In 2025 the Identity Theft Resource Center tracked 3,322 data compromises, the most in the twenty years it has been counting, and 80 percent of the consumers it surveyed had received a breach notice in the previous twelve months. Understanding how credit freezes work matters because of that second number, not the first.
Start with the scale, since it shapes what a freeze is up against. Those 3,322 compromises produced 278,827,933 victim notices. Divide one by the other and the average breach in 2025 reached roughly 84,000 people. Run the same arithmetic on 2024, when 1,367,117,021 notices went out across 3,152 compromises, and the average was about 434,000 apiece. More incidents, each one smaller. The mega-breach receded and a steady drizzle took its place.
The standard response to that letter is to freeze your credit, and it’s good advice. It’s also narrower protection than most people think they’re getting. Understanding how credit freezes work at the mechanical level tells you precisely where the edges are, and the edges are closer in than the advice suggests.
A freeze operates on a lookup, not on your money
Picture what happens when someone applies for a credit card in your name. The lender doesn’t reach into your accounts or query some central registry of you. It sends a request to a credit bureau, asking for the file filed under your Social Security number. The bureau returns your report, the lender scores it, and a decision comes out the other end.
A security freeze interrupts exactly one step of that: the bureau’s ability to release the file. It does not touch the application, the lender, or any account you already have. Your report sits there, still accurate, still updating, simply unavailable until you say otherwise.
That is the whole mechanism, and once you see it, the gaps become obvious rather than surprising. Any fraud that doesn’t require pulling your credit file walks straight past a freeze, because there’s nothing in its path to stop.
How credit freezes work when a lender actually pulls your file
The rights involved come from the Fair Credit Reporting Act, specifically 15 U.S.C. 1681c-1, which was substantially expanded by federal legislation in 2018. Before that, freezes were governed by a patchwork of state laws and most states let bureaus charge a fee, often around $10 per bureau per action. Placing and lifting a freeze three times in a year of house hunting could cost real money, which is roughly why hardly anyone did it.
Since September 2018, freezes are free nationwide, at every nationwide credit bureau, to place and to lift. The FTC’s guidance states plainly that there is no cost either way and that a freeze does not affect your credit score. The score is a calculation run on the file. Blocking access to the file doesn’t change what’s in it.
A freeze also lasts until you lift it. There’s no annual renewal, no expiration. And because each bureau maintains its own separate file on you, freezing at Equifax does nothing at Experian or TransUnion. You have to do it three times.
When you need credit, you lift the freeze. The useful trick is to ask the lender which bureau it pulls, then thaw only that one, either for a set window or until you refreeze. Most people thaw all three and forget to put them back.
Fraud alerts do something weaker, and that’s sometimes the point
A fraud alert is often mentioned in the same breath as a freeze, which obscures how different they are.
An alert doesn’t block anything. Your report still goes out. The alert rides along with it, telling the lender to verify your identity before granting credit. Whether that verification is a phone call to you or a shrug depends on the lender.
What separates the three types is mostly how long they last and what you have to prove to get one. Anyone who suspects they’ve been caught up in identity theft can place an initial alert, good for a year. The seven-year extended alert costs you more paperwork, since it requires an identity theft report filed at IdentityTheft.gov or with police, and it pays you back by pulling you off prescreened credit and insurance marketing lists for five years. Servicemembers on active duty get their own one-year version. One detail runs against the grain of everything else here: you contact a single bureau and it is required to notify the other two, the exact opposite of how freezes work.
So the two tools aren’t redundant, which is the argument for running both. The freeze blocks, the alert flags. The day you lift the freeze to apply for a car loan, the alert is the thing still standing there.
The bureaus you’ve never heard of keep files on you too
Equifax, Experian, and TransUnion are the nationwide consumer reporting agencies, but they are not the only companies keeping a reportable file on you. Specialty consumer reporting agencies collect narrower slices of behavior and sell them to industries the big three don’t serve well.
ChexSystems holds banking history: closed accounts, unpaid overdrafts, check-writing problems. When you try to open a checking account, that’s usually the file being pulled, not your credit report. The National Consumer Telecom and Utilities Exchange, run by Equifax, holds utility and telecom account data, which is what an electric company or wireless carrier checks before opening service. LexisNexis Risk Solutions and SageStream feed insurance underwriting and identity verification. Innovis functions as a fourth credit bureau that many people have never heard of.
Each of these accepts a free security freeze, requested separately. Which means the widely repeated instruction to freeze all three bureaus leaves you with three of seven or so relevant files locked. If someone opens a wireless account or a checking account in your name, the three-bureau freeze was never in the way.
What a freeze cannot reach at all
Then there’s the category no freeze of any kind addresses, because no credit file gets pulled.
Account takeover is the big one. If a thief has your existing card or login, they don’t need new credit. They change the email address and phone number on the account and start spending on a line you already opened. The ITRC’s survey found that 40 percent of people who received a breach notice reported an attempted takeover of an existing account. Tax refund fraud requires only your Social Security number and a filed return. Medical identity theft uses your insurance, not your credit. Employment fraud, retirement account raids, and synthetic identities built from a real Social Security number and invented details all route around the bureaus entirely.
Every one of those attacks works fine against a person whose credit is frozen at all three bureaus, because none of them ever asks a bureau for anything. They’re stopped by other things entirely: passkeys or unique passwords on financial logins, an Identity Protection PIN from the IRS, transaction alerts switched on everywhere, and the unglamorous habit of reading the explanation of benefits your insurer mails you instead of filing it unopened.
Where this leaves you
Freeze all three nationwide bureaus, then spend another twenty minutes on ChexSystems, NCTUE, Innovis, LexisNexis, and SageStream. It’s free at every one of them and it stays in place until you decide otherwise.
But hold the right expectation about what you bought. Understanding how credit freezes work means understanding that you’ve made your credit file unreadable to strangers, and nothing more than that. It’s a meaningful protection with a precise edge. The fraud that doesn’t need your file will not notice you did anything at all. If you want to see what’s actually in the file you just locked, our walkthrough on reading your credit report covers what each section means, and our piece on check washing covers one of the older fraud routes that never touches a credit bureau either.