Freeze Your Credit File: The 10-Minute Identity-Theft Lock

Scam season is officially here. With Black Friday deals already live, researchers tracked an 89% surge in Black Friday scam websites and a 2,000% jump in phishing this shopping season — and October 2026 data shows first contact by text message is the fastest-growing way scammers reach victims. Meanwhile, Cifas recorded more than 242,000 identity fraud cases in the UK in 2025, the single most common fraud type it sees.

The good news: the single strongest move against new-account fraud is also one of the cheapest. In the US, freezing your credit file is free at all three bureaus and takes about ten minutes each. In the UK, the nearest equivalent — Cifas Protective Registration — costs £30 for two years. Here is exactly how each one works, and how to set yours up today.

What a credit freeze actually does

A credit freeze (also called a security freeze) restricts access to your credit file. When a lender cannot pull your report, it cannot approve a new credit application in your name — so an identity thief holding your details hits a wall at the checkout, not after the account is opened.

What it does not do is just as important to understand:

• It does not affect your credit score. Freezing, lifting, and removing a freeze are all score-neutral.
• It does not touch your existing accounts. Your cards keep working, payments keep posting, and lenders you already have can still review your file in most cases.
• It does not stop fraud on accounts that are already open. A freeze blocks new accounts. Skimming, phishing, and account takeover on existing cards are separate problems — which is why transaction alerts and the habits in our fake-bank-texts guide still matter.

A credit freeze is the closest thing to a master lock for your identity: free by US federal law since 2018, and it stays on until you lift it yourself.

US: freeze all three bureaus (about 30 minutes total)

Equifax, Experian, and TransUnion each keep a separate file on you — a freeze at one covers nothing at the other two, so you must do all three. The CFPB explains that freezes at all three are free and must be requested separately, and the FTC says you can freeze at any time, for any reason: you do not need to be a confirmed victim.

1. Go to each bureau's official freeze page. Create an account or sign in, verify your identity (expect questions about your credit history or a request for documents), and place the freeze. Save the confirmation and your credentials in a password manager.
2. Type the address yourself or use a saved bookmark — do not click a sponsored search result. You will be entering your Social Security number, and phishing sites impersonate the bureaus.
3. Decline the paid products offered along the way. The bureaus will promote "credit locks" and monitoring plans during the process. A lock is a commercial product; the free statutory freeze does the job for blocking new credit.

When you need credit yourself: lift, apply, re-freeze

When you apply for a card, car loan, mortgage, apartment, or even some phone contracts, ask the lender which bureau it will check, then temporarily lift that bureau's freeze. Online lifts take effect within the hour (federal rules require online and phone lifts to be handled within an hour); phone is nearly as fast, and mail can take days, so do it online. Set a short window — say, three days — and the freeze re-locks automatically. Ask nothing else: some bureaus also offer a lift for one named creditor, keeping everyone else locked out.

Freeze vs fraud alert vs credit lock

Tool	Cost (US)	What it does	Best for
Security freeze	Free	Blocks most new-creditor access until you lift it	Default protection for everyone
Fraud alert	Free, 1 year	Tells lenders to verify your identity before approving credit; you contact one bureau and it notifies the other two	Confirmed or strongly suspected identity theft (use alongside a freeze, and IdentityTheft.gov for recovery)
Credit lock	Varies; often paid	Similar locking effect via an app, but a commercial product with its own terms	Convenience — the CFPB notes locks are not more effective than the free freeze

UK: there is no freeze — use Cifas Protective Registration

The UK has no credit-freeze mechanism. The nearest tool is Cifas Protective Registration: a warning flag placed against your name and details in Cifas's National Fraud Database, which prompts its 775-plus member organisations — most banks, lenders and telecoms firms — to run extra identity checks before approving applications in your name.

• Cost and length: £30 for two years, per the official Cifas page. You can update details or remove it any time; otherwise it expires after two years (you are not emailed a reminder, so reapply if still at risk).
• How to apply: online only, at the official Cifas site. Applications by phone are not accepted. The payment card should be in your name with a matching billing address — and type the address yourself rather than following a link from a message.
• Limits: it does not affect your credit score, is not insurance against fraud losses, and does not cover transactions on products already running. Genuine applications may take slightly longer while the extra checks run — so allow extra time.

If your documents have been stolen or your details have appeared in a data breach, Protective Registration is the most consistent UK-wide control available, since nearly all major lenders check the Cifas database. A lighter-touch option is a fraud alert with a credit reference agency (Equifax, Experian or TransUnion).

Your 20-minute lockdown checklist

1. Freeze or register. US: all three bureaus separately. UK: Cifas Protective Registration if your details are at risk.
2. Store your access details securely. Bureau logins and any freeze PINs go in a password manager — losing them turns a two-minute lift into a multi-day identity-verification slog.
3. Check your reports. US: free weekly reports at AnnualCreditReport.com. UK: each of the three credit reference agencies provides a free statutory report. Look for accounts and inquiries you do not recognise.
4. Turn on transaction alerts on every bank account and card you already have — a freeze does not watch existing accounts.
5. Save the scam-safety habit: lenders and bureaus will never text you a link to manage a freeze. If a message claims otherwise, it is the scam, not the service.

Frequently asked questions

Will a freeze stop me getting pre-approved offers?

Mostly, yes — lenders that screen you out of prescreened offers will skip a frozen file. That is a feature, not a bug: fewer offers in your mailbox means fewer account numbers floating around.

Does a freeze stop background checks or existing lenders?

Not entirely. Existing creditors, debt collectors, landlords and employers (with your permission) may still access your file in some cases. A freeze targets new credit approvals, which is where identity theft does its damage.

What about freezing a child's credit?

Children are prime identity-theft targets because the fraud can go undiscovered for years. The US bureaus allow parents or guardians to freeze a minor's file — worth doing well before they apply for anything.

I'm in the US — do I still need Cifas-style registration?

No. The three-bureau freeze covers the US equivalent. And if you are in the UK, there is no freeze to place — Protective Registration is the tool designed for your system.

Thirty minutes of setup buys years of default protection. Freeze your files — or register with Cifas — before the next data breach, not after.