages do not describe what happens once a thief has already used an account you hold. For the subscriptions that bundle a lock with monitoring and insurance, our page on whether identity theft protection is worth it sets out the published figures.

We placed no freeze and used no lock. We did not read the pages from Allstate, Aura, a credit union’s blog and a wealth adviser that Google listed, because they come from sellers of identity protection, a credit union and a wealth advisory firm, so we took nothing from them. The Equifax answers that open as accordions were not in the text we saved, so we used only its visible text. The Google AI box was read only in part and is not used. The FTC’s 2018 alert carries a 2022 date at the top but speaks of the 2018 start of the law as upcoming, so we cite it as the 2018 alert.