If you’ve ever looked into protecting yourself after a data breach, you’ve probably seen two options offered side by side: a credit freeze and a credit lock. The bureaus market them as nearly interchangeable, and the marketing is doing a lot of work there. They are not the same thing, and the difference matters more than most people realize when something actually goes wrong.

What a credit freeze actually is

A credit freeze is a right created by federal law. Since 2018, all three major credit bureaus – Equifax, Experian, and TransUnion – have been required to let you freeze and unfreeze your credit report for free, as many times as you want. When your report is frozen, lenders can’t pull it to open new credit in your name, which is exactly the point: most identity thieves need to see your credit file to approve a new card or loan.

Because it’s a legal protection rather than a company feature, a freeze comes with guarantees a lock doesn’t. The bureau can’t quietly change the terms, bundle it with a paid product, or drop the protection because you stopped paying for a subscription.

What a credit lock actually is

A credit lock does roughly the same job – blocking access to your report – but it’s a private product each bureau built on top of its own app, usually as part of a paid identity-monitoring plan. Locks are often marketed as faster and easier to toggle on and off from your phone, and that’s usually true. The trade-off is that a lock is governed by a customer agreement, not federal law. The bureau can change what a lock protects against, and your recourse if something goes wrong is contract law, not the Fair Credit Reporting Act.

This is not a small distinction if you ever need to dispute an error tied to how the freeze or lock was applied – something that comes up a lot around hard inquiries you didn’t authorize.

Which one should you use?

For most people, the freeze is the better default:

• It’s free by law, with no upsell path to a paid monitoring service.
• It’s backed by federal statute, not a company’s terms of service that can change.
• It works the same at all three bureaus, so you’re not relying on one company’s app staying reliable.

The lock’s main advantage is convenience – instant toggling through an app, sometimes bundled with dark web monitoring. If you’re already paying for that monitoring anyway and value the one-tap convenience, it’s not a bad add-on. Just don’t treat it as a replacement for the freeze, and don’t pay extra for a “lock” product if a free, legally-guaranteed freeze does the same core job.

When you actually need either one

A freeze or lock is most useful the moment you’ve been part of a data breach, lost a wallet, or noticed unfamiliar activity on a report a lender pulled. It’s also worth using proactively if you’re not planning to apply for credit in the near future – there’s little downside to freezing your file and thawing it only when you know you’ll need a hard pull, say for a mortgage or a new credit line as an authorized user.

How to freeze your credit (it takes about ten minutes)

You have to do it separately at each bureau – there’s no single form that covers all three:

1. Equifax: equifax.com/personal/credit-report-services
2. Experian: experian.com/freeze
3. TransUnion: transunion.com/credit-freeze

Each will ask you to verify your identity and give you a PIN or password to lift the freeze later. Save that credential somewhere you’ll actually find it – losing it means a slower manual verification process to unfreeze.

The bottom line

A freeze is the free, legally-protected option and should be most people’s default. A lock is a paid convenience feature dressed up to look like the same thing. If a bureau’s website or an ad is pushing you toward the lock without mentioning the free freeze, that’s a sales funnel, not neutral advice.