Credit freezes and fraud protection

A credit freeze is the single most effective anti-fraud tool available, it's free, it's the law, and fewer than 20% of Americans have used it. If you do only one thing for identity theft protection, make it this.

What a freeze does

A freeze blocks new creditors from pulling your credit report. Since most identity theft involves opening new accounts in your name, a freeze stops it at the source — the fraudster hits a wall when the lender tries to check your credit. You lift the freeze temporarily when you legitimately need to apply for credit.

Importantly, a freeze doesn't touch your existing life. Your current cards keep working, your score keeps updating, you can still check your own reports, and existing lenders, insurers, and employers doing background checks can generally still see what they need. The only thing that stops is the one thing you want stopped: a stranger opening new credit with your Social Security number.

How to set it up

1. Go to the websites of all three credit bureaus: Equifax, Experian, and TransUnion. You need to freeze at all three — they don't share.
2. Create an account at each. Expect a security verification process.
3. Place a freeze on each report. It's free under federal law since 2018.
4. Save your PIN or login for each in a password manager — you'll need them to temporarily lift the freeze later.

What a freeze doesn't cover

A freeze stops new-account fraud — the most damaging category — but identity theft has other lanes. It won't stop charges on your existing cards (your issuer's fraud protection and your transaction alerts handle that), a tax refund filed in your name (an IRS Identity Protection PIN handles that), someone hijacking your phone number to intercept verification codes (a carrier port-out PIN handles that), or fraud against your bank account (alerts and strong unique passwords handle that). Think of the freeze as the deadbolt on the most valuable door, not a force field around your whole identity.

The neighbor's story also explains why breach settlements offering 'free credit monitoring' feel so unsatisfying: monitoring would have told him about the fraudulent accounts a little sooner, but only the freeze would have prevented them. Detection is a consolation prize. Prevention was free the whole time.

The rest of the free fraud stack

• Transaction alerts on every card and bank account — a push notification per charge is the fastest fraud detector that exists.
• An IRS Identity Protection PIN, which stops fraudulent tax filings in your name — free at irs.gov.
• A port-out PIN with your mobile carrier, so your number can't be moved to a fraudster's SIM to intercept your two-factor codes.
• Freezes for your kids: child identity theft often runs undetected for a decade. All three bureaus will create and freeze a minor's file on a parent's request.
• A password manager and two-factor authentication on financial accounts — most account takeovers start with a reused password, not a sophisticated hack.

Who should freeze — and when

The short answer is nearly everyone, nearly always. If your Social Security number has ever been in a breach — and after the major breaches of the last decade, statistically it has — the raw material for new-account fraud is already circulating. The freeze costs nothing, doesn't expire, and the only ongoing price is a few minutes of thawing before each credit application. The people who benefit most are exactly the people least likely to have one: older adults (prime fraud targets), children (whose clean SSNs can be exploited for years undetected), and anyone who doesn't plan to apply for credit soon, since they pay the thaw friction approximately never. The main group who might reasonably wait: someone actively rate-shopping a mortgage across many lenders over several weeks, who can simply freeze after closing.

When to lift

Lifting is fast — usually takes minutes through the bureau website. You can lift it temporarily for a specific period or specific creditor. Just remember to re-enable when you're done. This small friction is the whole reason it works — it forces a conscious moment before any new credit request.

One practical tip: when you're about to apply for something, ask the lender which bureau they pull. Many use only one, so you can thaw just that bureau for a few days instead of unlocking all three. For a mortgage, expect to thaw all three. And schedule the thaw with an automatic re-freeze date so you never have to remember.

The bottom line

Identity theft protection is mostly sold as a subscription and mostly available as a law. The freeze is free, permanent until you say otherwise, and blocks the most expensive category of fraud outright — while locks and paid monitoring offer weaker versions of the same idea at a markup. Spend twenty minutes freezing all three bureaus, save the logins in a password manager, layer on the free alerts and PINs, and you've done more for your identity than any $25-a-month plan will.