Freezes and locks sound like the same thing, but they come from different laws and different companies, and offer different levels of protection. Here's what to actually use after a breach.
Another year, another headline about millions of records leaking from a retailer, hospital network, or payroll provider. If you've gotten one of those "your information may have been involved" letters in 2026, you've probably seen two options mentioned side by side: freezing your credit or locking it. They sound interchangeable. They aren't, and the difference matters more than most of those letters ever explain.
A credit freeze is a right guaranteed to you by federal law, free, at each of the three major credit bureaus (Equifax, Experian, and TransUnion). Once frozen, a bureau won't release your credit report to a new lender trying to open an account in your name, which is exactly what stops most identity theft before it starts. Freezes have no expiration date, and lifting one, temporarily or permanently, is also free and usually takes minutes online, though some requests can take up to an hour to process.
Because a freeze is a legal protection rather than a product, it works the same way no matter which bureau you use, and there's no subscription attached. The tradeoff is that you have to unfreeze manually every time you actually want a new account, a phone upgrade with a credit check, or an apartment application to go through, which means remembering to do it at all three bureaus separately.
A credit lock does roughly the same job, but it's a product sold by the bureaus themselves (often bundled into paid monitoring subscriptions) rather than a government-guaranteed right. Locks are usually toggled instantly through an app, which is the main selling point: no waiting, no separate unfreeze request. The catch is that a lock is governed by the bureau's terms of service, not federal law, so the protections and your recourse if something goes wrong are technically weaker, even though the day-to-day experience feels nearly identical.
Neither a freeze nor a lock stops you from checking your own credit score or pulling your own report; those are considered "soft" actions that don't involve a new lender. What a freeze or lock does block is a "hard" pull tied to a new account application, which is the exact moment identity thieves need to get through. If you're freezing your credit after a breach, it's a good time to also pull your full report from each bureau and scan it line by line for accounts you don't recognize.
Renata got a breach notification from her dental insurance provider in March, the kind of letter that offers a free year of monitoring and quietly hopes you'll forget about it. She decided to freeze her credit at all three bureaus that same evening, which took about twenty minutes total once she created accounts at each one. Two months later, she needed to apply for a new auto loan, and had to remember to unfreeze at all three bureaus a day in advance so the dealership's financing partner could actually pull her file.
Her coworker Dmitri went a different route after the same breach notice: he paid for a monitoring subscription that included a one-tap lock feature. When his own car needed refinancing three weeks later, he unlocked his file from his phone in the finance office parking lot in under a minute. Both approaches worked. Dmitri paid a monthly fee for the convenience; Renata paid nothing but had to plan a day ahead.
The most common mistake is freezing or locking credit at only one or two bureaus and assuming that's enough protection, when a thief who gets rejected at one bureau will often just try opening the account through a lender that pulls from a different one. Another is forgetting where the login credentials are stored; if you set up a freeze once and never write down the account details, you'll be starting from scratch, verifying your identity all over again, the next time you need to lift it.
People also frequently confuse a credit freeze with a fraud alert, which is a different, weaker tool that just asks lenders to verify your identity more carefully rather than blocking access outright. And some people freeze their credit but never actually review the report itself, missing existing fraudulent accounts that a freeze does nothing to remove.
Set up freezes at Equifax, Experian, and TransUnion the same day you get a breach notice, not the week after. Save your PIN or login credentials somewhere secure and findable, like a password manager, since you'll need them again. Pull and review your full report at each bureau while you're already in there. If you know you have upcoming credit needs, like a mortgage application or a new car, plan the unfreeze window a day or two ahead rather than scrambling at the dealership or the closing table.
A freeze and a lock do almost the same job day to day, but they come from different places: one is a free federal right with no expiration and a short manual step to lift it, the other is a paid convenience feature governed by a company's own terms. After a breach, doing either one immediately matters far more than which one you pick, so don't let the terminology slow you down.
This article is for general informational purposes only and does not constitute financial or legal advice. Consult the individual credit bureaus for current procedures, and consider speaking with a financial or legal professional if you believe you are a victim of identity theft.
Join the newsletter your bank hates and your wallet loves.
No spam. Unsubscribe anytime.