Freezes and fraud alerts, and which one does what

These two get used interchangeably in conversation and are not the same thing. The difference is worth knowing before you need either.

A security freeze

15 U.S.C. § 1681c-1(i) provides for a security freeze — a restriction on the agency’s release of your file. Most new creditors cannot pull it, which is what actually stops a new fraudulent account from being opened in your name.

The statutory particulars:

• Free. No charge to place, no charge to lift, no charge to remove.
• Indefinite. It stays until you ask for it to be removed. It does not expire on its own.
• Placement: not later than 1 business day after a request made by telephone or secure electronic means; 3 business days by mail.
• Removal: not later than 1 hour after a request by telephone or secure electronic means; 3 business days by mail.

That one-hour lift is the detail that answers the usual objection. People avoid freezing because they imagine being locked out when they want to apply for something. In practice you lift it electronically and the statute gives the agency an hour.

A freeze is placed with each agency separately. Freezing at one does nothing at the other two.

A fraud alert

An alert does not block access. It flags your file so that a user is expected to take steps to verify identity before extending credit. It is a speed bump, not a wall.

Three kinds:

Initial alert — § 1681c-1(a). Available if you assert a good-faith suspicion that you have been or are about to become a victim of fraud or identity theft. The agency must include it for not less than 1 year, and must refer the information to the other nationwide agencies — so one call propagates.

Extended alert — § 1681c-1(b). Requires an identity theft report. Lasts 7 years. It also excludes you from unsolicited prescreened credit and insurance offer lists for 5 years, and entitles you to two free file disclosures during the first 12 months.

Active duty alert — § 1681c-1(c). For active duty military. Not less than 12 months, or longer as the Bureau determines, and excludes you from unsolicited offer lists for 2 years.

Choosing

Roughly:

• Nothing has happened yet, and you want it to stay that way. A freeze. It is free, permanent, and liftable in an hour.
• Something has happened and you are still working out how much. An initial alert now — it takes one call and propagates — then a freeze, which you can do at any point.
• You have an identity theft report and a real problem. The extended alert, plus freezes, plus the block route described in the four-business-day identity theft block.

Freezing and alerting are not exclusive. You can do both.

What neither one does

This is the part that catches people.

Neither removes anything already on your file. A freeze stops future access. An alert flags future users. An account already reported and already wrong stays exactly where it is, and stays wrong, until it is disputed or blocked.

Neither undoes an account already opened. If a fraudulent account exists, freezing now prevents the next one. The existing one is a dispute or a § 1681c-2 block.

A freeze does not stop everyone. Existing creditors, their agents, and various others can still access a frozen file. It is aimed at new credit.

An alert depends on the user. A creditor that ignores the flag has still seen your file.

The order most people should do things in

1. If you suspect fraud, place an initial alert — one call, propagates, buys a year.
2. Get your reports and find out what is actually on them. See building a record that holds up.
3. Place freezes at all three agencies.
4. Deal with whatever fraudulent items already exist — that is a dispute or a block, and it is a separate job from steps 1 through 3.

Whether your situation warrants any of this, and particularly whether it is identity theft in the statutory sense, is not something we assess. The mechanics above are the same for everyone.