Published July 6, 2026 · Educational information — not legal, tax, lending, or financial advice.
Quick answer
A fraud alert leaves your credit file open but asks lenders to take extra steps to verify your identity before approving new credit — one bureau, one request, and that bureau tells the other two. A credit freeze goes further: it blocks new-credit access to your file entirely, so applications die at the credit check until you thaw — placed at each bureau separately. Both are free by federal law, and neither touches your score. Rough rule: alert for suspicion and convenience, freeze for maximum blocking, both after confirmed identity theft. Guard at the door, or lock on the door — and nothing stops you from having both.
The two tools, side by side
Both tools exist for the same reason: most credit fraud runs through a new application, and a lender pulling the applicant’s file is the choke point where it can be stopped. They differ in how hard they squeeze. The fraud alert is a note attached to your file — the file stays visible, applications still process, but the lender is asked to take reasonable steps to confirm the applicant is actually you (often a call to a phone number you provide) before extending credit. The freeze removes the file from view for new-credit purposes altogether; there is nothing to verify because there is nothing to pull. Placement differs the same way: one alert request covers all three bureaus, while a freeze must be placed at Equifax, Experian, and TransUnion separately — the same separate-files reality behind why your three credit scores are different. Neither one costs anything, and neither affects your score, your existing accounts, or your ability to check your own credit.
How a fraud alert works
You contact one bureau (online is fastest), request the alert, and provide a contact number; that bureau is required to notify the other two, so the alert lands on all three files from a single request. From then on, when a lender pulls your file for a new application, the alert asks them to take reasonable steps to verify identity before approving — in practice, often calling the number on the alert or requesting additional documentation. That’s both the strength and the limit: it adds friction for a fraudster without closing the door for you, but it relies on the lender’s verification actually happening and being rigorous, which the alert requests rather than guarantees. It also does nothing about pulls that aren’t new-credit applications, and it doesn’t notify you of activity — the hard pull still lands on your file, where you’d spot an unfamiliar one the way described in soft inquiry vs. hard inquiry.
The three fraud alert types
The initial alert is the general-purpose one: anyone who suspects they are or may become a fraud victim can place it, it lasts about one year, and it can be renewed. The extended alert is the heavyweight: available to documented identity-theft victims who file an identity theft report (typically through IdentityTheft.gov), it lasts seven years, asks lenders to contact you before opening new credit, and removes you from prescreened credit and insurance offers for five years. The active-duty alert covers deployed servicemembers — about a year at a time, renewable for the deployment, with the prescreen opt-out included. All three are free, none affects your score, and each is a one-bureau request that propagates to the other two.
How a freeze works (briefly)
The freeze story is told in full in how to freeze your credit, but the short version matters for the comparison: placed separately at each bureau, free by federal law, it blocks release of your file for new-credit purposes until you thaw it — permanently or for a temporary window, with online thaw requests generally taking effect within an hour. Existing accounts, self-checks, monitoring, and your score are all untouched. The freeze’s strength is that it doesn’t depend on any lender’s diligence: the application fails at the file pull, full stop. Its cost is the small ongoing chore of thawing whenever you legitimately need new credit, plus keeping track of three sets of credentials.
Which to use when
Choose by two questions: how strong does the protection need to be, and how often will you apply for credit? If you got a breach notice, noticed something slightly off, or just want a layer of caution while actively shopping for a mortgage, auto loan, or cards, the initial alert fits — one request, no thawing, applications proceed with extra verification. If you apply for credit rarely and want the strongest available block — which describes most people most of the time — the freeze is the better default, opened for an hour when needed. The honest asymmetry: the freeze is categorically stronger protection, while the alert is categorically lower maintenance. Neither replaces watching the file — both tools work silently, and it’s report review and monitoring that tell you what’s actually happening, on the cadence in how often should you check your credit report.
Stacking them after identity theft
After confirmed identity theft, the standard playbook uses both, because they cover each other’s gaps. The freeze closes the file to new-credit pulls. The extended alert (with the identity theft report filed) guards the moments the freeze can’t: any window you thaw to apply for something yourself, plus lenders working from information pulled before the freeze landed — and it keeps working for seven years without renewal. Alongside the pair: read all three reports closely for accounts and inquiries you don’t recognize, dispute anything fraudulent, and keep monitoring running so its credit alerts surface changes quickly. The freeze is the lock, the alert is the guard, and monitoring is the camera — three different jobs, no conflicts between them.
Two real-world examples
The mortgage shopper with a breach letter. Dana is three months from house hunting when a breach notice arrives. A freeze would work, but she’s about to have multiple lenders pulling her file on short notice, so she places an initial fraud alert instead — one online request, ten minutes, all three bureaus covered. Her preapprovals proceed with an extra verification call apiece, mildly annoying and exactly the point. After closing, with no borrowing on the horizon for years, she switches strategies: freezes all three bureaus and lets the alert lapse. Same person, both tools, chosen by season.
The confirmed victim. Luis finds two cards on his report he never opened. He files an identity theft report, disputes the fraudulent accounts, freezes all three bureaus, and places the seven-year extended alert. Months later, financing a car, he thaws one bureau for a three-day window — and during that window, the extended alert is still on duty, so the lender contacts him to confirm the application is his before approving. It is, and it’s the only one that gets through. The freeze handled the years; the alert handled the hour the door was open.
Key takeaways
- A fraud alert asks lenders to verify identity; a freeze blocks new-credit access entirely — both free, neither touches your score.
- Alerts propagate: one bureau notifies the other two. Freezes don’t: place all three separately.
- Three alert types: initial (~1 year, anyone), extended (7 years, documented victims), active-duty (~1 year, deployed servicemembers).
- Rule of thumb: alert while actively applying, freeze while not, both after confirmed identity theft.
- Neither tool alerts you to activity — report review and monitoring are the visibility layer.