Every data breach letter arrives with an offer of free credit monitoring, and almost none of them mentions the measure that would actually prevent somebody opening an account in your name. That is not a conspiracy. Monitoring is a product somebody sells, a security freeze is a right somebody has to provide at no charge, and organizations tend to recommend the things they can offer rather than the things they merely have to permit. The consequence is that the strongest tool available to a household is also the least mentioned.
Freeze, Alert, Lock, and Monitoring Are Four Different Things
A security freeze restricts access to your credit file, which means a lender running a check on a new application cannot see it and will decline the application rather than approve it blind. That is the entire mechanism and it is why the freeze works: new credit almost always requires a file to be pulled, so a file that cannot be pulled cannot support a new account. It is free to place, free to lift, free to remove, and required to be so under federal law.
A fraud alert is different and weaker, asking lenders to take extra steps to verify identity rather than preventing access outright, and it expires after a period. A credit lock is a product offered by the bureaus themselves that does something similar to a freeze under contractual terms rather than statutory ones, sometimes bundled with paid services. Monitoring does not prevent anything at all; it tells you afterward that something happened, which is genuinely useful and is a different function entirely. The four are frequently discussed as though they were four strengths of the same product, and they are not, which is why somebody who has enrolled in monitoring after a breach often believes they have done the protective thing and has in fact done the observational one.
What a Freeze Does Not Cover
The protection is specific and it helps to know its edges. A freeze does nothing about your existing accounts, so a stolen card number is still a stolen card number and account takeover of a bank login is unaffected. It does not prevent tax identity theft, where somebody files a return in your name, which is addressed by a separate identity protection number issued for that purpose. It does not stop medical identity theft, and it does not stop somebody using your details to claim unemployment benefits.
It also has to be placed at each of the three major bureaus separately, because a lender may pull from any one of them and a file frozen at two out of three leaves an open route. There are additional smaller specialty bureaus used for particular products, and thorough households freeze those too, though the three main ones cover the overwhelming majority of consumer lending decisions. The practical consequence is that this is one task done three times rather than one task, and stopping after the first bureau because the process was tedious leaves most of the exposure in place.
What Placing One Actually Involves
Each bureau takes about ten minutes online, requires identity verification with details from your own credit history, and issues a PIN or establishes an account login used to lift the freeze later. Online and telephone requests must be actioned quickly under the statute, generally within a day for placement, and lifting a freeze requested online or by phone is required to happen within an hour. It can be lifted temporarily for a defined window or for a specific creditor.
The credentials are the part that matters and the part people lose. Whatever PIN or login each bureau issues needs to be recorded somewhere retrievable, because a household that cannot lift its own freeze at the point of a mortgage application has created an inconvenience out of a protection. A password manager entry per bureau, with the account, the PIN, and the date placed, is the whole administrative burden.
Living With One, Which Is Less Disruptive Than Expected
The common objection is that a freeze will interfere with ordinary life, and in practice it interferes on the handful of days a year when somebody applies for new credit. Existing cards keep working. Existing loans are unaffected. Credit limit increases on accounts you already hold generally do not require a new pull. Employment screening and rental applications sometimes do, which is worth knowing before a move. The friction is real and small, and it compares favorably with the alternative, which is discovering an account opened eighteen months ago and then spending the following year proving it was never yours. That comparison is the whole case for the measure, and it is the one nobody makes on your behalf because there is nothing at the end of it to sell.
The mechanics are worth rehearsing once before they matter, because the moment a household needs to lift a freeze is usually the moment somebody is waiting on an answer. A car dealer, a mortgage broker, or a landlord will tell you which bureau they pull from if you ask, and lifting only that one is faster and leaves the other two in place. Where they cannot say, lifting all three for a short window is the safe approach and costs nothing beyond a few minutes.
Two habits make it painless. Lift for a defined period rather than removing the freeze altogether, so it reseals on its own and nobody has to remember to put it back. And do it the evening before rather than while sitting at a desk with somebody waiting, since online lifts are usually immediate but identity verification occasionally fails and falls back to a slower process that nobody wants to discover in a showroom.
Children, and the Version of This Nobody Thinks About
A child has no credit history, which makes their identity unusually attractive to misuse and unusually unlikely to be detected, since nobody checks a nine year old’s credit file and the problem surfaces at eighteen when they apply for something. Federal law requires the bureaus to create and then freeze a file for a minor at a parent or guardian’s request, and the process takes documentation rather than minutes because the file has to be created before it can be frozen. The same applies to anybody whose affairs are managed by somebody else, including an older relative under a power of attorney. Both are the cases where monitoring is least likely to catch anything, because there is no ordinary activity to compare against, and both are the cases where the preventive measure does the most work.
Where the Rules Come From, and the Rest of the Hour
The right to a free freeze, the timelines the bureaus have to meet, and the process for disputing an entry all sit in federal consumer reporting law, and the Consumer Financial Protection Bureau publishes the plain language explanations of each along with the complaint route when a bureau does not do what it is required to do. Knowing that route exists is worth more than it sounds, because the bureaus are considerably more responsive to a complaint submitted through it than to a phone call.
An hour spent on this covers more than the freeze itself. Place freezes at all three bureaus and record the credentials. Pull your own free reports and read them for accounts you do not recognize. And decide whether an identity protection number for tax filing is worth requesting, which it generally is for anybody who has already had information exposed. None of it is marketed to anybody, all of it is free, and it is the version of identity protection that prevents things rather than reporting them.