The Equifax data breach where 143 million Americans' identities were stolen was only the largest in a long series of data breaches over the last several years. Unless your social security number was issued yesterday, you should assume that it has been compromised. And when it comes to identity theft, prevention is an order of magnitude better than the cure. So it is imperative for us all to take steps to prevent identity theft.
Placing a fraud alert or a security freeze on your credit are two ways to do this. This article compares the two but note that they are not mutually exclusive; you can place both a fraud alert and a security freeze. Indeed, it is advisable to do both.
Understanding Credit Reporting
When you apply for a car loan or mortgage or insurance or even a new account for Internet or cellphone service, the company you want to do business with checks your credit. To do that they contact one of 4 credit reporting agencies: Equifax, Experian, Transunion or Innovis. This is also called "pulling your credit".
The credit reporting agencies (CRAs) are private companies that compile financial information about all Americans and sell this data to businesses seeking credit reports on potential customers. So the CRAs are the gatekeepers for your credit information.
Fraud alerts and security freezes must be placed with these 4 CRAs so that you can protect who they sell your credit information to.
What is a Security Freeze?
A security freeze prevents most companies from accessing your credit report from the CRAs. Other than some companies with whom you have an existing business relationship, no other business can pull your credit report if you have a security freeze in place.
This is a great way to lock your credit and prevent any new accounts from being opened in your name. It is also an inconvenience when you want to conduct business yourself and do want your credit to be accessible to a legitimate service provider -- say a new landlord or the phone company.
What is a Fraud Alert?
A fraud alert is a note placed on your credit report warning prospective lenders that you may be a victim of identity theft. It requires that lenders take some extra steps to verify your identity before they grant credit to the person claiming to be you. In most cases, that means calling the phone number listed as yours on the fraud alert.
How Fraud Alerts Work
There are 3 types of fraud alerts:
- Initial Fraud Alert: valid for 90 days; does not require evidence for prior identity theft; can be placed online; place with one credit bureau and the others will get notified; entitles you to a free credit report from each of the bureaus.
- Extended Fraud Alert: valid for 7 years; requires a copy of the identity theft report; place with one credit bureau and the others will get notified; entitles you to 2 free credit reports from each credit bureau in the first 12 months, then one every year; opts you out from prescreened offers of credit or insurance for 5 years which is something you can otherwise do for free online here.
- Active Duty Military Alert: valid for 1 year; place with one credit bureau and the others will get notified.
When you place a fraud alert, a notice gets added to your credit report at each of the credit reporting companies. When a lender pulls your credit, they are informed about the fraud alert and are required to take additional steps to verify your identity. The most common additional step they take it to call the phone number listed on the fraud alert to verify it's really you seeking the credit.
How Credit Security Freezes Work
Placing a security freeze
When you place a security freeze, you must do so separately for each credit bureau. Check the References section to find links for each bureau's security freeze page. The cost for placing a security freeze varies by state. In most states, it is free if you are a victim of identity theft and have documentation that shows that, such as a police report or a letter from a business where a data breach occurred and your information was stolen. But the wrinkle is that the credit bureaus don't let identity theft victims place security freezes online; they have to fill out a paper application and mail it in along with the ID theft report.
When you place a security freeze, you get a PIN or passcode that you must store securely. You will need this passcode when you want to lift or remove the security freeze. Unless lifted, the security freeze will stay in place indefinitely except in a few states like Kentucky, Pennsylvania, and South Dakota.
After a security freeze is in place at a credit bureau, prospective creditors will be unable to pull your credit from that bureau. But banks that you already have accounts with will still be able to check your credit report, as will collection agencies and certain government agencies.
Lifting or removing a security freeze
A credit freeze may be lifted temporarily or permanently. It is free to permanently lift the security freeze, but temporary lifts cost roughly $5 to $10 in most states. Again, costs vary by state and also sometimes depend upon whether you are a victim of identity theft or other circumstances e.g. for senior citizens.
You can lift the freeze for a specific date range and/or for a specific lender. You will need your passcode to lift the freeze. Some credit bureaus give you a temporary password that you need to share with the prospective lender so they can use it to pull your credit.
Some lenders use a single credit bureau to pull your credit but some (especially mortgage lenders) pull credit from all 3 bureaus. So depending upon that you will need to lift the freeze at one or more bureaus. And each bureau will charge their fee for the lift.
Pros and Cons
There are many advantages of placing a fraud alert on your credit file:
- There is a high chance (although not a certainty) that you will get a phone call when someone claiming to be you tries to open a new account.
- It is free.
- An initial fraud alert does not require a police report or any other documentation proving that you are a victim of identity theft. It also lets you get a free credit report from each of the 4 credit reporting agencies every time you renew the fraud alert. These free credit reports are in addition to the free report available to you annually via AnnualCreditReport.com.
- It is convenient to place an initial fraud alert. You can do it online and you only need to place it with one of the big 3 CRAs for the other 2 to be notified automatically.
The only disadvantages of a fraud alert are that
- Fraud alerts aren't guaranteed to prevent identity theft because some businesses may not take the additional identity verification steps they are supposed to.
- When lenders do take the additional steps to verify your identity, it may cause minor delays to the transaction.
The advantage of a credit freeze is that you can have peace of mind that your credit cannot be pulled at all unless you lift the freeze yourself. The downside is that it's placing or temporarily lifting a credit freeze costs about $10 every time with each credit bureau. If you anticipate your credit being pulled and are able to lift the freeze in advance, there will be no delays in your transaction. But if you forget or don't know which of the bureaus your lender needs to use, there could be a delay. A risk with security freezes is losing the PIN/passcode that you need to lift or remove the freeze. If you lose this passcode and need to reset it, it causes more delays.
Fortunately the downsides for both security freezes and fraud alerts are minimal. It is highly recommended to use both options to prevent identity theft.
- Federal Trade Commission FAQs on credit freezes and fraud alerts
- Place a fraud alert online with Transunion
- Fraud alert at Experian
- Fraud alert at Equifax
- Fraud alert at Innovis
- Transunion security freeze
- Security freeze at Experian
- Security freeze at Equifax
- Security freeze at Innovis
- Credit freeze fees by state
- Consumers Union guide to security freeze protection