- Identity Theft and Scams: How to Protect Yourself
- Credit Freeze: What It Blocks and What It Does Not (you are here)
This is part 2 of 2 of our guide to Protecting Yourself. It picks up where Identity Theft and Scams: How to Protect Yourself leaves off, and it is written to stand on its own: the key ideas are restated where you need them.
A freeze is a legal instruction, not a lock on the data. Since a 2018 amendment to the Fair Credit Reporting Act, each nationwide bureau must place it free within one business day of an online or phone request (three business days by mail) and lift it within one hour (three business days by mail). While it is on, the bureau may not release your report to someone deciding whether to open new credit. The statute then lists who still gets through, and the list explains its limits: your existing creditors reviewing or collecting your accounts; agencies acting under a court order, a subpoena or child-support law; companies sending prescreened offers; a monitoring service you subscribed to; and anyone using the report for insurance underwriting, employment, tenant or background screening, or to verify identity for purposes other than granting credit.
So a freeze stops the thief who wants a new card or loan, but it does not stop a fraudster who already holds one of your accounts, a landlord checking your history, or a new bank account, which banks screen through a separate agency, ChexSystems, that takes its own freeze. That is why 13.4 pairs freezes with account security.
| Credit freeze | Credit lock | Fraud alert | |
|---|---|---|---|
| What it does | Blocks most access to your report for new credit | Similar effect, switched on and off in a bureau’s app | Lenders must take reasonable steps to verify your identity before opening credit |
| Legal basis | Federal law; free since Sep 21, 2018 | The bureau’s own contract terms | Federal law; free |
| Cost | Free | Free or part of a paid subscription, depending on the bureau | Free |
| How to place | Separately at Equifax, Experian and TransUnion; placed within 1 business day and lifted within 1 hour when requested online or by phone | Separately at each bureau | Contact one bureau; it must notify the other two |
| How long | Until you lift it; parents can also freeze a child’s file (under 16) | While you keep it on | 1 year; 7 years (extended) with an identity theft report; 1 year for active-duty service members |
A thief makes $600 of unauthorized transactions: $200 in the first two business days after you learn your debit card was stolen, and $400 after that, before you call the bank.
- Debit card, reported within two business days (the day you learn doesn’t count) — Regulation E caps your share at the lesser of $50 or the amount taken before notice: $50; the card is blocked, so the later $400 never happens or is the bank’s loss.
- Debit card, reported on day five — up to $50 for the first two days plus the $400 taken afterward: $50 + $400 = $450, within the $500 cap. The bank absorbs $150.
- Debit card, never reported — transfers that occur more than 60 days after the statement showing the first theft was sent can be entirely yours, with no cap.
- No card lost — if the thief used only your account number, the $50 and $500 tiers don’t apply: report within 60 days of the statement and you owe $0.
- Credit card — Regulation Z caps your liability at $50, however late you report; many issuers waive even that.
- You sent the $600 yourself — tricked by a caller posing as your bank into sending a Zelle payment. Regulation E defines an unauthorized transfer as one initiated by someone other than you, so a payment you authorized under false pretenses (“authorized push payment” fraud) is generally not covered, and any refund is at the bank’s discretion. If instead the scammer obtained your login and made the transfer himself, CFPB guidance treats it as unauthorized and covered.
A fraud alert is a “check ID” sign on the door: a careful clerk will stop an impostor, a careless one won’t. A freeze is a deadbolt — nobody gets in until you unlock it yourself.
| Situation | What changes | Why | Number or rule |
|---|---|---|---|
| Applying for a mortgage, car loan or card | Lift the freeze first at the bureaus the lender uses (a mortgage lender usually pulls all three), for a set window | The freeze blocks the lender’s new-credit check | Lifted within 1 hour online or by phone |
| A landlord, employer or insurer checks you | The freeze does not stop them; no lift needed | Statutory exceptions | 15 U.S.C. § 1681c-1(i)(4)(H)–(I) |
| An existing card issuer reviews your account | It still sees your file for monitoring and credit-line changes | Account review is excepted | § 1681c-1(i)(4)(A) |
| A child under 16 | A parent can have the bureau create a record and freeze it, even if no file exists | “Protected consumer” rules | Free; proof such as a birth certificate (§ 1681c-1(j)) |
| An adult under guardianship, or with a POA agent | The guardian or agent can freeze the file | An incapacitated adult with a guardian is a protected consumer; a valid POA counts as proof of authority | § 1681c-1(j)(1)(B), (F) |
| Opening a bank account | Banks screen through ChexSystems, which the big-three freeze does not cover | A separate consumer reporting agency | Freeze it separately; lift it before applying |
| Prescreened credit offers keep arriving | A freeze does not stop them | Prescreening is excepted | An extended fraud alert removes you from the lists for 5 years |
| Active-duty service member | An active-duty alert adds verification while you are deployed | A fraud alert designed for deployments | 1 year, renewable for the deployment |
The Justice Department’s 2021 survey gives the inputs: 9% of people 16 and older suffered identity theft in a year; 12% of victims lost money of their own, a mean of $790; and victims who resolved their problems spent a mean of 4 hours doing it. Value the running household’s time at its pay: $75,000 ÷ 2,080 hours = $36.06 an hour. A paid monitoring-and-insurance plan is priced here at an illustrative $20 a month; prices vary.
| A: Do it yourself | B: Paid plan only | C: Both | |
|---|---|---|---|
| What you do | Freezes at three bureaus, IRS IP PIN, alerts, password manager | Monitoring alerts and expense insurance | A plus B |
| Yearly cost | $0 | $20 × 12 = $240 | $240 |
| Stops new-account fraud? | Yes, at the three bureaus | No; it reports it after the fact | Yes |
| Expected yearly loss, survey averages | Money: 9% × 12% × $790 = $8.53; time: 9% × 4 × $36.06 = $12.98; total $21.51 | Same exposure, less what insurance repays | Lower than A by at most the insured part |
The break-even. A paid plan earns its keep only if it removes more expected cost than it charges: $240 ÷ $21.51 ≈ 11 times the average household’s whole expected loss. Holding the survey’s rates fixed, the mean out-of-pocket loss would have to be ($240 − $12.98) ÷ (9% × 12%) ≈ $21,020, about 27 times the measured $790, or the plan would have to cost about $21.51 ÷ 12 ≈ $1.79 a month. The averages are low because institutions reimburse most reported losses; the free freeze prevents the costly kind.
Freezes: keep your file frozen at Equifax, Experian and TransUnion at all times, and at ChexSystems if you are not about to open a bank account. When you apply for credit, ask the lender which bureaus it uses (a mortgage lender usually pulls all three) and lift only those, for the shortest window the bureau offers. Payments: if anyone who contacted you, by call, text, email or message, asks you to pay or move money by gift card, crypto, wire, payment app or cash, or to a “safe account,” stop and call the institution on a number you already have. Paid monitoring: buy it only if the price is under about $2 a month or a breach notice offers it free; otherwise the freeze does more.
Assumptions: you can verify an institution’s number independently, and the survey averages in 13.3 describe your risk. Ignore the payment rule only for a payment you started yourself to a person or business you located and verified independently; even then, a credit card gives you rights the other methods do not.
Moving your own money for a caller who says your account is under attack. A text asks whether you made a purchase; you reply no, and a “fraud specialist” calls from what looks like your bank’s number. To “protect” the savings, you send the household’s $14,063 emergency fund to a “safe account” in two payment-app transfers and a wire. Because you initiated each transfer, Regulation E treats them as authorized, and any refund is at the bank’s discretion. The loss is $14,063, six months of the household’s essential spending. People reported losing nearly $1 billion to impersonators of banks and other businesses in 2025, with bank impersonators the costliest.
How to avoid it: no bank or agency ever asks you to move money to protect it. Hang up, call the number on your card, and set a daily limit on payment-app transfers. If you have already sent a wire, call your bank at once to request a recall and file at ic3.gov the same day.
Does freezing your credit hurt your credit score?
No. A freeze does not change your score, your existing accounts or your ability to use them, and placing or lifting it is free by federal law. The only effect is that a new lender cannot see your report until you lift it, which takes up to an hour online or by phone.
Can a landlord or employer see my credit report if it is frozen?
Yes. The freeze law exempts employment, tenant and background screening, along with insurance underwriting, so a landlord, employer or insurer can still obtain your report with whatever permission the law otherwise requires.
Is a credit lock the same as a credit freeze?
No. A freeze is created by federal law, free at each bureau, with timing rules the bureau must meet. A lock is a product the bureau offers under its own contract terms; it works similarly but may come with a paid subscription and gives you only the rights the contract grants.
Can I get my money back if I was scammed through Zelle or another payment app?
Usually not, if you sent the payment yourself. Federal rules treat a transfer you initiated as authorized even when you were deceived, so any refund is at the bank’s discretion. If the scammer got your login and sent the money himself, it is unauthorized: report it to your bank at once, ideally within two business days, and confirm in writing; the federal liability limits then apply (13.3).
How do I freeze my child’s credit?
Contact each of the three bureaus as the parent and send proof of identity for both of you and proof that you are the parent, such as a birth certificate. For a child under 16, the bureau must create a record if no file exists and freeze it free.
Reported consumer fraud losses to the FTC reached $15.9 billion in 2025, with investment scams the costliest category and imposter scams the most reported, and AI voice cloning now powers the old family-emergency call. Every scam pulls the same levers — urgency, borrowed authority, secrecy and an irreversible payment — so a callback on a number you already have and a family code word defeat most of them. How you pay decides what you can recover: a credit card is strongest, debit cards and bank transfers cover unauthorized transfers but generally not a payment you sent yourself, and wires, crypto, gift cards and cash offer little or nothing. A credit freeze at all three bureaus is free, leaves your score untouched and blocks new-account fraud outright, where a fraud alert only asks lenders to verify and monitoring only detects.
Five questions on this chapter. Decide on your answer first, then click “Reveal Answer.”
1. A caller posing as your bank talks you into sending $600 through Zelle yourself to a “safe account.” How does Regulation E treat the loss?
- Covered, with your share capped at $50 if reported within two business days
- Covered in full, because you were deceived by false pretenses
- Covered, with your share capped at $500 since the transfer was through an app
- Generally not covered, since you initiated it; a refund is up to the bank
Reveal Answer
Answer: D. Regulation E covers transfers initiated by someone other than you, so an authorized push payment made under false pretenses is generally not covered. Had the scammer used your login to send it, it would count as unauthorized. (Part 13.3)
2. Your credit is frozen at all three bureaus. Which of these can still obtain your credit report without you lifting the freeze?
- An auto lender considering a new loan
- A landlord screening your rental application
- A store offering instant financing at checkout
- A new card issuer deciding whether to approve you
Reveal Answer
Answer: B. The freeze statute, 15 U.S.C. § 1681c-1(i)(4), exempts employment, tenant and background screening and insurance underwriting; it blocks only reports for opening new credit. (Part 13.3)
3. Using the 2021 survey averages in this chapter (9% victimized a year, 12% of victims with out-of-pocket losses averaging $790, 4 hours at $36.06 an hour), roughly what is an adult’s expected yearly cost from identity theft?
- About $21.51
- About $8.53
- About $240
- About $71.10
Reveal Answer
Answer: A. Money: 9% × 12% × $790 = $8.53; time: 9% × 4 × $36.06 = $12.98; total $21.51, far below an illustrative $240-a-year paid plan. (Part 13.3)
4. Worked problem: A thief makes $1,200 of unauthorized credit card charges. What is the most you can be made to pay under the federal limit?
Reveal Answer
Answer: The federal limit is $50, and many issuers waive even that.
5. Worked problem: An unauthorized $800 debit-card transfer is reported on the fifth day after you notice it (more than two business days). What is the maximum liability?
Reveal Answer
Answer: Reported after two business days but within 60 days, liability is capped at $500, so you could lose up to $500 of the $800.
- Regulation E §1005.6: liability — Unauthorized-transfer liability
- Free credit freezes are here — Freezes and fraud alerts
- Consumer Sentinel Network — Reported fraud losses
- Lost or stolen credit, ATM and debit cards — Card liability limits
- 2025 Internet Crime Report — Internet crime and elder fraud losses
- 15 U.S.C. § 1681c-1(i)