Freeze your credit at all three bureaus (and the ones you're forgetting)
A credit freeze is free, permanent, and blocks the exact thing most new-account fraud runs through. But “all three bureaus” isn't the whole job, and doing the steps out of order costs you weeks. Here is the sequence that avoids the traps: claim your bureau accounts before a fraudster does, freeze the two agencies people forget, and know precisely what a freeze can't touch.
A freeze blocks one specific thing — and blocks it well.
A freeze blocks the credit-report pull that most new-account fraud needs to succeed. The mechanism is direct, even though no one has measured how much it actually lowers your odds — that gap is stated plainly further down this guide, not papered over.
GAO-19-230 (2019)New-account identity theft is real but a minority of identity-theft cases overall — existing-account misuse is far more common. A freeze is aimed at the one thing it actually covers, not a general shield.
BJS, Victims of Identity Theft, 2021 (pub. 2023)Complaints about frozen-account handling run in the tens of thousands a year at the federal consumer-complaint database — the process breaks often enough that the right order, with a working fallback, is worth getting right.
CFPB Consumer Complaint Database, queried Aug 9 2026What's actually measured — and what isn't.
Only 17% of Americans have a credit freeze or fraud alert — both free since 2018. No causal effectiveness study exists, but a freeze blocks new-credit pulls by construction.
9% of Americans 16+ experience identity theft each year (23.9M people); 22% — 1 in 5 — have experienced it in their lifetime. The peak age band is 50–64, not seniors.
The typical identity-theft case: median $0 out of pocket (88% of victims lose nothing), median 1 hour to resolve. The catastrophic cases concentrate in the elder tail.
8 steps, in this order.
Pull all three credit reports — before you freeze anything
Get a baseline first. Weekly access to all three reports at AnnualCreditReport.com is permanent, not a temporary perk. Reading your reports first also arms you for the identity-verification questions the freeze flows ask — and at least one major report product has refused to pull a frozen file, so pulling before you freeze sidesteps that friction entirely.
- AnnualCreditReport.com, or call 1-877-322-8228
- Answer each bureau's identity questions and save the PDFs
- If verification fails (“we are unable to verify your identity”), that's usually a thin file with under six months of history — the fallback is requesting by mail, or proceeding straight to freezing by phone or mail with documents
Enroll in any free monitoring you actually want — before you freeze, not after
This is the step that wastes an afternoon when it's done out of order. A new third-party enrollment can fail identity verification against an already-frozen file — Credit Karma maintains a dedicated support article for exactly this problem. The freeze statute exempts monitoring you're already subscribed to, so sign up for whatever you want first, and freeze second.
- Credit Karma — covers TransUnion and Equifax
- Experian's own free tier — covers Experian
- Your card issuers' built-in account alerts
Create your own account at each bureau — claim it before a fraudster does
All three bureaus now gate freeze management behind a web account — myEquifax, your Experian account, TransUnion's Service Center — and none of them use a PIN for online management anymore. Control of your freeze now equals control of that account. An Experian account re-registration flaw let attackers holding a victim's SSN and date of birth create a new account against an existing file and strip the freeze off it — documented in 2022, and Krebs on Security showed the hole still open when he retested in November 2023, with no independently verified fix published since. Registering your own account with a unique password isn't housekeeping here; it's the actual security step, and it costs nothing extra, because account creation is the freeze flow.
- A unique password per bureau — not reused from anywhere else
- Turn on Experian's freeze/thaw change-notification email — it's your tamper alarm if someone else touches the account
- This step and freezing (next) happen in the same sitting — creating the account is most of the freeze flow
Freeze Equifax, Experian, and TransUnion — online first, phone on failure, mail as the last resort
This is the core step, and the order of the fallback ladder is what most guides get wrong. If a bureau's website won't verify you, call before you consider mail: Equifax's automated phone line has worked when web signup rejected a valid email, and TransUnion's live fraud department has placed a freeze after both the web flow and its automated phone system failed. Mail is the genuine last resort — the response clock only starts once the bureau receives your letter, real round trips run into weeks, and Experian imposes a documented 30-day wait if you fail phone verification and don't follow up by mail. Sending someone to a mail form after their first web failure costs them a month for nothing.
- Equifax — equifax.com/personal/credit-report-services/credit-freeze/ (routes through myEquifax) · phone 888-298-0045, verified by SMS one-time code or credit-file questions · mail: Equifax Information Services LLC, PO Box 105788, Atlanta, GA 30348-5788
- Experian — experian.com/freeze/center.html · phone 1-888-EXPERIAN (1-888-397-3742) · mail: Experian Security Freeze, PO Box 9554, Allen, TX 75013
- TransUnion — transunion.com/credit-freeze (flow at service.transunion.com) · phone 800-916-8800 · mail: TransUnion, PO Box 380, Woodlyn, PA 19094
- $0 to place, lift, or remove at any of the three, by federal law — and once placed, it stays until you directly ask to remove it
Freeze the bureaus that “all three” doesn't cover
A big-three freeze does not reach NCTUE, the telecom and utility exchange — it's operated by Equifax, but an Equifax freeze does not freeze it, and fraudsters have opened phone plans through NCTUE against people who were frozen everywhere else. It also doesn't reach ChexSystems, which screens new bank accounts, or Innovis, sometimes called the “fourth bureau.” Each takes its own free freeze. Add LexisNexis if you've already had a fraud incident — it runs #4–5 in CFPB freeze-related complaints, so expect more friction there than at the other three.
- Innovis — innovis.com/securityFreeze · 1-800-540-2505 — still PIN-based by mail, no account required; widely described as the easiest of the group
- NCTUE — nctueconsumerportal.com · 1-866-349-5355 — closes the phone-plan gap an Equifax freeze leaves open
- ChexSystems — chexsystems.com · 800-887-7652 (24/7 automated) — this one blocks bank-account screening, including your OWN new checking or savings applications, until you lift it
- LexisNexis — consumer.risk.lexisnexis.com/freeze · 1-800-456-1244 — worth adding once you've already had a fraud incident
Do the two things a freeze can't do
A freeze only gates new-credit report access. It does nothing for tax-refund fraud, and it does not stop prescreened-offer mail — prescreening is a written exception in the freeze statute, so those offers keep arriving by default even with every bureau frozen. An IRS Identity Protection PIN closes the tax gap; opting out at OptOutPrescreen.com closes the mail gap.
- IRS Identity Protection PIN — irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin
- OptOutPrescreen.com or 1-888-567-8688 — 5 years online, permanent if you follow up by mail
Freeze your kids' credit, if you have any under 16
Protected-consumer freezes for children under 16 are free and guaranteed under federal law, but in practice all three bureaus require mail for them — minors can't open the web accounts the adult flow now runs through. Assemble the packet once you understand your own freezes, and do all three bureaus' packets in a single sitting rather than spreading it out.
- Proof of your authority — a birth certificate, or a court order/power of attorney for a guardianship
- ID for you and for the child, submitted to each bureau separately
- Removable later by you as the representative, or by the child directly once they turn 16
Freeze your spouse or partner too — freezes are strictly per person
There is no couple's freeze. A joint account does not create a joint freeze, and this is the step people forget most often, precisely because it feels redundant once you've done your own. A household that does this fully ends up with six big-three freezes, not two — three per adult.
- Repeat steps 3 through 5 for each additional adult in the household, in their name, with their own identity documents
Where this actually goes wrong
- Online identity verification fails (a knowledge-based question you can't answer) and the guide you're following sends you straight to a mail form — call the automated phone line first; mail runs weeks, the phone line often works within the hour.
- You fail phone verification at Experian and don't follow up by mail in time — a documented 30-day wait then kicks in before you can try again.
- You freeze the big three and stop there — NCTUE, ChexSystems, and Innovis are separate freezes with separate, real gaps: phone plans, bank accounts, and a fourth full credit file.
- You skip claiming your own bureau account because you already have a memorized PIN from years ago — PINs no longer control online freeze management at the big three; the web account does, and that account is the thing account-takeover attacks now target.
You already pay for an assistant that can do the drafting.
Paste one of these prompts in, fill in your details, and it will draft the checklist or the letter for you — the guardrails below each prompt are built from the failure modes AI assistants specifically hit on this topic.
We don't see your details and we're not in the loop. This is genuinely yours to run.
Help me build a personal checklist for freezing my credit at every bureau that matters, in the right order. MY SITUATION - Do I have kids under 16 I should also freeze: [YES/NO] - Do I have a spouse or partner who should do this too: [YES/NO] - Have I already been a fraud target, so LexisNexis is worth adding: [YES/NO] WHAT I NEED 1. A numbered checklist covering: pulling my three credit reports, enrolling in any monitoring I want BEFORE freezing, creating my own account at each bureau, freezing Equifax/Experian/TransUnion, freezing Innovis/NCTUE/ChexSystems (and LexisNexis if relevant), the IRS IP PIN, the prescreen opt-out, and — if applicable — my kids and my partner. 2. Put the steps in dependency order, not just importance order. 3. Flag which steps are genuinely optional for my situation and which aren't. RULES - Do not tell me I need a PIN to manage freezes at Equifax, Experian, or TransUnion — they use account logins for online management now, not PINs. - Do not tell me to lift a freeze to sign up for an IRS or Social Security online account — those use document-based identity verification (ID.me/Login.gov) with no documented freeze dependency. - Do not produce a URL, phone number, or mailing address for any bureau from memory — tell me to pull it from the bureau's own site or the CFPB's current List of Consumer Reporting Companies, and leave a placeholder where the detail goes.
Check what it produces before sending — verify any statute, phone number, or URL it gives you.
The things people actually ask.
No — the FTC states this flatly. A freeze has no effect on your score. The wrong answer still circulating is legacy bureau marketing implying freezes are burdensome or costly to your credit standing.
- No government agency, academic study, or industry report has ever measured how much a credit freeze reduces the odds of new-account identity theft. The case for freezing rests on mechanism — it blocks the credit-report pull most new-account fraud needs — not on a measured effect size. That's a real, logged gap, and this guide won't put a percentage on it.
- It doesn't stop fraud on your existing accounts, tax-refund fraud, benefits fraud, or any account opened without a credit pull. New-account-only theft is a real but minority share of identity-theft cases overall.
- It doesn't take you off prescreened-offer mailing lists on its own — that's a separate opt-out at OptOutPrescreen.com.
- It doesn't cover NCTUE (phone and utility accounts), ChexSystems (bank accounts), or Innovis just because you froze the big three — each needs its own freeze.
- It doesn't require lifting to sign up for an IRS or Social Security online account — both now use document-based identity verification with no documented freeze dependency, though neither agency has published anything that formally rules the interaction out.