The first time I froze our credit, it took twenty minutes and a cup of coffee. The second time, six months later, for my parents' files instead of ours, it ate most of a Saturday and left me on hold with three different companies. That gap between the two afternoons is basically the whole lesson here: freezing credit at all three bureaus is one of the simplest tools in identity theft recovery, and it's also a job people manage to make harder than it needs to be. I started keeping a blue three-ring binder of fraud paperwork back in 2022, after my father got taken by a fake IRS caller and my own card got cloned two months after that, and locking down our credit files became the first piece of financial security for our family that actually held.
Two Freezes, Two Very Different Afternoons
Our first fraud year started with a phone call, not a hack. Someone posing as an IRS agent convinced my father he owed back taxes immediately or he'd be arrested, and by the time he was talked down he'd already loaded five thousand dollars onto gift cards and read the numbers over the phone. Two months later, my own debit card got cloned at a gas pump — a classic skimmer setup — and someone in another state used it for a little over a thousand dollars in furniture I never touched, let alone signed for. Marguerite Seals, my friend from book club who works in mortgage lending, was the first person I called when I saw those furniture charges — she was the one who'd been telling me for years to actually watch our credit reports instead of just hoping for the best.
Freezing your credit doesn't require a security clearance or a law degree, whatever the paperwork makes it feel like. It's a right guaranteed under the Fair Credit Reporting Act, and by law, the fee for freezing or unfreezing your file at any bureau is zero dollars — always has been, no matter what an upsell screen tries to tell you on the way through checkout. I'm not a financial advisor and never claimed to be one; I'm an HR manager who spent a chunk of one year reading fraud alerts before bed instead of falling asleep to the news. What I do know, from doing this twice, is that nobody at the bureaus is going to freeze your file for you. They make money selling access to your data. You have to be the one who locks it.
What a Credit Freeze Actually Locks — and What It Doesn't
A freeze works like a deadbolt on a door that only opens for people you already trust with a key. Once your file is locked at Equifax, Experian, and TransUnion, a lender who pulls your report to open a brand-new account — a car loan, a store card, a mortgage — gets a denial instead of a green light, because the bureau legally can't hand over your file. That part is genuinely simple, and it's the part that stops the scariest kind of theft: someone opening debt in your name that you don't find out about for months.
None of that would have stopped what actually happened to my card at the pump, though. A freeze only blocks new accounts — it does nothing for an account you already have. That gas station charge came from a skimmer, a small card-reading device fitted over the real slot, and no amount of freezing would have caught it; only checking my statement did. If your Social Security number has ever shown up in a breach notice — and at this point, statistically, most of ours have — a freeze is still the strongest single lock available on new-account fraud, but it's not the only lock you need.
There's a second gap worth knowing about too: a freeze doesn't stop the internal stuff. If a company you already bank or shop with gets breached and someone logs into your existing account, freezing your credit file does nothing, because that fraud isn't opening anything new — it's just impersonating you inside something that already exists. If you've gotten one of those breach notification letters in the mail, it's worth reading through steps to take after receiving a data breach notification letter before you decide a freeze alone covers you.
Locking Down Equifax, Experian, and TransUnion
Actually locking each bureau isn't hard, just repetitive, since you have to do it three separate times and again for every family member. Experian was the easiest of the three for me — an online dashboard, a handful of "no thanks" clicks past their monitoring upsells, and a freeze confirmation within minutes. Equifax wasn't far behind once I set up a myEquifax login, which made it simple to toggle the freeze on and off later when we needed it thawed. TransUnion was the one that slowed me down both times, mostly because their site buries the free freeze option under a paid "lock" product that looks nearly identical — you have to specifically hunt for the word "freeze," not "lock," or you'll end up paying for something that's supposed to be free.
While you're in there, it's worth adding a fraud alert too, since it takes two extra minutes. An initial fraud alert lasts one year and tells any lender to double-check your identity before approving credit in your name; if you've actually filed a report through the FTC's IdentityTheft.gov process, you qualify for an extended alert that lasts seven years instead. I put the seven-year alert on my father's file once we had that police report and the FTC paperwork to back it up, since a scam built around fear and a fake badge number deserved the longest protection the law allows.
Why Did TransUnion Give Me the Most Trouble?
Four months after the second freeze, we needed to buy a family car, which meant thawing my file so the dealership could actually run a credit check. I couldn't find the PIN I'd generated for TransUnion anywhere in the binder — every other bureau's paperwork was there, filed and tabbed, and that one page had simply vanished. Calling their automated line while I walked laps around Freedom Park to burn off the stress didn't help either, since the security question I'd set up years earlier didn't match what I typed back — I'd apparently misspelled the name of the street from my childhood address when I first created the account, and the system doesn't forgive typos. Forty-five minutes and one very patient representative later, verified through old tax records instead, TransUnion finally lifted the freeze.
That scare is what finally got me to deal with the mail pile I'd been ignoring. I'd bought a decent cross-cut shredder that same fall, then let nearly six months of statements, insurance notices, and preapproved offers stack up in a box I kept meaning to get to before I ran a single page through it — which is its own kind of risk, since a freeze does nothing for a bank statement someone could pull out of a bin. Working through that backlog became part of the same weekend project as the TransUnion call, and by around the fifth week of actually keeping up with it instead of just piling more on top, checking the mail stopped making my stomach drop before I'd even opened the box.
Six months after we froze my dad's file, I sat down and lined his TransUnion report up against the one from right after the scam — nothing new, not one account he didn't recognize — and that was the first time in months I actually let my shoulders drop instead of just telling people I felt fine.
Being the one responsible for a parent's logins and PINs is its own quiet weight — write them down somewhere safe you can actually reach, because if it had been up to my father to navigate that TransUnion phone tree alone, he'd have hung up in the first two minutes and never called back. That's exactly the kind of giving-up moment a scammer counts on.
A Freeze Buys You Time, Not Immunity
Freezing your file is not the finish line, even once all three bureaus confirm it. My dad still gets preapproved credit card offers in the mail every few weeks, because bureaus are allowed to use your data for prescreened marketing even while your file is locked — stopping that requires a separate opt-out through OptOutPrescreen.com, one more tab in the binder.
Existing accounts are the other blind spot. If a company you already do business with gets breached and someone logs into an account you already hold, a freeze does nothing to stop that, because the fraud isn't opening anything new — it's just impersonating you inside something that already exists. That's the gap a paid monitoring service is actually built for, catching a changed mailing address or a strange login rather than blocking new credit — monitoring and freezing solve two different problems, and one subscription won't do both jobs. It's also why I still keep an eye on device security for my parents' phones alongside their frozen files — the best antivirus for multiple devices with family identity protection guide covers the piece of this that usually starts the trouble in the first place.
None of this makes our family bulletproof, and I'd be lying if I said I don't still get a small jolt every time an unfamiliar number calls my dad's phone. But the lesson that stuck across both freezes is simple: lock the door before you go looking for burglars, not after. A freeze is free, it takes less than an hour split across three websites, and it buys you the one thing fraud actually depends on — enough time for a scammer to hit a locked file and move on to someone easier. Keep your PINs somewhere you can find them, keep the binder current, and don't wait for a second scare to do what you can do today.