Three Shields, Three Functions: Matching Security Freezes, Fraud Alerts, and Credit Locks to the Right Consumer Situation

When a consumer suspects identity theft or wants to limit access to their credit file, they typically hear about three protective tools: security freezes, fraud alerts, and credit locks. In practice, these terms get used interchangeably — by consumers, by customer service representatives, and sometimes even in compliance documentation. That imprecision creates real risk. Each tool operates under different legal frameworks, carries different obligations for consumer reporting agencies (CRAs), and is appropriate for different situations. CFCRP professionals who understand the distinctions are better equipped to conduct accurate audits, support compliant consumer-facing communications, and spot process gaps before they become regulatory problems.

Security Freezes: The Statutory Tool With the Strongest Protections

A security freeze — sometimes called a credit freeze — is a right established under the FCRA, primarily through provisions added by the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018. When a consumer places a security freeze with a CRA, the agency is generally prohibited from releasing the consumer's credit report to third parties for credit-granting purposes without the consumer's explicit authorization to lift or temporarily thaw the freeze.

Key compliance points about security freezes:

• Free for all consumers. CRAs must provide, place, temporarily lift, and remove security freezes at no charge.
• Time requirements apply. CRAs must place a freeze within one business day of receiving a request by phone or online, and within three business days for written requests. Temporary lifts have similarly defined timeframes.
• Scope has limits. A freeze does not block all file access. Certain permissible purposes — such as existing account review, collection activity, government requests, and some employment or insurance uses — may still allow access depending on the situation.
• Minors and protected consumers. The FCRA also includes provisions allowing parents or guardians to place freezes on behalf of children under 16 and other protected consumers.

Because a security freeze is a federal statutory right, its requirements are non-negotiable for covered CRAs. Auditors reviewing CRA freeze processes should confirm that placement, lift, and removal timelines are being tracked and met, and that consumers are not being charged fees.

Fraud Alerts: Notice to Creditors That Something May Be Wrong

A fraud alert is also an FCRA-based right, but it works very differently from a freeze. Rather than blocking access to a consumer's file, a fraud alert flags the file so that any creditor who pulls it is required to take reasonable steps to verify the applicant's identity before extending credit.

There are three types of fraud alerts under the FCRA:

1. Initial fraud alert: Lasts one year. Available to any consumer who believes they may be or are about to become a victim of fraud or identity theft. No police report or documentation is required.
2. Extended fraud alert: Lasts seven years. Available to consumers who have already been victims of identity theft and can provide an identity theft report. Triggers additional protections, including removal from prescreened offer lists for five years.
3. Active duty alert: Available to active duty military members. Lasts one year and also triggers removal from prescreened offer lists during that period.

When a consumer places a fraud alert with one of the three nationwide CRAs (Equifax, Experian, TransUnion), that CRA must notify the other two, which are then required to place their own alerts. This pass-through obligation is an important compliance checkpoint — audit procedures for fraud alert workflows should verify that cross-bureau notification is occurring as required.

Credit Locks: A Contractual Product, Not a Statutory Right

Unlike freezes and fraud alerts, a credit lock is not defined or mandated by the FCRA. It is a product offered by CRAs and some third-party services that allows consumers to quickly lock and unlock access to their credit file — typically through a mobile app or online portal. The convenience factor is the primary selling point.

From a compliance perspective, credit locks require careful attention:

• No federal floor. The terms, conditions, and protections of a credit lock are governed by the contract between the consumer and the CRA — not by statute. This means protections can vary and may be subject to change.
• Fees may apply. Unlike security freezes, credit locks are often offered as part of a paid subscription or bundled service, though some CRAs offer basic versions at no cost.
• Not equivalent to a freeze. Consumer-facing materials that treat locks and freezes as the same thing are potentially misleading. CFCRP professionals reviewing disclosures or consumer education content should flag any language that conflates the two.

Practical Takeaways for CFCRP Professionals

1. Audit freeze timelines rigorously. The FCRA's placement and lift requirements for security freezes are specific. Build these timeframes into your compliance monitoring calendar and confirm that systems are logging request timestamps accurately.
2. Verify cross-bureau fraud alert notification. When auditing fraud alert workflows, confirm that the CRA receiving the initial request has a process to notify the other two nationwide CRAs — and that notification is actually occurring, not just documented as a policy.
3. Review consumer-facing language for accuracy. If your organization or a client produces educational content, disclosures, or FAQs that describe these tools, check that freezes, fraud alerts, and credit locks are described distinctly and accurately. Conflation is a common and correctable error.
4. Know the scope exceptions for freezes. A consumer who has placed a freeze may still be confused when a creditor accessed their file for an existing account review or collection purpose. Compliance teams should be prepared to explain why certain access types are still permissible after a freeze is placed.
5. Treat credit locks as contract review territory. When evaluating a CRA's or third-party vendor's lock product, review the terms of service — not just FCRA requirements. The consumer protections are only as strong as the contract, and those terms can change.

This article is provided for educational purposes only and is intended to support the professional development of CFCRP students and Certified FCRA Professionals. It does not constitute legal advice and should not be relied upon as such. Compliance questions involving specific facts or circumstances should be directed to qualified legal counsel.

Last updated: October 10, 2026 · Published by the FCRA Professional Institute