Credit Lock vs Freeze: How Each Restricts a Credit File

What a Security Freeze Is

A security freeze, usually called a credit freeze, is a legal right created by the Fair Credit Reporting Act as amended by the Economic Growth, Regulatory Relief, and Consumer Protection Act. When a freeze is in place, a nationwide credit reporting company must generally withhold a consumer's credit file from a third party that requests it for a credit-related purpose, such as a lender evaluating a new application.

The right applies to each nationwide credit reporting company separately. Equifax, Experian, and TransUnion each maintain their own file on a consumer, so a freeze placed with one company does not restrict the other two, and a person who wants full coverage places a freeze at all three. Placing, temporarily lifting, and permanently removing a freeze is free under federal law.

Federal rules set deadlines the companies must meet. A freeze requested online or by telephone must be placed within one business day, while a request sent by mail may take up to three business days. Lifting a freeze follows a similar structure: online or telephone requests must be honored within one hour, and mailed requests within three business days.

• Freeze is a statutory right, not a purchased service
• No fee to place, lift temporarily, or remove
• Applies file by file at each nationwide company

What a Credit Lock Is

A credit lock is a feature a credit reporting company offers through its own website, mobile app, or account dashboard. In practice it restricts access to a file much as a freeze does, but the mechanism is a contractual product governed by the company's terms of service rather than by a statutory right.

Naming and packaging differ by company. A credit lock with Experian, for example, is toggled through that company's account tools, while a credit lock with Equifax is offered through its own security product. Some companies bundle a lock with paid monitoring subscriptions, and features, prices, and eligibility can change at any time.

Because a lock rests on a contract, its terms can include provisions a freeze does not, such as arbitration clauses, class-action waivers, or the ability of the company to modify or discontinue the feature. A consumer who wants to lock a credit file, or later remove an Experian credit lock, is relying on the provider's tools and responsiveness rather than on a federal deadline.

Companies sometimes describe the same action in different words, which is why the phrase credit lock vs freeze matters when comparing offers. What is being described as a lock in one product may be closer to a freeze in effect, while still carrying subscription terms and account requirements.

• Contractual product, not a statutory right
• Access is managed through the provider's app or dashboard
• Terms, fees, and availability can change

The Core Differences Between a Freeze and a Lock

The clearest difference is legal footing. A freeze exists because federal law grants it, and the Fair Credit Reporting Act sets the response times a company must meet. A lock exists because a company chooses to offer it, so the company also controls how the feature works and whether it continues to exist.

Cost and control differ as well. Freezes are free at each nationwide company and are managed with credentials the company issues, such as a personal identification number or password. Locks may be free, may require a paid subscription, or may be included with a monitoring plan, and they are managed inside the company's own account environment.

The practical consequence appears when something goes wrong. If a lock portal is unavailable, an account lapses, or a subscription is cancelled, the consumer has whatever remedy the contract and applicable state law provide. With a freeze, the consumer can point to a federal standard for how quickly the company must act.

Both tools restrict release of a file, so neither is a substitute for reviewing a credit report for accuracy or for disputing information that is wrong. A dispute is a separate process under the Fair Credit Reporting Act and is handled by the company that furnished or holds the information.

• Legal basis: statute compared with contract
• Cost: free by law compared with terms set by the provider
• Timing: federal deadlines compared with provider service standards
• Ongoing management: PIN or password compared with an account login

How a Freeze Is Placed, Lifted, and Timed

A freeze can be requested online, by telephone, or by mail at each nationwide credit reporting company. The company typically asks for identifying details such as name, current and prior addresses, date of birth, and Social Security number, and it may ask for documentation such as a government-issued identification card or a utility bill.

Once a freeze is placed, the company issues credentials used to manage it later. If those credentials are lost, the company generally requires the consumer to re-verify identity before the freeze can be lifted or removed. This is one reason people note where the credentials are stored at the time the freeze is created.

A freeze can be lifted temporarily for a set window, which is useful when a specific application is pending, or removed permanently. A temporary lift requested online or by telephone must take effect within one hour under federal law, which is why many consumers describe the process as a thaw rather than a removal.

Instructions and mailing addresses are updated from time to time, so the current steps are best confirmed through the Consumer Financial Protection Bureau or the Federal Trade Commission rather than from an old printed form. Fraud alerts, freezes, and locks are three distinct tools, and the request method differs for each.

Costs, Terms, and Contractual Details of Locks

A lock offered by a credit reporting company may be free, may sit behind a paid subscription, or may be one part of a broader monitoring package that includes alerts and reports. Because pricing and packaging are set by the company, they can change without the notice a statutory right would require.

State laws address security freezes and, in some cases, related security measures, but federal law already makes freezes free and sets the timing rules for the nationwide companies. A lock is not covered by those timing provisions, so its responsiveness depends on the provider's operations and the contract.

When comparing offers, it helps to look at who governs the feature, whether the lock applies to one file or several, what happen if a subscription is cancelled, and how the provider handles removal requests. Reading the terms of service is the only reliable way to know what a particular lock product does, because the label alone does not describe the mechanism.

A consumer who wants the statutory protections can place a freeze at each nationwide company and keep a lock, if any, as an additional convenience layer. The two can coexist, and placing one does not cancel the other.

Fraud Alerts, Freezes, and Locks Compared

A fraud alert is a different tool. An initial fraud alert asks businesses to take reasonable steps to verify identity before extending credit, lasts one year, and, when requested with one nationwide company and proof of identity, must be shared with the other two. An extended fraud alert is available to identity theft victims who provide an identity theft report and lasts seven years.

An active duty alert serves military consumers and follows its own rules. Unlike a freeze, an alert does not block access to a file; it adds a verification step that businesses are expected to follow, which makes it a lighter measure for people who expect to apply for credit soon.

A freeze blocks release of the file for most credit-related purposes until it is lifted. A lock, in turn, restricts access through a provider's own product. Someone weighing credit lock vs freeze is choosing between a contractual convenience and a statutory protection, and the choice often depends on how soon a credit application is expected.

IdentityTheft.gov provides a recovery plan for people whose information has already been misused, and that plan can include freezes, alerts, and disputes in a coordinated sequence. The Federal Trade Commission publishes guidance on how alerts and freezes differ in scope.

What a Freeze or Lock Does Not Do

A freeze does not block every request. Access is generally still permitted for existing creditors and debt collectors handling an account, for the consumer's own requests, and for purposes allowed by law such as certain employment, insurance, and government inquiries. It also does not prevent a lender from opening an account without requesting a credit file.

A freeze does not close existing accounts, stop charges on an account that has already been opened, or remove information from a file. If an account was opened fraudulently or a report contains inaccurate information, the remedy is a dispute with the credit reporting company and, where relevant, a fraud report with the lender.

Neither a freeze nor a lock changes the contents of a file or the way a credit score is calculated. Scoring models use the information in a report, such as payment history, balances, and account age, and a freeze changes who may see that report rather than what it contains.

A freeze also does not prevent a data breach or undo one that has already occurred. It limits one avenue of misuse after the fact, which is why it is often described as a containment measure rather than a complete safeguard.

Choosing Between a Freeze and a Lock

The comparison comes down to what each tool is. A freeze is free, available by law at each nationwide company, and backed by federal timing rules for placement and lifting. A lock is a product, with the features, fees, and limits the provider sets in its terms of service.

People who expect to apply for credit in the near future sometimes prefer a lock because toggling it on and off happens inside an app. Others prefer a freeze because the one-hour lift requirement applies regardless of whether an app is working, and because no subscription is involved.

Either way, the same underlying files are involved, and each nationwide company holds its own. Reviews of credit reports from all three companies, freezes or locks placed at each, and careful tracking of the credentials needed to lift them are the recurring practical steps that appear across this topic.

Reporting fraud to IdentityTheft.gov and reviewing the guidance published by the Consumer Financial Protection Bureau and the Federal Trade Commission helps clarify which measure fits a given situation without relying on marketing language from any single provider.