How to freeze your credit and protect yourself from identity theft

A credit freeze is the strongest free step US consumers can take against new-account identity theft: while it is on, nobody can open a new credit account in your name, and it costs nothing to place or lift. The FTC says it does not affect your credit score and that anyone can place one, any time, without waiting for a breach. A freeze does not protect everything, though. It will not stop someone using your existing cards, filing a tax return in your name or taking over a bank account. The UK, Australia and EU have different tools, covered below.

What a credit freeze does and does not do

A freeze restricts access to your credit report. Lenders usually check your report before they open a new account, so if they cannot see it, they generally cannot approve new credit. The FTC says a freeze blocks new accounts for everyone, including you, which is why you lift it before you apply for credit, rent a home, buy insurance or take a job that needs a credit check.

What it does not do:

• It does not stop fraud on accounts you already have, such as someone using your card number.
• It does not stop a thief filing a tax return with your Social Security number. That is what an IRS IP PIN is for.

The FTC’s own list of identity theft risks also includes tax refund theft, getting medical care in your name and pretending to be you if arrested, which are not about opening new credit accounts. Combine the freeze with the other steps below.

How to freeze your credit in the US

1. Contact all three bureaus. The FTC says to place a freeze with Equifax, Experian and TransUnion. The IdentityTheft.gov credit bureau contacts page lists how to reach each one.
2. Verify your identity when asked, and keep the confirmation and any login details the bureau gives you.
3. Leave it on. The freeze lasts until you lift it.
4. To lift it, lift only what you need. The FTC suggests asking the lender which bureau it will use, lifting at that one, and putting the freeze back when the credit check is done.

You can also freeze your child’s credit if the child is under 16, according to the FTC, though the process is different from an adult’s.

Fraud alerts: how they differ

A fraud alert asks businesses to verify your identity before opening new credit. Unlike a freeze, it does not stop them seeing your credit report. Per the FTC:

• Initial fraud alert: for anyone who is or suspects they may be affected by identity theft. It lasts one year, can be renewed, and is free. You contact one bureau, which must tell the other two. It also entitles you to a free report from each bureau.
• Extended fraud alert: for people who have experienced identity theft and have filed an FTC identity theft report or police report. It lasts seven years, and also takes you off marketing lists for unsolicited credit and insurance offers for five years.
• Active duty alert: for servicemembers. It lasts one year and can be renewed for the length of a deployment.

You can have an alert on top of a freeze. If you are only worried and have not been a victim, a freeze is simpler and stronger. If you are an identity theft victim, the alert gives extra benefits like a free report and the seven-year option.

Check your credit reports

The FTC says all three bureaus have permanently extended a program that lets you check your report from each bureau once a week for free, and that federal law also gives you one free report every 12 months. The only authorised site is AnnualCreditReport.com. The FTC warns that imposter sites exist and that neither AnnualCreditReport.com nor the bureaus will email you asking for your Social Security number.

Look for accounts you do not recognise, unfamiliar addresses, and enquiries you did not make. The FTC lists other warning signs as well: bills that stop arriving (a possible change-of-address), charges or bills you do not expect, and bank withdrawals you did not make. If you spot something wrong, move to the recovery steps below.

What to do if your identity is stolen

The FTC says to report it at IdentityTheft.gov, which gives you a free personal recovery plan, lets you track progress, and prints pre-filled letters and forms for credit bureaus, businesses and debt collectors. It covers more than 30 types of identity theft and what to do after a data breach. You can report by phone in other languages on 877-438-4338 (press 3).

In practice, the sequence is:

1. Report at IdentityTheft.gov and follow your plan.
2. Freeze your credit at all three bureaus, and consider an initial or extended fraud alert.
3. Pull your reports and dispute anything fraudulent.
4. Tell the bank or card issuer about any fraudulent transactions.
5. Get an IRS IP PIN if you have not already.

Add an IRS Identity Protection PIN

An IP PIN is a six-digit number that prevents someone else filing a federal return using your SSN or ITIN. It is known only to you and the IRS. Anyone with an SSN or ITIN who can verify their identity can enrol, even if they are not required to file. The IRS says the fastest way is through your online IRS account.

A few points from the IRS:

• The IP PIN is valid for one calendar year and a new one is generated each year.
• You must use it on any federal return you file that year, including prior-year returns.
• An incorrect or missing IP PIN causes an e-filed return to be rejected, or a paper return to be delayed.
• The IRS will never ask for your IP PIN. A call, email or text asking for it is a scam.

This protects your refund, which is covered in more detail in our guide to tax refunds and withholding.

Credit monitoring and identity theft insurance

The FTC says credit monitoring services usually charge a monthly or annual fee and can notify you about new accounts, inquiries, late payment reports and changes to your personal information. They will not alert you when someone withdraws money from your bank account or uses your SSN to file a tax return. Most identity monitoring services also won’t alert you to tax refund theft or misuse of benefits. Before paying, remember that you can check your credit reports weekly for free.

Identity theft insurance, the FTC says, may cover out-of-pocket costs like copying, postage, notarising, lost wages and legal fees, but it generally will not reimburse money scammers stole. Ask about deductibles and exclusions before you buy. Some of these services come bundled with a bank, credit card, employer benefit or insurance policy, so check what you already have.

Everyday protection habits

The FTC’s guidance boils down to a short list:

• Use strong passwords and turn on two-factor authentication where offered.
• Do not give personal information to anyone who calls, emails or texts you. The IRS, your bank and your employer will not ask for your SSN that way.
• Before giving your Social Security number to anyone else, ask why they need it, how they will protect it, whether another identifier would work and whether the last four digits would do.
• Keep Social Security and Medicare cards and financial records safe, and shred documents before throwing them away.
• Take statements out of the mailbox promptly.

If you are in the UK

The UK has no equivalent to the US freeze in the sources we checked. Instead:

• Cifas Protective Registration costs £30 for two years. It places a warning flag in the National Fraud Database so that member organisations carry out extra identity checks. It does not affect your credit score, but genuine applications may take slightly longer. It is not insurance, it does not cover existing card transactions, there is no expiry email, and you must reapply to renew. Each person applies separately.
• Notice of Correction: this free password can be added to your credit report. Anyone applying for credit in your name, including you, must give it.
• Credit reference agency fraud alert: the government advice says this has a cost.
• Check your credit report: the free check with Equifax, Experian and TransUnion will not affect your score. Report mismatches to the credit reference agencies.
• Report it: use the Report Fraud service (reportfraud.police.uk or 0300 123 2040), which replaced Action Fraud on 4 December 2025. Also contact your bank, change passwords and PINs, and report lost documents to the issuer.

If you are in Australia

Australia calls the freeze a credit ban. The OAIC says that if you have been or are likely to be the victim of fraud, you can request a ban, and that you should ask all three credit reporting bodies. The OAIC page links to application forms at Equifax, Experian and illion, while IDCARE’s fact sheet names Equifax and Experian, so check which bodies hold a file on you.

• The ban lasts 21 days after you first request it.
• During the ban the credit reporting body must not use or disclose your report, with limited exceptions, and it will tell a credit provider about the ban if one asks.
• It must tell you at least five business days before the ban ends. It must extend the ban if it believes you have been or are likely to be a fraud victim, and there is no limit on how often you can extend.
• Requesting a ban or an extension is free.
• You can ask one body to pass your request to the others.
• A ban may make applying for credit harder, and IDCARE says it does not affect existing credit lines unless credit is due for renewal.

IDCARE advises applying for an extension at least 10 days before the initial ban ends, and says a 12-month extension may be requested. It also says you may be asked for a police report number or a cyber.gov.au report number. IDCARE’s individual helpline is 1800 595 160. You can get a free report from a credit reporting body once every three months, according to the OAIC.

If you are in the EU

We did not find an EU-wide credit freeze in the official sources. Credit bureaus and fraud reporting are organised nationally, so look at your own country’s rules. What applies across the EU is the GDPR. The European Commission says you can ask an organisation for a free copy of the personal data it holds, ask for inaccurate data to be corrected (in principle within one month), and complain to your national Data Protection Authority. If a breach is likely to put you at high risk, the organisation must tell you. The Commission’s own example for rectification involves a credit bureau holding wrong information.

Worked example

Illustration only. Alex, in the US, gets a letter saying a company that held his Social Security number was breached. The table below shows a sensible first week, using the steps above.

Six weeks later Alex applies for a car loan and the lender says it checks TransUnion. Alex lifts the freeze at TransUnion only, then puts it back afterwards. The other two bureaus stay frozen.

If Alex were in Australia, the timeline is date-driven. A ban requested on day 0 ends on day 21. Because IDCARE recommends asking for an extension at least 10 days before it ends, Alex should ask by day 11 (21 minus 10). That timing is an illustration based on IDCARE’s recommendation, not a legal deadline.

If you are applying for a mortgage, lift the freeze at the right bureau before the lender runs its check. Our home buyer guide covers how the process works. For another common situation where credit checks matter, see how buy now, pay later products use them.

Common mistakes

1. Freezing at only one bureau. The FTC says to contact all three.
2. Assuming a freeze blocks every kind of fraud. It does not stop tax refund theft or use of existing accounts.
3. Paying for something you can do free. A US freeze is free, and weekly reports are free at AnnualCreditReport.com.
4. Using imposter “free credit report” sites. Use only AnnualCreditReport.com.
5. Forgetting to lift the freeze before applying. Lift it at the right bureau first, then re-freeze.
6. Losing the PIN or login. Keep the details the bureau gives you somewhere safe.
7. Sharing your IP PIN. The IRS never asks for it.
8. Letting a UK or Australian protection lapse unnoticed. Cifas gives no expiry email, and Australian bans end after 21 days unless extended.

Frequently asked questions

Does a credit freeze hurt my credit score?

No. The FTC says placing or lifting a freeze does not affect your credit score.

How much does a credit freeze cost in the US?

Nothing. The FTC says there is no cost to place or lift one.

What is the difference between a freeze and a fraud alert?

A freeze stops new accounts being opened by blocking access to your report. A fraud alert asks lenders to verify your identity, but they can still see your report.

How long does a freeze last?

In the US, until you lift it. A US initial fraud alert lasts one year and an extended one seven years. In Australia, a credit ban lasts 21 days unless extended. A UK Cifas registration lasts 24 months.

Can I freeze my child’s credit?

In the US, the FTC says yes, if the child is under 16, and the process differs from an adult’s.

Do I need credit monitoring if I have a freeze?

Not necessarily. Monitoring tells you about changes on your reports but does not block anything, and it will not alert you to bank withdrawals or tax return fraud. Weekly free reports are available in the US.

Sources

1. FTC: Credit Freezes and Fraud Alerts
2. FTC: What To Know About Identity Theft
3. FTC: Free Credit Reports
4. IdentityTheft.gov: report identity theft and get a recovery plan
5. IdentityTheft.gov: credit bureau contacts
6. AnnualCreditReport.com (the only authorised site for free US credit reports)
7. IRS: Get an identity protection PIN
8. Report Fraud (UK): Identity fraud and identity theft
9. GOV.UK: Report Fraud, new service from City of London Police
10. Cifas: Protective Registration
11. OAIC (Australia): Fraud and your credit report
12. OAIC (Australia): Access your credit report
13. IDCARE: Credit bans, Australia
14. European Commission: Information for individuals (GDPR rights)