Credit protection works by layering three kinds of defenses: federal laws that cap what you can lose to fraud, free tools at the three credit bureaus that block or flag new activity on your file, and optional paid services that watch for threats beyond your credit report. Used together, these keep thieves from opening accounts in your name and limit the damage when something slips through. The useful question is not which single product to buy, but which free protections you already have and where a paid service actually adds something.
What Federal Law Already Covers
Before paying for anything, know the floor Congress has already set. Your maximum liability for unauthorized credit card charges is $50 under the Truth in Lending Act, and only for charges made before you notify the issuer. After you report the card lost or stolen, you owe nothing on later charges.1Office of the Law Revision Counsel. 15 U.S. Code 1643 – Liability of Holder of Credit Card Most major issuers go further on their own with zero-liability policies, though those are company policies rather than legal requirements.
Debit cards are riskier because the money leaves your account immediately, and your liability depends on how fast you report under the Electronic Fund Transfer Act:
- Report within two business days, and your liability tops out at $50.
- Report after two business days but within 60 days of your statement, and liability can reach $500.
- Report after 60 days from the statement, and you can lose everything taken after that window and before you notify the bank.2Office of the Law Revision Counsel. 15 U.S. Code 1693g – Consumer Liability
That last tier is where people get hurt. A thief draining a checking account for months while statements go unread can leave you with no legal right to reimbursement for the late-discovered charges. One thing banks cannot do: use carelessness, like writing a PIN on the card, to push you above these statutory caps.3Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers
Credit Freezes: The Strongest Free Tool
A credit freeze blocks lenders from pulling your credit report at Equifax, Experian, and TransUnion. Without that report, most creditors will not approve a new account, which makes a freeze the single most effective defense against new-account fraud. While it is in place, nobody can open credit in your name, including you.4Consumer Advice. Credit Freezes and Fraud Alerts
Freezes are free to place, lift, and remove at all three bureaus under federal law. They do not affect your credit score, and they do not touch existing accounts. Your current cards, mortgage, and auto loan all keep functioning. When you apply for new credit, you temporarily lift the freeze; bureaus must place one within one business day of your request and lift it within one hour when you request the lift online or by phone.5USAGov. How to Place or Lift a Security Freeze on Your Credit Report You have to contact each bureau separately. There is no single portal that covers all three.
Fraud Alerts: The Lighter Alternative
A fraud alert flags your credit file so that lenders are supposed to take extra steps to verify your identity before approving new credit. You only need to contact one bureau, and that bureau is required to notify the other two.4Consumer Advice. Credit Freezes and Fraud Alerts Three versions exist.
Initial Fraud Alert
Anyone can place one, no documentation required. It lasts one year and entitles you to a free credit report from each bureau.6Office of the Law Revision Counsel. 15 U.S. Code 1681c-1 – Identity Theft Prevention; Fraud Alerts Useful if you suspect your information has been exposed but have not confirmed actual fraud.
Extended Fraud Alert
Available to confirmed identity theft victims, this alert lasts seven years and requires proof of the theft, such as an identity theft report. It also entitles you to two free credit reports from each bureau during the alert period.7TransUnion. Fraud Alerts
Active Duty Alert
Military servicemembers on active duty can place a one-year alert, renewable for the length of deployment. It also removes you from prescreened credit and insurance offer lists for two years.8Military OneSource. FTC Active-Duty Fraud Alert
Alerts are weaker than freezes because they depend on the lender actually following through on the verification step. A freeze mechanically blocks the report. An alert asks someone to double-check. Some lenders are more diligent than others.
Credit Monitoring and Free Reports
Monitoring is detection, not prevention. It watches your bureau files and alerts you to new activity: hard inquiries, new accounts, address changes, and shifts in public records like bankruptcies or judgments.9USAGov. Learn About Your Credit Report and How to Get a Copy The value is speed. The faster you learn about unauthorized activity, the faster you can shut it down.
Free single-bureau monitoring is available through many banks, card issuers, and the bureaus themselves. The catch is that not every creditor reports to all three bureaus, so one-bureau monitoring can miss fraud. Paid three-bureau services close that gap, but check what you can get for free first. All three bureaus permanently offer free weekly credit reports through AnnualCreditReport.com, so you can rotate through your files manually without a subscription.10Consumer Advice. You Now Have Permanent Access to Free Weekly Credit Reports
Credit Locks Versus Freezes
A credit lock does essentially the same thing as a freeze but operates under different rules. Locks are products the bureaus sell, often bundled with paid monitoring, and they tend to toggle instantly through a mobile app. The trade-off is legal: a lock runs on a service agreement, not federal law. If the bureau changes its terms, raises prices, or has a glitch that exposes your file, your remedies are weaker than with a statutory freeze. For most people, the free freeze is the better choice.
Threats That Never Touch Your Credit Report
Credit protection covers activity on your credit file: unauthorized cards, loans, and hard inquiries. Some identity theft never shows up there at all. Medical identity theft happens when someone uses your information to get healthcare or file insurance claims. Criminal identity theft occurs when someone gives your name during an arrest. Tax identity theft involves a fraudulent return filed under your Social Security number to claim a refund. Credit monitoring alone will not catch any of these.
Paid identity theft plans typically add dark web scanning that searches breach databases and underground marketplaces for your login credentials, Social Security number, and other identifiers. Some include dedicated restoration specialists who do the cleanup work when fraud spans multiple agencies and creditors. Whether that is worth paying for depends on your situation. If you have already been exposed in a major data breach, the monitoring and restoration support can earn their keep. If new-account fraud is your main concern, a free freeze handles that without a monthly fee.
Protecting a Child’s Credit
Children are attractive targets because the fraud can run undetected for years. A child under 18 generally should not have a credit report at all, so the existence of one is itself a warning sign.11Consumer Advice. How To Protect Your Child From Identity Theft Federal law lets parents and legal guardians place a credit freeze on a child’s file if the child is under 16, with proof of authority such as a birth certificate. For children in foster care, the agency representative provides documentation certifying the child is in the agency’s care.12Consumer Advice. New Protections Available for Minors Under 16 Freezing a child’s credit before problems arise is worth the small amount of paperwork.
What to Do If Fraud Happens
When something unauthorized shows up, the order matters. Each step feeds the next.
Start with a fraud alert at any one bureau. That bureau notifies the other two, and you get a free credit report from each.4Consumer Advice. Credit Freezes and Fraud Alerts If you want stronger protection while you work, add a freeze at the same time.
Then file a report at IdentityTheft.gov. The FTC site generates a personalized recovery plan with pre-filled dispute letters, and the report it produces is your official FTC Identity Theft Report, which creditors and bureaus will ask for and which qualifies you for an extended fraud alert.13Federal Trade Commission. Report Identity Theft File a police report locally as well, bringing the FTC report and supporting documents.
Next, dispute the fraudulent items with each bureau and each creditor involved. Written disputes sent by certified mail build a paper trail. A bureau generally has 30 days to investigate, with five business days after that to notify you of the results; if you submit additional information during the investigation, the bureau can extend to 45 days.14Consumer Financial Protection Bureau. How Long Does It Take to Repair an Error on a Credit Report?
Tax-related fraud runs on a separate track. If someone filed a fraudulent return under your Social Security number, submit IRS Form 14039 to flag your account for the IRS’s specialized identity theft process.15Internal Revenue Service. Form 14039 – Identity Theft Affidavit The credit bureaus cannot resolve this one.
Recovery is slow. Bureau disputes, creditor investigations, and IRS cases each take weeks to months. Keeping organized records from the start, every letter, confirmation number, and call log, makes the process far less painful when one of those disputes stalls or has to be escalated.