Credit Freeze vs. Fraud Alert: What Federal Law Requires

Educational information only, not legal or financial advice. This guide describes federal rules for the nationwide consumer reporting agencies. It does not determine which step fits an individual's circumstances, prevent every form of identity theft, or cover every credit-reporting company.

The difference in one question

If someone may try to open credit in your name, do you want to restrict access to your credit report, or have a business verify your identity before granting new credit? A security freeze addresses the first question. A fraud alert addresses the second. Neither is a guarantee that identity theft cannot occur. You can have both at the same time. 15 U.S.C. § 1681c-1(a), (h), (i); FTC, Credit Freezes and Fraud Alerts.

The word freeze here means the federal security freeze in § 1681c-1(i), not a bureau's separate credit-lock product. The FTC cautions against confusing freezes with locks.

A credit freeze: contact each nationwide bureau

Under § 1681c-1(i), a security freeze generally restricts a covered consumer reporting agency from disclosing the contents of a frozen consumer report to someone requesting it, subject to the exceptions listed below. The subsection defines a covered agency by reference to 15 U.S.C. § 1681a(p)—the nationwide consumer reporting agencies. This article does not assert that the same federal freeze duties apply to every specialty reporting agency. § 1681c-1(i)(1).

You request a freeze separately from Equifax, Experian, and TransUnion. It is free. You do not need to prove that identity theft has already happened. After a direct request and proper identification, each covered agency must place the freeze no later than:

• one business day after receiving the request directly from you by toll-free telephone or secure electronic means; or
• three business days after receiving the request directly from you by mail.

These are placement deadlines, not promises that every online or phone request is completed instantly. § 1681c-1(i)(2)(A); FTC guide.

A freeze generally stays in place until you directly ask that it be removed. The statute also permits removal when the agency placed it because of a material misrepresentation of fact by the consumer, with prior written notice. You can request a temporary lift for a period you specify. Once the agency receives your direct removal request and proper identification, it must lift the freeze, free of charge, no later than one hour after receiving a phone or secure-electronic request, or three business days after receiving a mailed request. Those are removal clocks; they are not the one-business-day placement clock. § 1681c-1(i)(3)(A)–(E).

If a lender needs a report for a new credit application while a freeze is in place and you do not permit access, it may treat the application as incomplete. A freeze does not erase existing account information or stop all uses of a report. § 1681c-1(i)(3)(D), (4).

A freeze has statutory exceptions

Section 1681c-1(i)(4) lists circumstances in which a freeze does not apply to the making of a consumer report for the stated use. It names:

1. Existing or prior account relationships: a person or entity with which you have or had an account or contract, including the specified affiliates, agents, and assignees, for reviewing the account or collecting the obligation. Account review includes maintenance, monitoring, credit-line increases, upgrades, and enhancements. The paragraph also covers its stated negotiable-instrument relationships.
2. Legal process: the listed government and law-enforcement bodies, trial courts, and private collection agencies acting under a court order, warrant, or subpoena.
3. Child support: a child-support agency acting under the specified Social Security Act program.
4. Government duties: a federal agency or a state or its agents or assigns investigating fraud, investigating or collecting delinquent taxes or unpaid court orders, or fulfilling other statutory responsibilities consistent with a permissible purpose under § 1681b.
5. Section 1681b(c) uses: a person using credit information for the purposes that subsection permits.
6. Subscribed monitoring: an entity administering a credit-file-monitoring subscription or similar service to which you subscribed.
7. Your requested copy: an entity providing your consumer report or credit score at your request.
8. Insurance underwriting: a person using the information in connection with underwriting insurance.
9. Screening: a person using the information for employment, tenant, or background screening.
10. Identity and fraud checks: a person assessing, verifying, or authenticating your identity for a purpose other than granting credit, or investigating or preventing actual or potential fraud.

Those are the statute's categories, not a claim that any requester can access a frozen report for any purpose. The conditions within each category matter. § 1681c-1(i)(4)(A)–(J).

A fraud alert: contact one nationwide bureau

An initial fraud alert tells prospective users of a report to take the identity-verification steps required by § 1681c-1(h) before the specified new-credit actions. It does not restrict access to the report the way a freeze does. A consumer who asserts in good faith that they are or may be a victim of fraud or a related crime, including identity theft, may request one. The covered bureau must include the alert for not less than one year, unless it is removed earlier at the consumer's verified request. The bureau that receives the request must refer the alert information to the other nationwide bureaus; you do not have to make three initial-alert requests. § 1681c-1(a)(1), (h)(1); FTC guide.

An extended fraud alert is different. It requires an identity-theft report and appropriate proof of the requester's identity. The covered bureau must include that alert for the statutory seven-year period, unless it is removed earlier at a verified request, and refer it to the other nationwide bureaus. It also triggers a five-year exclusion from the specified unsolicited credit and insurance offer lists unless the consumer asks to end that exclusion earlier. Its verification rule for prospective users is more specific than the initial-alert rule. § 1681c-1(b)(1), (h)(2).

The FTC explains the practical distinction: both alert types are free; an initial alert can be renewed, and an extended alert requires an identity-theft report. A fraud alert does not make accurate account information disappear.

A third mechanism: blocking identity-theft information

A credit-report block under 15 U.S.C. § 1681c-2 is not a freeze or a fraud alert. It concerns information the consumer identifies as resulting from alleged identity theft and has its own document requirements and conditional blocking process. For that process, read What Is Actually Disputable on a Credit Report?. A freeze addresses access to a report; an alert changes identity-verification duties; a block addresses identified information. None should be represented as an automatic deletion of accurate information.

The practical next question

If you are concerned about new accounts, check which of the three nationwide bureaus you have contacted and whether you requested a freeze or an alert. Keep the confirmation and the date and channel of each request; the federal deadlines depend on what the agency received and how. If a report shows an account or field you do not recognize, read the report entry and identify the specific information at issue. That is a different question from placing a freeze or alert.

This guide focuses on adult consumers. It does not cover the separate protected-consumer freeze procedure in § 1681c-1(j) for children under 16 and certain people with guardians or conservators; that procedure has its own proof-of-authority and identification requirements. § 1681c-1(j).

Source and review record

The statutory text cited above is the Government Publishing Office's 2024 U.S. Code edition of § 1681c-1, read September 28, 2026; the FTC consumer guide was also read that day. The Office of the Law Revision Counsel's preliminary Code search indicated the same section but its full page did not load in this source check. Claude Opus 5 completed a source and compliance red-team on September 28, 2026. External compliance review remains pending.

AI Credit Copilot provides source-backed education. We do not place freezes or alerts, file identity-theft reports, or promise a credit or fraud-prevention outcome.