How to Freeze Your Credit, And Why It Is Not Enough on Its Own

A credit freeze is the most underused free tool in consumer protection. It takes 15 minutes, costs nothing under federal law, and is the closest thing available to making yourself immune to new credit account fraud.

A credit freeze protects your credit file only. It does nothing about the people-search sites that currently show your address, employer, relatives' names, and phone number to anyone who searches for you. A frozen credit file on top of an exposed data broker profile is like locking your front door with the windows open.

This guide covers both, the complete freeze process, and the step most guides skip.

Key Takeaways

• Credit freezes are free under the 2018 Economic Growth, Regulatory Relief, and Consumer Protection Act — any bureau advertising a paid "credit lock" product is selling an upgrade, not required for the legal protection a freeze provides
• You must freeze at all six bureaus, not just the big three — ChexSystems controls new bank accounts, Innovis is used by specialty lenders, and NCTUE controls new utility and telecom accounts
• A credit freeze does not affect your credit score, existing accounts, or ability to use current credit cards — it only blocks applications for new credit lines
• The 2024–2025 National Public Data breach exposed 2.9 billion records — a credit freeze only covers the credit fraud portion; tax refund fraud, benefits fraud, and account takeover all rely on personal profile data that data broker opt-outs address
• An IRS Identity Protection PIN is the separate step that stops tax refund fraud — the IRS does not use credit bureau data, so a frozen credit file provides no protection there
• Lifting a freeze takes minutes online — ask which bureau a lender pulls from and lift only that one, or set a date-limited window so it re-freezes automatically

What a credit freeze actually does

A security freeze instructs the three major credit bureaus, Equifax, Experian, and TransUnion, not to share your credit file with lenders who request it.

When a lender cannot pull your credit file, they cannot approve a new account application. The application gets declined even if the fraudster has your Social Security number, birthdate, and address.

What a credit freeze does not do:

• Does not protect existing accounts, your current cards and bank accounts remain vulnerable to account takeover
• Does not affect your credit score, scores are calculated independently of freezes
• Does not freeze ChexSystems, used for new bank accounts; requires a separate freeze
• Does not prevent medical identity theft, insurers use different verification systems
• Does not stop tax fraud or government benefits fraud, the IRS and SSA use their own identity verification

How to freeze your credit, the complete list

Most articles mention only three bureaus. Lenders pull from different sources depending on loan type, so freeze all of these:

The three major bureaus (all free):

• Equifax: equifax.com/personal/credit-report-services, account required
• Experian: experian.com/freeze, no prior account required
• TransUnion: transunion.com/credit-freeze, account required

The secondary bureaus (all free):

• ChexSystems: chexsystems.com security freeze, controls new checking and savings account openings
• Innovis: innovis.com security freeze, used by some specialty lenders
• NCTUE: nctue.com/consumer, controls new utility and telecom accounts

Each bureau is independent. There is no universal freeze, you must contact each one. Online freezes are typically instant or same-day. Mail-in requests take 3-5 business days.

The 2018 Economic Growth, Regulatory Relief, and Consumer Protection Act made all credit freezes free nationwide. Some bureaus advertise paid "credit lock" products, these are marketing products, not improvements over the free legal freeze.

How to lift a freeze when you need to apply for credit

When you apply for a loan or new credit card, you need to temporarily lift the freeze.

• Lift for a specific lender, ask which bureau they pull from, then lift only that bureau's freeze. Minimizes exposure.
• Lift for a specific time window, set a date range (e.g., 7 days). It re-freezes automatically.
• Lift permanently, remove entirely. You can re-freeze at any time.

Lifting a freeze takes minutes online. Plan 24 hours ahead for lenders requiring an immediate hard pull.

Why a credit freeze alone is not enough

A frozen credit file stops new account fraud. It does not stop:

• Tax refund fraud, the IRS does not use credit bureau data. An IRS Identity Protection PIN (irs.gov/identity-theft-central) prevents this.
• Government benefits fraud, state unemployment agencies and the SSA have separate identity verification systems.
• Account takeover on existing accounts, fraudsters use account recovery flows (security questions, phone verification) to access existing email, banking, or brokerage accounts.
• Medical identity theft, insurers verify identity through their own systems.

All of these fraud types rely on the same input: your personal profile, current address, phone number, employer, relatives' names, freely available on people-search sites like Spokeo, Radaris, and Whitepages.

The National Public Data breach (2024-2025) exposed 2.9 billion records from a data broker that scraped and sold personal data before failing to secure it. See the full 2026 identity theft statistics → That breach gave fraudsters not just SSNs but the complete profile data that makes account recovery bypasses, tax fraud, and benefits fraud viable. A credit freeze helps against the credit fraud portion only.

The missing step: data broker opt-outs

Removing your profile from people-search sites does not undo a breach. But it raises the cost of fraud by removing the enrichment layer that converts a partial breach record into a complete identity dossier. For the fastest address removals, the personal safety removal guide covers 24-hour opt-outs by broker.

The practical combination:

1. Freeze credit at all 6 bureaus above, stops new account fraud
2. Remove yourself from data broker databases, limits profile enrichment for tax, benefits, and account takeover fraud
3. Get an IRS Identity Protection PIN, stops tax refund fraud
4. Enable 2FA on financial accounts using an authenticator app, stops account takeover via SIM-swap

OfflistMe removes your profile from 500+ data brokers for a one-time fee. No subscription, no ongoing charges.

Credit freeze vs. fraud alert, which to choose

A fraud alert is a one-year notice on your credit file that instructs lenders to take extra verification steps before approving credit. It does not block access to your file.

A credit freeze blocks access to your file entirely.

Fraud alert: easier to manage, no need to lift for applications, weaker protection.

Credit freeze: stronger protection, minor friction when applying for legitimate credit.

For anyone who has experienced identity theft or a high-risk breach with SSN exposure, a credit freeze at all six bureaus is the right choice. If you are recovering from a breach, see the 48-hour breach action plan → for the full recovery sequence.

Frequently Asked Questions

Does a credit freeze affect my credit score?

No. A credit freeze has zero effect on your credit score, existing accounts, or ability to use current credit cards. It only affects applications for new credit lines.

How long does a credit freeze last?

Indefinitely, until you lift it. It does not expire or need renewal. Federal law eliminated the expiration rules that some states previously imposed.

Can I still use my existing credit cards if my credit is frozen?

Yes. A credit freeze does not affect existing accounts in any way.

What is the difference between a credit freeze and a credit lock?

A credit lock is a paid product from the bureaus offering similar protection with slightly faster toggle. A credit freeze is a free federal right. Consumer advocates generally recommend the free freeze over the paid lock.

Do I need to freeze my credit at all three major bureaus?

Yes. Each bureau operates independently. Freeze all three plus ChexSystems and Innovis for complete coverage.

Is a credit freeze still effective with so many data breaches?

Yes. A credit freeze is the single most effective defense against new-account fraud — the type of fraud where a criminal opens a credit card or loan in your name. In 2024, the National Public Data breach exposed 2.9 billion records including Social Security Numbers. Consumers who had credit freezes in place were protected against new account fraud using that data; those without freezes were vulnerable. A credit freeze does not protect against account takeover fraud (where criminals access your existing accounts) or tax identity theft. The IRS Identity Protection PIN program at irs.gov/identity-theft-central covers the tax fraud component separately.

The IRS Identity Protection PIN: The Missing Step Most Guides Skip

A credit freeze protects your credit file. It does not protect your tax return.

Tax identity theft works differently: a fraudster files a tax return in your name claiming a large refund before you file. Because the IRS processes the fraudulent return first, your legitimate return is rejected. Resolving tax identity theft takes an average of 18–24 months and involves significant paperwork with the IRS.

The IRS Identity Protection PIN (IP PIN) prevents this. An IP PIN is a 6-digit number added to your tax return that the IRS uses to verify that the return was actually filed by you. Without the correct IP PIN, a fraudulent return filed in your name will be rejected by the IRS system automatically.

How to get an IP PIN:

1. Go to irs.gov/identity-theft-central
2. Click "Get an IP PIN"
3. Verify your identity through the IRS's secure identity verification portal
4. Your IP PIN is generated; you will use it on every future tax return

Your IP PIN is issued annually in January. You must use the current year's IP PIN on your tax return. Store it securely — if you lose it, there is an IRS process to retrieve it, but it causes delays in filing.

The IP PIN and the credit freeze together cover the two most common forms of identity fraud using SSN data: credit account fraud and tax fraud. Neither covers government benefits fraud, a less common but growing category that the Social Security Administration handles separately.

Remove your data from people-search sites → | Read: What to Do After a Data Breach →

Option 2, One-time paid service (OfflistMe)

Cost: One-time fee

Time: 15-30 minutes to get started; no ongoing account management

Effectiveness: 500+ brokers covered in the initial sweep; no re-monitoring

OfflistMe submits opt-out requests to 500+ brokers in a single pass, for a one-time fee. No monthly charge. No re-billing. No account to manage after purchase.

What you get: the initial sweep, which is the highest-return single action. Consumer Reports found that even subscription services remove 35-68% of profiles within 4 months, the majority of that happens in the first pass. Subsequent monthly re-submissions catch incremental re-listings.

What you don't get: automated re-monitoring. Data will reappear within 60-90 days for some sites. An annual DIY re-check of your top 10 priority sites (free, about 2 hours) addresses most re-listings.

The 3-year cost comparison:

• Incogni, $95.88/year × 3 = $287.64
• DeleteMe, $129/year × 3 = $387
• Optery Extended, $99/year × 3 = $297
• OfflistMe one-time, one-time fee + ~3-5 hours/year of DIY re-checking

Even accounting for the time value of annual re-checks, OfflistMe is the more economical choice over 2-3 years for most users.

Guarantee: if it doesn't work, we refund it.

See what's included → | One-time removal detailed →

Option 3, Subscription service (for ongoing hands-off monitoring)

Cost: $8-$21/month

Time: 15-30 minutes to set up; zero ongoing effort

Effectiveness: 35-68% profile removal within 4 months (Consumer Reports); continuous re-monitoring

When a subscription makes sense:

• You're high-risk. Executives, journalists, domestic violence survivors, public officials, people for whom a leaked address is a genuine safety issue. Continuous monitoring has real safety value for these users.
• Your time is expensive. If you earn $50+/hour, paying $10/month to avoid annual re-check time is clearly rational.
• You want zero ongoing involvement. After setup, subscription services require no further thought.

Top options if you choose subscription:

• Optery, most effective per Consumer Reports; $3.25-$20.75/month; free tier available
• Incogni, most transparent coverage numbers; $7.99/month annually; NordVPN bundle option
• DeleteMe, human oversight, quarterly reports; $10.75/month annually

Full subscription service comparison →

Which option is right for you?

Complete data broker opt-out guide →

Related Guides

• What to Do After a Data Breach
• Identity Theft Statistics 2026
• FCRA and Data Brokers Explained
• Ghost Scams and AI Identity Theft in 2026
• Complete Data Broker Opt-Out Guide