How to Freeze Your Credit After a Data Breach: Full Guide

If your information was exposed in a data breach, the single most effective step you can take is a credit freeze at all three major credit bureaus — Equifax, Experian and TransUnion — not just one. A freeze is free, it blocks anyone (including you) from opening new credit in your name until you lift it, and because each bureau keeps its own separate file, freezing one does nothing to protect the other two. Here is exactly what a freeze does, how it differs from a fraud alert, and how to place, manage and lift one at each bureau.

What a Credit Freeze Actually Does

According to the Federal Trade Commission's guidance on credit freezes and fraud alerts, "while a credit freeze is in place, nobody can open a new credit account in your name, including you." A freeze restricts access to your credit report at that bureau so lenders cannot pull your file to approve a new loan, credit card, or line of credit. Anyone can place a freeze, whether or not their identity has actually been stolen — it is a preventive tool, not just a response to confirmed fraud.

A freeze does not affect your existing accounts. Your current credit cards, mortgage, auto loan, and other open accounts keep working normally, and your credit score is unaffected. It also does not stop you from checking your own credit report or score, and it does not prevent debt collectors, your existing creditors, or government agencies with existing relationships from accessing your file under the exceptions the law allows.

Why Freeze Your Credit After a Breach

This security desk covers data breaches on a near-daily basis — large-scale incidents at retailers, healthcare providers, game publishers, and IT service providers routinely expose names, Social Security numbers, dates of birth, and account details. That is exactly the information someone needs to open a credit card, take out a loan, or open a new utility account in your name. A credit freeze is the step that directly blocks that specific outcome, regardless of what was leaked or which company lost it.

If you have not already checked whether your information has turned up in a known breach, it is worth doing before you decide how urgently to act — see our explainer on how to check if you've been hacked using Have I Been Pwned. But a freeze is worth placing proactively even without a confirmed hit, since breach notifications often lag the actual exposure by weeks or months. Large-scale incidents like the Loblaw breach affecting millions of customers are exactly the kind of event where freezing your credit at all three bureaus is the recommended next step, not just reading the notification letter and moving on.

Credit Freeze vs. Fraud Alert

The FTC's consumer guidance distinguishes two separate tools, and people often confuse them. A fraud alert does not block new accounts — it requires businesses to verify your identity before opening one. A credit freeze is the stronger option because it blocks new accounts outright. The tradeoff is convenience: a freeze needs to be lifted every time you legitimately apply for credit, while a fraud alert just adds a verification step for lenders.

In practice, many people use both after a breach: a freeze to stop new accounts cold, and — if they go on to file an identity theft report — an extended fraud alert for the longer-term protection of the prescreened-offer opt-out that comes with it.

How to Freeze Your Credit at Equifax

Equifax lets you place a security freeze online through its dedicated credit freeze center, backed by a free myEquifax account. The page states plainly that "placing, temporarily lifting, or removing a security freeze is free." To manage a freeze online, you create or log into your myEquifax member center, where you can place a new freeze or lift/remove an existing one. Creating a myEquifax account requires you to be at least 18 years old.

If you don't want to create an account, Equifax also offers a phone line for managing a freeze: 1-888-298-0045. Equifax verifies your identity on the call either with a one-time PIN sent to your phone or by having you answer questions based on information in your Equifax credit file. If you don't have an online account and can't verify by phone, Equifax's Customer Care team can also handle freeze requests by phone or mail. Separate request forms exist for freezing a minor's file, an incapacitated adult's file, or the file of an active-duty service member on behalf of someone else — each requires proof of identity for both the requester and the protected person, since these requests are made by someone other than the person the file belongs to.

Remember: a freeze placed with Equifax only covers your Equifax report. As Equifax's own page notes, "to freeze your other credit reports, you will need to contact Experian and TransUnion directly."

How to Freeze Your Credit at Experian

Experian manages freezes through a free Experian account rather than a mailed PIN, via its online freeze center. The page describes this as "the easiest and quickest way to manage your credit freeze" — once you're logged in, you can place a freeze, permanently remove one, or schedule a temporary "thaw" for a set window of time, with changes applying in real time and an alert sent whenever your freeze status changes.

If you'd rather not create an online account, Experian also accepts freeze requests by phone at 1-888-397-3742 (1-888-EXPERIAN) or by mail to Experian Security Freeze, P.O. Box 9554, Allen, TX 75013. A mailed request needs your full name, Social Security number, addresses for the past two years, date of birth, a copy of a government-issued ID, and a copy of a utility bill or bank statement showing your current address and a recent issue date. Mailed changes can take up to three days to process after Experian receives them, while online changes are immediate.

Like Equifax, an Experian freeze only protects your Experian file — it has no effect on your Equifax or TransUnion reports.

How to Freeze Your Credit at TransUnion

TransUnion is the third bureau you need to contact, and the same core rule applies: freezing Equifax or Experian does nothing to protect your TransUnion file, so it has to be done separately, directly with TransUnion. Per the FTC's guidance, a freeze at TransUnion — like the other two bureaus — is free to place and free to lift, and it stays in effect until you remove it.

TransUnion offers its own online freeze management tools and a phone-based option for people who prefer not to manage it online, following the same general pattern as Equifax and Experian: verify your identity, place or lift the freeze, and request a temporary lift only at the bureau a specific lender will check when you need new credit. If you run into trouble reaching TransUnion directly, the federal government's identity theft recovery site, IdentityTheft.gov, has guidance on contacting all three bureaus and can walk you through next steps, including filing an identity theft report if you find signs of actual fraud rather than just exposure.

How Much a Freeze Costs and How Long It Lasts

There is no charge to place a freeze, lift it temporarily, or remove it permanently at any of the three bureaus, and that applies no matter how many times you do it. You also do not need to have already proven identity theft, filed a police report, or shown any evidence of fraud to get a free freeze — the FTC notes that anyone can place one simply as a precaution, which is exactly the position most people are in right after a breach notification arrives.

A freeze has no expiration date. The FTC is explicit on this point: "a credit freeze lasts until you lift it." That means once you place freezes at all three bureaus after a breach, you can effectively leave them in place indefinitely and only lift the relevant one on the rare occasions you actually need new credit. There is no need to renew a freeze the way you would an initial fraud alert.

How to Temporarily Lift a Freeze When You Need Credit

A freeze is designed to be lifted on demand, not permanently removed every time you need credit. When you're about to apply for a new credit card, auto loan, mortgage, apartment lease, or even some jobs or utility accounts that involve a credit check, find out which bureau the lender or landlord will pull from. Log into that one bureau's account (or call its freeze line) and request a temporary lift — Equifax and Experian can both do this instantly online, with Equifax also offering phone-based lifts and Experian offering a scheduled, date-bound thaw window.

Once the application has gone through, re-freeze your file at that bureau. If you don't know in advance which bureau will be checked, some people temporarily lift all three rather than guess — since lifting and refreezing are both free, there's no financial cost to doing this, only a short delay while each bureau processes the request.

Should You Use a Fraud Alert Instead, or Alongside a Freeze?

A fraud alert is a lighter-touch option: it does not block new accounts, but it requires any business pulling your credit to verify your identity first, and — unlike a freeze — it only requires contacting one bureau, which is then required to notify the other two on your behalf. This makes it faster to set up, at the cost of weaker protection.

There are two tiers. An initial fraud alert lasts one year, is renewable, and anyone who suspects they might be affected by identity theft can request one with no extra documentation. An extended fraud alert lasts seven years, also removes you from prescreened credit and insurance offer lists for five years, but requires that you've filed an identity theft report — through IdentityTheft.gov or with police — confirming you've actually experienced identity theft, not just potential exposure.

For most people reacting to a breach notification where no fraud has happened yet, a freeze is the more complete protection since it blocks new accounts outright rather than just adding a verification step. A fraud alert makes the most sense either as a lighter interim step for someone who wants new accounts to stay easy to open, or as a longer-duration extended alert layered on top of a freeze once you've actually confirmed and reported identity theft.

Other Steps Worth Taking After a Breach

A credit freeze addresses new-account fraud specifically. It is not a complete response to every kind of breach. If the exposed data included login credentials rather than just personal identifiers, you should also change the password on the affected account and anywhere you reused it, and watch for credential stuffing attacks, where attackers use breached email-and-password combinations to try logging into other, unrelated services. Enabling multi-factor authentication on your important accounts, reviewing existing account statements for unauthorized activity, and keeping an eye on your credit reports for accounts you don't recognize are all reasonable companion steps to a freeze, not substitutes for one.

What to Do Next

If you've just received a breach notification, or simply want to lock down your credit preventively, the order of operations is straightforward: freeze your file at Equifax, then Experian, then TransUnion — each is a separate, free request, and none of them protects the other two. Keep a note of which bureau you used for each account type so that when you do need new credit, you know exactly which single freeze to lift. If you find evidence of actual fraud rather than just exposure, file a report at IdentityTheft.gov and consider upgrading to an extended fraud alert alongside your freezes. None of this costs money, and unlike many security recommendations, a credit freeze is something you set once and can largely leave alone.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage