How to Freeze Your Credit and Lock Down Your Accounts

Think about how many financial accounts you have opened in the last decade. Bank accounts, brokerage accounts, retirement plan portals, insurance logins, credit card apps. Now think about when you last checked whether those accounts still use a password you created in 2014, or whether the recovery email on file is one you no longer access. For most people, the honest answer is: never.

Identity theft remains one of the most common financial crimes in the United States, and the Federal Trade Commission (FTC) consistently reports it as the top consumer fraud category in its annual data. The good news is that the defenses available to you are free, genuinely effective, and faster to set up than most people assume. This guide gives you the actual steps, not vague suggestions, so you can work through the whole checklist in one focused session.

Before diving into the steps, it helps to understand what these two tools actually do, because they are often confused.

A credit freeze (also called a security freeze) locks your credit file at a bureau so that new lenders cannot pull your report. If someone steals your Social Security number and tries to open a credit card in your name, the application will typically be rejected outright because the lender cannot see your file. The freeze does not affect your existing accounts, your credit score, or your ability to use cards you already have. It simply closes the door to new credit inquiries from unfamiliar parties.

A fraud alert is a lighter-touch option. It adds a notice to your file asking lenders to take extra steps to verify your identity before extending credit. A fraud alert does not block access to your file; it just raises a flag. An initial fraud alert lasts one year. An extended fraud alert, available to confirmed identity theft victims, lasts seven years. You only need to place a fraud alert with one bureau and they are required to notify the other two.

In most situations where you want strong, ongoing protection, a freeze is considered the more robust option. A fraud alert is sometimes useful if you want protection without the occasional inconvenience of lifting a freeze when you apply for new credit.

Under federal law (specifically the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018), credit freezes are free for all consumers. You must contact each of the three major bureaus separately, because they do not share freeze requests with each other.

Here is how to reach each one:

• Equifax: Visit equifax.com/personal/credit-report-services or call 1-800-685-1111. You will create an account or log in, then navigate to the freeze section. Equifax also has a myEquifax portal that makes managing freezes straightforward.
• Experian: Visit experian.com/freeze/center.html or call 1-888-397-3742. Experian allows you to set a freeze online without creating an account if you prefer.
• TransUnion: Visit transunion.com/credit-freeze or call 1-888-909-8872. TransUnion also offers a freeze through their TrueIdentity portal.

For each bureau, you will typically provide your name, address, date of birth, and Social Security number to verify your identity. Once confirmed, the freeze takes effect immediately online (or within one business day by phone or mail, per federal requirements). Each bureau will give you a PIN or confirmation number. Store these securely, because you will need them if you ever want to lift the freeze.

A note on additional data brokers: Equifax, Experian, and TransUnion are the three primary bureaus that most lenders use. However, a smaller bureau called Innovis is sometimes used in certain industries. Innovis also offers a free freeze at innovis.com. The ChexSystems database, used by banks when opening checking accounts, offers a free security freeze as well at chexsystems.com. These are optional but worth knowing about if you want thorough coverage.

One concern people often raise is that a freeze will be inconvenient when they want to apply for a mortgage, car loan, or new credit card. The process of lifting a freeze temporarily is simpler than most people expect.

You can log in to each bureau's website and choose to either lift the freeze permanently, lift it for a specific lender, or lift it for a defined time window (for example, for the next five days). Once the window closes, the freeze reinstates automatically. For most routine applications, contacting the relevant lender ahead of time to find out which bureau they pull from is a practical move, because it means you may only need to lift the freeze at one bureau rather than all three.

Federal law requires bureaus to lift a freeze within one hour of receiving a request online or by phone. If you request a lift by mail, they have three business days. In practice, online lifts are typically instant. This means that if you are sitting in a dealership or a mortgage office, you can lift the freeze on your phone in real time.

If you are concerned about financial scams that target people over 50, a permanent freeze combined with targeted temporary lifts is a particularly useful layer of protection, because it removes the ability for a fraudster to open new accounts in your name even if they have your personal information.

A credit freeze protects against new accounts being opened in your name. But it does nothing to protect your existing accounts if someone gains access to your login credentials. That requires a separate set of steps, and most people have at least one weak point somewhere in their setup.

Work through the following areas in one sitting:

1. Switch from SMS two-factor authentication to an authenticator app

Two-factor authentication (2FA) adds a second verification step when you log in, typically a code sent to your phone. SMS text codes are better than nothing, but they are vulnerable to a technique called SIM swapping, where a criminal convinces your mobile carrier to transfer your phone number to a device they control. Authenticator apps like Google Authenticator, Microsoft Authenticator, or Authy generate codes directly on your device without relying on your phone number. They cannot be intercepted via SIM swap. Most major financial institutions, email providers, and brokerage platforms support authenticator apps. The process of switching usually takes under five minutes per account: go to the security settings, look for two-factor or two-step verification, and select the authenticator app option.

2. Use unique passwords for every financial account

Reusing passwords across accounts is one of the most common and most consequential security mistakes. When one website is breached and credentials are leaked, criminals run those same username-and-password combinations against banks, brokerages, and retirement plan portals. A password manager (such as Bitwarden, 1Password, or the one built into your browser) can generate and store long, random, unique passwords for every account so you only need to remember one master password. If you want to check whether your email address has appeared in known data breaches, the website haveibeenpwned.com (operated by security researcher Troy Hunt) is a widely referenced free tool.

3. Review account recovery details

Recovery email addresses and backup phone numbers are often set up once and forgotten. If the recovery email on your bank account is one you no longer access, or the backup phone number is an old number that has since been reassigned, someone else could potentially use that pathway to reset your password. Log in to each major account and audit the recovery options. Update anything that is out of date.

4. Review security questions

Many older accounts still use security questions with answers that are easy to find through social media (your mother's maiden name, your first car, the street you grew up on). One approach some people take is to treat security question answers like passwords, entering random strings of characters that have nothing to do with the actual question and storing the answers in their password manager. This removes the risk of someone guessing based on your public information.

5. Check authorized users and connected apps

Most online banking and investment portals allow you to see which third-party apps have been granted access to your account data. It is worth auditing this list periodically and revoking access for any services you no longer use. The same applies to authorized users on credit card accounts.

If you are also thinking about who would be able to access your accounts in an emergency or after your death, our guide on digital estate planning and password access covers that territory in detail.

Here is everything gathered into one place. Many people find it useful to work through this list on a weekend afternoon with a notepad open.

Credit protection

• Place a credit freeze at Equifax (equifax.com)
• Place a credit freeze at Experian (experian.com)
• Place a credit freeze at TransUnion (transunion.com)
• Optionally place a freeze at Innovis and ChexSystems
• Store your freeze PINs or confirmation details somewhere secure
• Place a fraud alert if you prefer a lighter-touch option (one bureau notifies the others)

Password and login security

• Audit every financial account login and replace reused or weak passwords with unique ones
• Set up a password manager if you are not already using one
• Enable two-factor authentication on all financial and email accounts
• Switch from SMS codes to an authenticator app wherever the option is available

Account recovery and access

• Verify that recovery email addresses are current and accessible
• Verify that backup phone numbers are still yours
• Review security question answers and consider replacing them with random strings
• Audit third-party app connections on banking and brokerage accounts
• Review authorized users on credit card accounts

Ongoing monitoring

• Check your free annual credit reports at AnnualCreditReport.com (the official FTC-endorsed site). Under permanent changes introduced during the COVID-19 pandemic period, weekly free reports became available and the FTC's consumer information pages confirm free weekly access remains available through AnnualCreditReport.com.
• Consider setting up transaction alerts via email or text on all bank and credit card accounts
• Review account statements monthly, even briefly, for unfamiliar activity

Staying alert to evolving fraud tactics also matters. AI voice cloning scams are one of the newer threats worth understanding, particularly for anyone who manages money for older family members.

This article is provided for general educational purposes only and does not constitute personalised financial, legal, or security advice. Every individual's circumstances are different. Readers are encouraged to consult a qualified financial adviser, and where appropriate a cybersecurity professional, before making decisions related to their financial accounts or identity protection strategy.