Credit Freeze vs Credit Lock: Differences, Cost, and When to Use Each (2026)

If your Social Security number, driver's license, or other identifying information has ever appeared in a breach, you have probably been told to "freeze your credit" or to "lock your credit file." The two sound interchangeable, but they are legally and operationally different. Choosing the wrong tool can leave gaps an identity thief can drive a car loan through. This guide walks through how each option works, what it actually blocks, what it costs, how fast you can lift it, and which one fits your situation.

What a credit freeze is

A credit freeze, sometimes called a security freeze, is a legally defined restriction on your consumer credit file. Under the federal Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018, consumers in all 50 U.S. states can place and lift a freeze with each nationwide bureau at no cost. When a freeze is in place, the bureau will not release your credit report to most new creditors. That means a lender who runs a standard hard pull will not be able to approve a new credit card, loan, auto finance, or credit-based utility account in your name.

A freeze does not block existing creditors, account servicing, employers who already have a relationship with you, collection agencies working an existing debt, or soft inquiries from companies you already do business with. Pre-approved offers, insurance quotes in some states, and government agencies also have specific exceptions defined by law.

To lift a freeze, you use a PIN or your authenticated bureau account. You can thaw temporarily for a specific creditor, for a set number of days, or you can permanently remove the freeze. Bureaus are legally required to act on a lift request within one hour when it is made online or by phone, which makes modern freezes far more usable than the slow, mail-only freezes that existed before 2018.

What a credit lock is

A credit lock is a commercial product offered by each bureau, usually through an app. The user experience is similar to a freeze: you tap a button, your credit file becomes unavailable to new creditors, and you tap again to unlock it. The difference is legal. A lock is governed by the terms of the bureau's service agreement, not by statute. The bureau can change the terms, bundle the lock with paid monitoring, or discontinue the product. In some cases, the lock is only free when you also maintain another subscription.

The practical implication is that a lock works until the contract says otherwise. For many users this is fine: the convenience of one-tap locking is worth the risk. For high-risk users, long-term deployments, or anyone who wants the strongest legal backing, a freeze remains the safer default.

Freeze vs lock: side-by-side

When to choose a freeze

Choose a freeze when you want the strongest legal protection, when you do not plan to open new credit frequently, when you want a plan you can document for a spouse or elderly parent, when you want to protect a child's file, or when you have already been affected by a breach involving SSN, date of birth, or driver's license data. The freeze is also the right default for anyone whose identity has been stolen in the past, since monitoring alone only reports bad events after they occur.

When a lock can make sense

A lock can make sense for users who apply for credit often, want a single mobile app to manage protection, are already subscribed to a paid identity protection or monitoring product that bundles a lock, or want to avoid managing a PIN. Some users combine a freeze at two bureaus with a lock at the third if their identity protection plan bundles one. That is acceptable as long as all three bureaus are restricted in some form.

How to place a federal credit freeze at all three bureaus

What a freeze does not block

Freezes are powerful, but they are not a complete identity protection strategy. They do not block:

• Tax fraud using your SSN to file a fraudulent return. The IRS offers its own Identity Protection PIN program for this.
• Medical identity theft, which uses insurance or medical records rather than a credit file.
• Account takeover of your existing bank, email, retirement, or social accounts. Those require strong passwords, passkeys, and multi-factor authentication.
• Scams that trick you into approving a transaction, wiring money, or granting an OAuth permission. Freezes do not stop social engineering.
• Debit-side fraud, including payment fraud on existing cards. Card network rules, chargebacks, and issuer alerts cover that.
• Synthetic identity fraud when a partial SSN is combined with fabricated personal data to build a new credit identity; specialty bureau coverage and proactive monitoring help here.

Special situations

Recent SSN exposure in a breach

Place freezes at all three major bureaus immediately, then at specialty bureaus within 48 hours. File an identity theft report at IdentityTheft.gov if anything suspicious has already happened. See our companion guide on SSN exposed online for the full 24-hour, 7-day, and 30-day response plan.

Children and dependents

Most children do not have credit files, so when a bureau creates one in order to freeze it, that file is unused and locked to new activity. This is one of the highest-leverage protections a parent can set. Child freezes are free.

Elderly parents and caregivers

If you manage finances for an elderly relative, a freeze plus written documentation of the PIN location protects them against solicitations, tele-fraud, and unauthorized account opening. Keep the PIN in a shared password manager vault rather than a paper note at the house.

How locks bundle with paid services

Many identity-theft protection products include a lock or "credit monitoring with locking" feature. These can be helpful for users who want one mobile dashboard, but it is worth reading the service terms. Questions to ask:

• Is the lock legally equivalent to a statutory freeze in my state, or contractual only?
• Does the lock cover all three bureaus or only one?
• Does the product require a subscription to keep the lock active?
• What happens to the lock if I cancel the subscription?
• Does the vendor offer child locks, SSN monitoring, and dark web alerts alongside the lock?

If the lock only covers one bureau or stops working when the subscription ends, you still need freezes at the other bureaus.

Cost, fees, and renewal

Federal credit freezes are free to place, lift, and remove at all three nationwide bureaus, for all consumers, in all 50 states, for life. There is no renewal, no expiration, and no cancellation fee. Some specialty bureaus are also free, though their processes vary. Credit locks may be free at Equifax but packaged with paid identity protection bundles at other bureaus. Always confirm cost before enabling a lock.

Monitoring is still important

A freeze prevents new accounts from being opened, but a lot of fraud happens elsewhere. Complement a freeze with at least one layer of monitoring: your bank's transaction alerts, a free credit monitoring service, breach monitoring from your password manager, and dark-web alerts if you hold a paid identity protection plan. The two tools answer different questions: "can a criminal open new credit in my name?" is answered by the freeze; "is my data already being abused somewhere?" is answered by monitoring.

Frequently asked questions

Is a credit freeze or credit lock better?

A freeze is stronger for most people because it is backed by federal law, free at all three bureaus, and cannot be altered by a contract change. A lock can be a convenience upgrade on top of a freeze.

Does freezing my credit hurt my credit score?

No. A freeze does not affect your score. It only restricts who can open new credit in your name.

Can I still use my existing credit cards?

Yes. Existing cards, loans, auto-pay, and rewards continue to work. A freeze only blocks new credit inquiries.

How fast can I lift a freeze?

Within one hour for online and phone requests; three business days if requested by mail.

Do I need to freeze at all three bureaus?

Yes. Equifax, Experian, and TransUnion each maintain their own file. Freezing only one still leaves two exposed.

Should I freeze specialty bureaus too?

If you have had SSN exposure or an identity theft event, freezing Innovis, ChexSystems, NCTUE, and LexisNexis adds meaningful coverage for banking, telecom, and insurance-related fraud.

Is a credit freeze useful if I already have identity theft protection?

Yes. Monitoring alerts you after something suspicious happens. A freeze prevents the first fraudulent account from being opened. Use both.

Bottom line

Start with a free credit freeze at all three major bureaus. Add specialty bureau freezes if you have elevated risk. Layer in monitoring, MFA on your email and financial accounts, an IRS IP PIN, and a password manager that flags reused or breached credentials. A credit lock can make sense as a convenience layer, but it should not replace the freeze.