Types of Fraud Alerts

Quick answer

A fraud alert is a notice on your credit file that asks businesses to take extra steps to verify that you are the person applying for credit. There are three kinds in federal consumer guidance:

• An initial fraud alert lasts one year. You can place it if you suspect fraud, even before you have finished an identity theft report.
• An extended fraud alert lasts seven years. You must give the bureau an identity theft report.
• An active duty alert lasts one year and is for service members away on deployment. It can be renewed for the deployment.

You generally request the alert from one nationwide bureau, and that bureau must notify the other two. A fraud alert does not lock the file. A freeze does. The comparison is in fraud alert versus credit freeze. This page is about choosing among the alerts themselves.

What every fraud alert is asking a lender to do

When a fraud alert is on the file, a business that wants to open a new credit account is supposed to take reasonable steps to confirm the applicant is you. In practice, that often means using the phone number you put on the alert. It can slow an application. It can also fail if a lender does not see the alert, if the phone number is wrong, or if the business is not opening a new account in the way the rule covers.

An alert is not:

• A freeze or a lock
• A deletion of existing accounts
• A promise that every application will be declined
• A substitute for disputing accounts that are already wrong
• A police investigation

If accounts are already open in your name, placing an alert is one step beside a report and disputes. Use what to do if someone opened credit in your name and identity theft on a credit report.

Initial fraud alert: one year, lower paperwork

The initial alert is the version to use when something looks wrong and you are not ready to assemble a full identity theft report, or when you want a shorter warning. Federal Trade Commission guidance says it lasts one year.

You do not need to prove the theft to place it. You do need a phone number where you can actually be reached. A disconnected number makes the "call me first" step useless.

What you should still do during that year:

• Pull your official reports and write down inquiries and new accounts. Start with how to get your free credit report.
• If the suspicion becomes a real theft, create an identity theft report and consider upgrading to an extended alert.
• Decide whether you also want a freeze. Many people place both, because the alert verifies and the freeze restricts access.
• Check that the phone number on the alert is current if you move.

When the year ends, the alert comes off unless you place a new one. It does not silently become a seven-year alert.

Extended fraud alert: seven years, and an identity theft report

The extended alert is for people who have an identity theft report. FTC guidance points to IdentityTheft.gov as the place to create that report and an recovery plan. A bureau can ask for the report before it places the seven-year alert.

The extra rights are the reason to bother with the paperwork:

• The alert stays for seven years, not one.
• For 12 months after you place it, you can request two free reports from each of the three nationwide bureaus, beyond the standard free report.
• Businesses must take extra identity-verification steps before issuing credit in your name. The duty is real, and it is still not a freeze.

An extended alert does not remove the fraudulent accounts by itself. You still dispute the inaccurate tradelines with the bureaus and the companies that furnished them. Keep the identity theft report with your dispute packet. A checklist for that packet is the identity theft credit report checklist.

If a bureau placed only a one-year alert after you sent a complete identity theft report, follow up. The seven-year version is a specific request, not an automatic upgrade.

Active duty alert: for deployment, not for every service member at home

An active duty alert is available when you are a service member on active duty and you are assigned away from your usual duty station, commonly described as deployment. It lasts one year. If you are still deployed, you can place another one.

It includes a step the other alerts do not emphasize in the same way: you can use it to be removed from prescreened firm-offer lists for two years. That reduces some unsolicited credit and insurance offers. It does not opt you out of every advertisement forever. Ordinary opt-out choices are explained in how to opt out of prescreened offers.

An active duty alert is not the right tool for a veteran who is home and dealing with old identity theft. That situation fits an initial or extended alert, plus a freeze if you want the file restricted. It is also not a military lending benefit and it does not change interest rates.

Family members are not covered by your active duty alert. A spouse who needs protection places their own alert or freeze.

Side-by-side

One request is supposed to reach all three bureaus

FTC guidance says you can place a fraud alert by contacting one of the three nationwide bureaus, and that bureau must tell the other two. You do not have to mail three identical packets for the alert itself.

Still confirm. Files update separately, names get mistyped, and phone numbers get dropped. A week or two later, check each bureau or each official report and look for the alert and the phone number. If one file is missing it, contact that bureau with the details of the request you already made. Do not assume "I called Experian" is visible to a lender that pulls Equifax until you have looked.

Bureau-specific screens change. For one bureau's placement notes, see Experian fraud alert. The same three alert types exist at Equifax and TransUnion. The labels on the websites are marketing. The durations above are the legal categories.

Fraud alert plus freeze is a common combination

People stall because they think they must pick one. You do not.

• The alert tells a business that does see your file to verify it is you.
• The freeze limits who can see the file until you lift it. Freezes are free and, unlike the one-year alerts, they stay until you remove them. Timing details are in how long a credit freeze lasts.
• A lock is a product term some bureaus sell. It is not the same legal tool as a freeze. Compare them before you pay for a lock you do not need.

If you want the file blocked at all three bureaus, follow how to freeze credit at all three bureaus. An alert does not complete that job.

When you apply for credit yourself, a freeze has to be lifted for that pull. A fraud alert may only add a verification call. Plan for both if both are on the file, and make sure the phone number on the alert is one you answer.

What to do in the first week

1. Decide which alert matches the facts. Suspicion or an unfinished report points to one year. A completed identity theft report points to seven years. Deployment points to active duty.
2. Place it with one nationwide bureau and write down the date, the confirmation, and the phone number you gave.
3. If you are using the extended alert, save the identity theft report you submitted.
4. Pull your reports and list every account and inquiry you do not recognize.
5. Place freezes if you want new pulls blocked, not merely flagged.
6. Dispute fraudulent accounts with documents, after the alert is requested. The alert will not close those accounts for you.
7. Recheck all three files to confirm the alert is actually there.

What not to pay for

You do not have to pay a company to place a fraud alert. The bureaus must place the alerts described above at no charge. A service that sells "priority alerts" or promises to wipe a file because you bought a package is not the federal process.

Also ignore instructions to invent a new identity, use a different number, or "start a clean file." Those pitches show up beside identity theft advice and they create new harm. The lawful tools are the alert, the freeze, disputes of inaccurate data, and an identity theft report.

Updating or removing an alert

The phone number is the working part of a one-year or seven-year alert. If you change numbers, update the alert. A lender that calls the old number and gets a disconnect may still open the account, or may decline you when you are the real applicant. Either result is a reason to keep the number current. You do not need a new identity theft report just to change a phone number on an alert you already placed.

You can also ask a bureau to remove an alert before it expires. Do that when you placed it by mistake or when you no longer want the extra step. Removing an alert does not remove a freeze. It does not delete disputes you already filed. It does not mean the theft did not happen. If an extended alert was based on a real theft, think before you remove the seven-year version just to make an application faster. You can lift a freeze for a day and keep the alert.

Keep the confirmation that the alert was removed, and check the other two bureaus. A removal request, like a placement request, can lag on one file.

Data-breach letters

A breach notice is a reason to consider an initial fraud alert and a freeze. It is not, by itself, an identity theft report, and it does not create the seven-year alert. The letter may offer monitoring. You can accept or skip that product. The federal tools are still free.

Use the breach as a prompt to pull your reports, not as proof that a particular account is fraudulent. If the reports are clean, an initial alert plus freezes may be enough. If new accounts are already there, move to the identity theft report and the extended alert, and dispute the accounts. The breach letter goes in the folder with the reports. It does not replace them.

Children, mixed files, and the wrong person's alert

A child's file is a different process. Minors often have no file until someone creates one, and the protection that matches that problem is a child freeze, described in how to freeze a child's credit. Do not place an adult extended alert in your own name and assume it covers a child.

A mixed file is when someone else's accounts are blended into yours because of a similar name or Social Security number. An alert will not unmix the file. You still have to dispute the specific accounts that are not yours. The alert can sit on top of that work so new credit is checked more carefully while the mix-up is corrected.

If a bureau attaches your alert to the wrong file, say so. Bring your report, the confirmation number, and the accounts that are not yours. An alert on the wrong person's file does not protect you.

What you will see when you apply for credit yourself

Expect friction. A card issuer may call the alert phone number. A car dealer may tell you the system is "frozen" when you only have an alert, or the reverse. Ask which tool they hit. If it is the alert, answer the phone and have the number ready. If it is a freeze, lift the freeze at the bureau they name. Guessing wastes the appointment.

Applications you make while an alert is on the file can still create hard inquiries. The alert does not hide shopping from the inquiry list. It asks the business to verify you. After you are verified, the inquiry can post as usual.

A decline that cites "unable to verify identity" can be the alert working, or it can be a wrong phone number. It is not evidence that your score is bad. Read the adverse action notice if you receive one, then fix the phone number or lift the freeze and reapply only if you still want the account. Each new application can be a new inquiry.

Military families

The active duty alert belongs to the deployed service member. A spouse who stays home and wants fewer unsolicited offers can use the ordinary prescreen opt-out. A spouse who sees fraudulent accounts needs their own initial or extended alert and their own freeze. Sharing a login or asking the bureau to put one alert on two files is not the process.

If the deployment is extended, put a reminder on the calendar before the one-year alert ends. Renewal is a new request. It is not automatic just because orders are still in effect. Save a copy of the orders with the confirmation in case a bureau asks for them. Requirements vary, so read the prompt on the bureau site you use rather than mailing documents you were not asked for.

What an alert looks like on a report you pull

On your own report, the alert is usually a statement in the personal-information or consumer-statement area, not a tradeline and not a score factor. It may include your phone number. It should not include a full narrative of the theft. If the statement is missing, the alert may not have posted on that bureau yet. If the statement is there and the phone number is wrong, correct it before you rely on it.

Fraud alerts are not public remarks that explain your whole history to a landlord. A landlord who pulls a file may see that an alert exists. That is a reason for them to verify identity, not a reason for you to skip the rental application, and not a substitute for disputing a screening error. Tenant-screening reports can be a different company from the three bureaus. An alert on Equifax does not automatically rewrite a separate screening file.

A folder that matches the alert you chose

Keep one folder, on paper or in a drive you control:

• The alert type you requested and the date
• The bureau you contacted and any confirmation number
• The phone number you registered
• The identity theft report, if you used the extended alert
• The dates you confirmed the alert on the other two bureaus
• The freeze confirmation, if you also froze
• A reminder for one year later, or for the deployment renewal

That folder is what you hand yourself when an application stalls. It is also what you use if you have to show that you asked for the seven-year alert and received the one-year version by mistake.

Alerts do not sort your mail or your existing accounts

A fraud alert will not stop a collector from calling about a real debt, and it will not stop a thief who already has an open card from using that card until the issuer closes it. Call the issuer for a compromised card. Use the alert for new credit applications. Use disputes for tradelines that are already wrong. Using only the alert is how people discover, a year later, that the fraudulent card was never closed.

Also check bank accounts and tax transcripts if the theft went beyond credit. Those systems are outside the three bureaus. This page will not pretend a fraud alert covers them. It will tell you not to skip them because the credit alert felt complete.

If a company asks you to pay to "activate" an alert you already placed for free, that is not the bureau process. The confirmation you saved is the activation.

Order of operations when you are not sure which alert you need

If you are staring at a strange inquiry and you do not yet have a police report or an IdentityTheft.gov report, place the one-year initial alert the same day and pull your reports. If those reports show accounts you did not open, create the identity theft report next and request the seven-year extended alert. If you are deployed, use the active duty alert even if you also suspect fraud, and add the extended alert only when you actually have an identity theft report. You can have a clear reason for the deployment alert and a separate reason for the theft alert. Say which one you are requesting so the bureau does not place a one-year alert when you asked for seven.

Write the request in one sentence: the alert type, the phone number, and, for the extended alert, that an identity theft report is included. Keep a copy. That sentence is enough. You do not need a long story on the form.

Bottom line

Use a one-year initial fraud alert when you need a warning quickly. Use a seven-year extended alert when you have an identity theft report and you want the longer protection and the extra free reports. Use an active duty alert for deployment, and renew it if you are still away. Then confirm all three bureaus show it. If you need the file blocked rather than flagged, add a freeze. None of the alerts deletes accounts that are already wrong.