A US credit freeze takes three requests. A fraud alert takes one

One request can start a fraud alert across the three main US credit bureaus. It cannot freeze all three credit files. That small administrative difference matters: a confirmation from one company is not proof that every nationwide file has been frozen.

The Federal Trade Commission draws a clear distinction. A credit freeze restricts access to a file, making it harder for someone to open new credit in another person's name. A fraud alert leaves the file accessible but requires a lender to verify identity before granting new credit. Both are free. They are not interchangeable names for the same service.

For people with US credit records, the useful question is therefore not simply whether some form of protection is switched on. It is which protection, at which bureau, and what happens when a legitimate application needs access. These are existing US arrangements, not a newly announced rule or a system that applies automatically in other countries.

The three nationwide credit reporting companies are Equifax, Experian and TransUnion. The Consumer Financial Protection Bureau says consumers can freeze and unfreeze their records without charge, at any time, but must contact each company separately.

That is the practical catch in the word “freeze”. It describes a restriction on a particular file, not one central instruction that automatically reaches every bureau. The FTC's comparison card explicitly says to contact all three when placing a freeze. USAGov provides links to the companies' official freeze information and says requests can be made online, by phone or by mail.

The protection operates at the point where a prospective creditor wants to inspect a credit file. Lenders typically will not offer credit without that access, the CFPB explains. A freeze can therefore interfere with a genuine application as well as an attempted fraudulent one. It is an access barrier, not a lender's decision to approve or reject a borrower.

This also explains why a freeze is not a guarantee against every form of identity theft. The mechanism concerns access for new credit. It is not an account-recovery process, a refund arrangement or a way to erase information already on a report.

For an initial fraud alert, the FTC says to contact one of the three bureaus. That company has to tell the other two. The alert lasts one year and is available to someone who is, or suspects they may be, affected by identity theft.

Rather than closing access to the file, the alert tells lenders to verify the person's identity before granting new credit in their name. This is a different intervention from a freeze, which anyone can request for any reason and which lasts until it is lifted.

The distinction changes what a confirmation means. An initial fraud alert placed through one bureau is meant to be shared. A freeze placed through one bureau is not a substitute for separate requests to the other two. The description of the service matters more than a reassuring confirmation screen.

Neither the free freeze nor the initial fraud alert described by the FTC requires buying a subscription. The official guides are useful starting points because they identify the specific service and link to the relevant companies, rather than treating every credit-protection product as equivalent.

A freeze is reversible. It can be removed permanently or lifted temporarily for a period specified by the consumer. The FTC says that lifting it involves contacting any bureau a lender will use to check the file. A temporary opening is not, by itself, an instruction to remove every restriction indefinitely.

The timing rules distinguish putting a freeze in place from taking it off. According to the CFPB, a freeze requested by telephone or secure electronic means must be placed within one business day. A mailed request must be acted on within three business days after receipt.

For removal, including a temporary lift, the deadline is one hour after a request arrives by toll-free telephone or secure electronic means. By mail, it is three business days after receipt. These are the bureau's processing deadlines, not promises that a loan application will be approved within an hour or that postal delivery takes three days.

The CFPB also says the bureau must send written confirmation no later than five business days after placing the freeze, including information on removing it. The confirmation and the restriction therefore have separate clocks. Waiting for a letter is not the same thing as waiting for the file to be frozen.

A frozen file is not sealed off from everyone. The CFPB lists creditors of accounts a person already holds, certain government entities and companies hired to monitor the file among those that can still see it. Consumers can also request, see and review their own files while a freeze is in place.

The bureau says security freezes do not affect credit scores. It also notes that the federal law requiring free freezes does not apply to requests for reports for employment, tenant-screening or insurance purposes. Those qualifications matter: “frozen” is not a universal block on every use of a credit record.

Where information has already been misused to open an account or make a purchase, the FTC directs people to IdentityTheft.gov for reporting and recovery steps. Adding an access restriction does not finish that separate task.

The simplest way to keep the two protections straight is to follow the requests. A freeze involves each of the three bureaus and may need a later, deliberate lift. An initial fraud alert starts with one bureau and asks lenders to verify identity. Both can have a role, but the paperwork should say which one has actually been put in place.