Free Credit Reports, Fraud Alerts & Security Freezes
What Is It?
Federal law — specifically the Fair Credit Reporting Act (FCRA), 15 U.S.C. Section 1681 et seq. — gives every American three powerful, completely free tools to monitor and protect their credit identity:
- Free weekly credit reports from all three major bureaus (Equifax, Experian, TransUnion) via AnnualCreditReport.com — no credit card required, no subscription
- Fraud alerts — a flag on your file that requires creditors to take extra steps to verify your identity before opening new accounts
- Security freezes — a full lock on your credit file that prevents any new creditor from accessing your report (making it nearly impossible for an identity thief to open new accounts in your name)
All three tools have been free since at least 2018, are legally mandated, and are dramatically underused. A security freeze in particular costs nothing, takes minutes to set up online, and is the single most effective tool available to prevent new-account identity theft.
How It Works
Tool 1: Free Weekly Credit Reports
The law: FCRA Section 612 (15 U.S.C. Section 1681j) requires the three major nationwide consumer reporting agencies to provide each consumer with a free copy of their credit report once every 12 months upon request. In 2020, the COVID-19 pandemic led to a temporary expansion to free weekly reports; in 2023, the CFPB made free weekly reports permanent. As of early 2026, you are entitled to one free report from each bureau every single week — 156 free reports per year across all three.
How to access: Go to AnnualCreditReport.com — the only federally authorized site for free reports. Do not use look-alike sites (annualcreditreports.com, freecreditreport.com, etc.) that may charge fees or require credit card entry. The official site has no subscription and no upsell.
What to check:
- Personal information (name, address, Social Security number — errors here may indicate fraud)
- Accounts you do not recognize (signs of new-account fraud)
- Accounts with incorrect balances, credit limits, or payment histories
- Hard inquiries you did not authorize (someone applied for credit in your name)
- Public records (judgments, liens)
Dispute process: If you find an error, you have the right to dispute it for free directly with the bureau. The bureau must investigate and respond within 30 days (or 45 days if you provide additional information). If the error is verified, the bureau must correct or delete it.
Strategy: Stagger your free weekly pulls. Check one bureau per month on a rotating basis — Equifax in January, Experian in February, TransUnion in March, then repeat. This gives you ongoing monitoring coverage without paying for a credit monitoring service.
Tool 2: Fraud Alerts
A fraud alert is a notice in your credit file that tells lenders to take additional steps to verify your identity before opening new credit in your name. There are three types:
Initial Fraud Alert (1 year)
- Who can use it: Anyone who suspects they may be a fraud victim or whose personal information has been exposed (data breach, stolen wallet, etc.). You do not need to prove fraud has occurred.
- Duration: 1 year, automatically renewable
- How to place: Contact any one of the three bureaus — that bureau is legally required to notify the other two. You only need to make one call or visit one website.
- Equifax: equifax.com/personal/credit-report-services/credit-fraud-alerts/ or 1-888-766-0008
- Experian: experian.com/help/fraud-alert/ or 1-888-397-3742
- TransUnion: transunion.com/fraud-alerts or 1-800-680-7289
- Effect: Lenders must take “reasonable steps” to verify your identity before extending credit. In practice, this typically means calling you at the phone number you provide before approving a new credit application.
- Cost: Free, always
Extended Fraud Alert (7 years)
- Who can use it: Victims of identity theft who have filed an identity theft report. You must have a copy of your identity theft report (filed at IdentityTheft.gov or with law enforcement) to place this alert.
- Duration: 7 years
- How to place: Contact any one bureau with your identity theft report documentation; that bureau notifies the others.
- Effect: More stringent than the initial alert — lenders must contact you via phone or other method you specify before approving credit. Your name is also removed from prescreened credit and insurance offer lists for 5 years.
- Cost: Free, always
Active Duty Military Alert (1 year)
- Who can use it: Active duty military members
- Duration: 1 year, renewable
- Effect: Same as initial fraud alert, plus removal from prescreened marketing offers for 2 years
Important: A fraud alert does not prevent lenders from accessing your credit report. It is a flag that requests extra verification — a determined fraudster with access to your personal information could still potentially open an account. For stronger protection, use a security freeze (below).
Tool 3: Security Freeze (Credit Freeze)
A security freeze is the most powerful consumer credit protection tool available under federal law. When a freeze is in place, consumer reporting agencies cannot release your credit report to potential new creditors — which means a fraudster cannot open a new credit card, loan, or other financial account in your name because lenders cannot pull your credit to approve the application.
The law: The Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 (Public Law 115-174) amended FCRA Section 605C to require all nationwide consumer reporting agencies to place and lift security freezes for free, upon consumer request. Before 2018, many states charged $5-$10 per bureau to place a freeze.
How to place a security freeze: You must contact each of the three major bureaus separately — a freeze at one bureau does not automatically apply at the others.
- Equifax: equifax.com/personal/credit-report-services/credit-freeze/ or 1-800-349-9960
- Experian: experian.com/freeze/center.html or 1-888-397-3742
- TransUnion: transunion.com/credit-freeze or 1-888-909-8872
Each bureau requires you to create an account or provide identifying information (name, address, date of birth, Social Security number, and in some cases a copy of a government ID). Online placement is available at all three bureaus and takes approximately 5-10 minutes per bureau. A freeze placed online or by phone must be enacted within 1 business day. A freeze requested by mail must be enacted within 3 business days.
Lifting a freeze (temporarily or permanently): When you apply for new credit, you must temporarily lift the freeze at the relevant bureau(s). You can lift it:
- For a specific date range (e.g., for 24 hours while you apply for a credit card)
- For a specific creditor
- Permanently (if you decide you no longer need the freeze)
Lifting online or by phone takes effect within 1 hour. This is the key practical advantage — the freeze does not permanently lock you out of credit; it just requires an extra step when you want to open something new.
Who else to freeze: The three major bureaus are only part of the picture. Identity thieves also target smaller specialty consumer reporting agencies. Consider also placing freezes at:
- ChexSystems (used by banks for checking account applications): chexsystems.com
- Innovis (fourth credit bureau, less commonly used): innovis.com/personal/securityFreeze
- NCTUE (National Consumer Telecom and Utilities Exchange, used by telecom and utility providers): nctue.com
- LexisNexis Risk Solutions (used for background checks, insurance): consumer.risk.lexisnexis.com
The Differences: When to Use Each Tool
| Tool | Stops new accounts? | Inconvenience to you | Best for |
|---|---|---|---|
| Free credit reports | No — monitoring only | None | Ongoing monitoring, anyone |
| Initial fraud alert (1 yr) | No — just flags lenders | Minimal | Post-data breach, suspected risk |
| Extended fraud alert (7 yr) | No — just flags lenders | Minimal | Confirmed identity theft victims |
| Security freeze | Yes — blocks report access | Minor (lift required to apply for credit) | Anyone who wants proactive prevention |
The optimal approach for most people: Place a security freeze at all three major bureaus (plus ChexSystems and Innovis) and check your free credit reports monthly on a rotating schedule. The freeze prevents the worst outcomes; the reports catch anything that slips through (such as fraud on existing accounts, which a freeze does not block).
What Most People Don’t Know
-
Weekly reports have been permanent since 2023. Many people still believe they get only one report per bureau per year. The free weekly access via AnnualCreditReport.com has been permanent since early 2023 and shows no sign of being reversed. There is no reason to pay for a credit monitoring service if free weekly access covers your monitoring needs.
-
A security freeze does not hurt your credit score. Placing or lifting a freeze has zero impact on your credit score. It does not create a hard inquiry or any negative mark. It simply controls who can access your report.
-
Existing accounts are not protected by a freeze. A security freeze only prevents new accounts from being opened. If someone has already obtained your existing credit card number, they can still use it — that is covered by your card’s zero-liability policy and FCRA dispute rights, not by a freeze.
-
You can place a security freeze on your child’s credit. Parents can place a security freeze on a minor child’s credit file — even if the child has no credit history — which creates a protected file that cannot be used. This is done through each bureau’s dedicated process for minors and requires documentation of your relationship to the child.
-
Data brokers are a separate problem. The security freeze and fraud alerts apply to credit bureaus and do not affect the data broker ecosystem (companies like Spokeo, Whitepages, Acxiom, and hundreds of others that sell your personal information). For data broker opt-outs, a separate strategy is required (see the Data Broker Opt-Out loophole in this database).
-
Fraud alerts travel with you across bureaus automatically. When you place a fraud alert at any one bureau, that bureau is legally required under FCRA Section 605A to notify the other two, who must then place the same type of alert on your file. You truly only need to make one contact for a fraud alert.
Who Benefits Most?
- Anyone who has been notified of a data breach involving their Social Security number or financial information
- Anyone who has had their wallet, Social Security card, or personal documents stolen
- High-net-worth individuals who are higher-value targets for identity theft
- Parents who want to protect their minor children’s identities proactively
- Seniors, who are disproportionately targeted by new-account identity theft schemes
- Really, every American — the protections are free, the inconvenience is minimal, and the potential harm from identity theft is severe
Legal Basis
- FCRA Section 605A (15 U.S.C. Section 1681c-1) — Fraud alerts, including initial, extended, and active duty alerts; the one-bureau placement rule; lender notification requirements
- FCRA Section 605C (15 U.S.C. Section 1681c-1(f)) — Security freezes, free of charge, and the 1-business-day placement and 1-hour lifting requirements for online/phone requests (added by the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018, Pub. L. 115-174)
- FCRA Section 612 (15 U.S.C. Section 1681j) — Free credit reports; the annual free report requirement, as extended to weekly access permanently in 2023
- FCRA Section 611 (15 U.S.C. Section 1681i) — Dispute rights; the 30-day investigation and correction requirement
- Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 (Pub. L. 115-174) — Made security freezes free nationwide and added minor children’s freeze protections
Frequently Asked Questions
If I place a security freeze, do I need to do it at all three bureaus separately?
Yes. A freeze placed at Equifax does not carry over to Experian or TransUnion — you must contact each bureau individually. This takes about 5–10 minutes per bureau online. The same rule applies when you lift the freeze: you must lift it at each bureau separately (or just the one your lender will pull from).
Will placing a security freeze hurt my credit score?
No. Placing or lifting a security freeze has zero impact on your credit score. It does not create a hard inquiry, does not show as a negative mark, and does not affect any existing accounts. It simply restricts new creditors from accessing your report.
Do I need to place a fraud alert at all three bureaus, or just one?
Just one. When you place a fraud alert at any single bureau, that bureau is legally required under FCRA Section 605A to notify the other two, who must then add the same alert to your file. One call or one online submission covers all three.
Does a security freeze protect me if someone uses my existing credit card without my permission?
No. A security freeze only prevents new accounts from being opened in your name. It does not protect existing accounts — if someone has your current card number, they can still use it. Existing-account fraud is handled through your card’s zero-liability policy and the FCBA dispute process, not a security freeze.
Can I get more than one free credit report per year now?
Yes. Since 2023, you are entitled to one free credit report from each of the three major bureaus every week — not just once per year. This means up to 156 free reports per year total across all three bureaus, all available through AnnualCreditReport.com with no subscription or credit card required.
Sources
- AnnualCreditReport.com — Official Free Report Site
- FTC Consumer Advice — Credit Freezes and Fraud Alerts
- FTC Consumer Advice — Free Credit Reports
- CFPB — What to Do If You’ve Been a Victim of Identity Theft
- Experian — Place a Fraud Alert
- TransUnion — Fraud Alerts
- Equifax — Place a Fraud Alert or Active Duty Alert
- FTC — Economic Growth, Regulatory Relief, and Consumer Protection Act
- Fair Credit Reporting Act — Full Text (FTC)