How to Freeze Your Credit: Step by Step for the US, Canada and UK (Plus Australia)

A credit freeze is the strongest free way to stop someone opening new credit in your name, and in the United States you can place one at Equifax, Experian and TransUnion at no cost, at any time. In Canada the equivalent is a security freeze or "credit lock" that is currently limited to certain provinces, in the UK the closest tools are Cifas Protective Registration and a password-protected Notice of Correction, and in Australia it is a "ban period" requested from the credit reporting bodies. This guide walks through each country step by step, shows how to lift a freeze, and explains what none of them can stop.

The details below were read from official and regulator pages on 9 November 2026. Fees, provinces and procedures change, so treat this article as a map and check the official page for your country before you act. Where the sources disagree or we could not load a page, we say so.

Freeze, fraud alert and lock: what is the difference?

The three terms are often used as if they meant the same thing. They do not, and picking the wrong one is the most common mistake people make.

• Credit freeze (security freeze): a legal restriction on who can see your credit file. While it is on, a lender cannot pull your report to approve a new account, so a thief using your details is normally turned away. It stays until you remove it.
• Fraud alert: a flag on your file that tells lenders to take extra steps to confirm it is really you. Your report can still be viewed, so it is a speed bump, not a wall.
• Credit lock: usually a bureau product that does a similar job to a freeze, often managed in an app. In the US it is a commercial feature that is not the same legal creature as a freeze. In Canada the word "lock" is the official term used by Equifax Canada in Quebec and Ontario.

Before you start: what you will need

Have these ready before you open any bureau website. Identity checks fail mostly because people guess at details.

• Your full legal name, current address and any addresses from the last two years or so.
• Your date of birth and your national identifier where the country uses one (for example a US Social Security number where the bureau asks for it).
• A phone that can receive a one-time code, and an email address you still control. If your email is compromised, secure it first with the steps in our guide to setting up two-factor authentication.
• A password manager. Each bureau account needs a unique password, and some give you a PIN or a freeze credential you must keep. Our password manager guide explains how to store them.
• A photo of an ID and a recent utility bill or bank statement, in case the online identity check sends you to a mail-in form.

Only ever start from the bureau's own address typed into your browser or from a government page. Scammers buy search ads that imitate bureau sites, and a fake "freeze" page is a good way to hand over exactly the data you are trying to protect.

United States: how to freeze your credit

According to the FTC, there is no cost to place or lift a credit freeze, it does not affect your credit score, and anyone can do it at any time, even without being a victim. The freeze lasts until you lift it. You must contact each of the three bureaus separately: Equifax, Experian and TransUnion.

Step by step

1. Create an account at each bureau. Use the bureau's official site: equifax.com, experian.com and transunion.com. Equifax manages freezes through a myEquifax account or by phone, and TransUnion has an online service center.
2. Choose "freeze" or "security freeze", not a paid "lock" subscription. Equifax states it will not let you hold both a freeze and a lock at the same time. Pick the free freeze unless you have a specific reason to prefer the app-style lock.
3. Save the confirmation and any PIN. Store it in your password manager.
4. Confirm each freeze is on. Log in again or check the confirmation email. Do not assume that freezing one bureau covers the others. It does not.

The CFPB says the bureaus must place a freeze within one business day when you request it by phone or secure online means, and within three business days of receiving a mailed request. A written confirmation must follow within five business days.

Fraud alerts in the US

The FTC describes three kinds of fraud alert, all free. An initial alert lasts one year and you can ask any one bureau, which must pass it to the other two. An extended alert lasts seven years and requires an FTC identity theft report from IdentityTheft.gov or a police report. An active duty alert is for service members. A fraud alert does not stop lenders seeing your file, so it works best as an add-on to a freeze, not a replacement.

How to lift or thaw a US freeze

When you need to apply for a mortgage, a card, a car loan, a phone contract or sometimes a rental, ask the lender which bureau it will check. The FTC suggests lifting the freeze only at that bureau, and then putting it back afterwards. The CFPB says a temporary lift or removal must happen within one hour when requested by phone or secure online means, and within three business days by mail, and you can lift it for a set period. In practice most online lifts are instant. Set a calendar reminder for the day the lift ends if your bureau does not re-freeze automatically.

Canada: security freeze, credit lock and fraud alerts

Canada is the awkward one, because credit bureau rules are set provincially and the Government of Canada does not regulate the bureaus. The Financial Consumer Agency of Canada (FCAC) page, last modified 1 July 2026, says that in some provinces or territories you may be able to place a security freeze, which may also be called a credit freeze or credit lock, and that you should contact Equifax and TransUnion to see if you qualify. It also tells you to remember to remove the freeze before applying for credit or a loan.

Which provinces can freeze right now?

Based on what the bureaus themselves publish as of 9 November 2026:

• Quebec: Equifax Canada says consumers in Quebec have had the right to lock their credit reports since 1 February 2023 under that province's Credit Assessment Agents Act.
• Ontario: Equifax Canada says Ontario residents can lock their credit reports from 1 July 2026 under the Better for Consumers, Better for Businesses Act. Equifax's June 2026 announcement states the lock is free and has no effect on your credit score.
• Other provinces and territories: Equifax says the lock function is currently only available to Quebec and Ontario residents, and that it is ready to work with other provinces as they introduce legislation. In those provinces, rely on fraud alerts and monitoring for now, and check again regularly.

TransUnion Canada's freeze page, as shown in a search result retrieved the same day, states that placing, suspending or removing a freeze is free and is available to consumers in Ontario and Quebec. We could not load TransUnion Canada's page directly (the site blocked our automated fetch), so confirm the current wording yourself.

Step by step in Canada

1. Check your province. Your address on file must be in Quebec or Ontario. Equifax says if your credit file does not show a current Quebec or Ontario address, you must correct it first.
2. Lock at Equifax Canada. Create or sign in to a myEquifax account, open the credit lock section and press Lock. You can also call or mail a form to Equifax Canada Co., National Consumer Relations, Montreal, using the Quebec or Ontario form on its site. Equifax says there is no charge.
3. Freeze separately at TransUnion Canada. TransUnion says it does not share your freeze with Equifax, and Equifax does not share with TransUnion, so you must do both.
4. Add fraud alerts at both bureaus if you suspect fraud. The FCAC says a fraud alert makes lenders contact you and confirm your identity before approving credit, and lists reasons such as a stolen wallet, ID or phone, or a home or vehicle break-in. It warns the bureaus may ask for identification and may charge a fee, so ask before you proceed.
5. Report the fraud. The FCAC tells you to contact the affected lender and report the fraud to the National Fraud Reporting System.

Lifting a Canadian lock

Equifax says you must unlock to apply for new loans, increased credit limits and similar uses such as a car lease or a phone contract. Online it is the same page with an Unlock button. Equifax also notes that once you fully unlock, you cannot lock again unless you have an active Quebec or Ontario address. Locks made while you lived in those provinces remain on if you move, until you unlock.

United Kingdom: Cifas, Notice of Correction and what replaces a freeze

The UK does not have a statutory freeze like the US. Instead there are two tools that work differently. Neither blocks the credit reference agencies from showing your report. Both aim to make lenders slow down and verify you.

Cifas Protective Registration

Cifas says that for £30 for two years it places a warning flag against your name and details in its National Fraud Database. Organisations that use Cifas data then carry out extra checks to make sure it really is you applying. Cifas states it does not affect your credit score, and that it is a fraud prevention measure, not insurance against losses.

1. Check the conditions on the application page. Cifas's application states you need a UK address, a UK card in your name and that you are over 14. It does not take applications by phone, and it offers the service for individuals only.
2. Apply online only at cifas.org.uk. Avoid any site that offers the same thing for a higher price.
3. Diary the renewal. Cifas says the registration lasts 24 months unless you ask for removal, and you will not receive an email when it expires. You must reapply to renew.

The downside is that your own genuine applications can take a little longer while members run the extra checks. Cifas describes the service as intended for people whose identities are at heightened risk, such as after lost documents or a data leak.

Notice of Correction, including a password

The Information Commissioner's Office explains that a notice of correction is a statement of up to 200 words that you can ask a credit reference agency to add to your file, and that anyone who looks at the entry will see it. Consumer-advice sources go further: Checkmyfile describes a "Password Notice of Correction", where you add a password of your choice, so credit applications in your name need the correct password. The trade-off, per the same source, is that applications usually need manual review, so your own applications can be slower.

How to do it, in order:

1. Contact Experian, Equifax and TransUnion in the UK. Lenders use different agencies, so a notice at only one can be missed.
2. Say you are a victim of identity theft or at risk, and ask for a notice, with a password if offered.
3. Report the crime through Report Fraud (formerly Action Fraud), per Checkmyfile.
4. Ask each agency for your statutory report, which by law is free, and check for accounts you do not recognise.

We did not find an official page stating that every agency offers the password variant as a standard product, so ask each agency directly. Also check whether the bureau offers its own paid "protective" subscription, and compare it against the free options above before buying.

Australia: credit ban periods

The Office of the Australian Information Commissioner (OAIC) says that if you have been, or are likely to be, a victim of fraud, you can ask a credit reporting body to place a ban on your consumer credit report, which stops it using or disclosing the information for a credit check. The OAIC names three bodies: Equifax, Experian and illion, and recommends you make the request to all of them. IDCARE's fact sheet refers to two agencies, so the OAIC list is the one to follow.

1. Request the ban online. The OAIC page links to application forms for each body. It says you can ask one body to pass the request to the other two, and that requesting a ban or an extension is free.
2. Note the 21 days. The initial ban period lasts 21 days. The body must notify you at least five business days before it ends and tell you what information it needs to support an extension.
3. Request an extension before it lapses. The OAIC says there is no limit on how many times it can be extended if the body believes you are, or are likely to be, a fraud victim. Equifax Australia says an extension can run up to 12 months and asks for a police or cyber report reference number or other supporting information. Experian Australia's page states the extension period is 12 months. IDCARE suggests asking at least 10 days ahead, and Equifax says at least five days.
4. Lift it for credit applications. Equifax Australia says that if you apply for credit during a ban, providers cannot access your report, which may affect your application, so lift it first and re-apply for the ban afterwards.

Reports are made through the Australian Cyber Security Centre's ReportCyber service, and IDCARE (1800 595 160 in Australia, per its fact sheet) offers free identity support. Because the 21 day default means a ban simply expires if you do nothing, put the dates in your calendar.

What a freeze does not stop

A freeze is powerful, but narrow. It addresses new credit opened using your file. It does not cover many of the ways identity theft actually happens.

• Existing accounts. The CFPB notes creditors of accounts you already hold, certain government agencies and monitoring companies you hired can still see your file. Someone who takes over your bank or card account is not stopped by a freeze.
• Non-credit uses. The CFPB says the federal free-freeze law does not apply to a request for your report for employment, tenant screening or insurance.
• Other bureaus. Freezing one bureau does not freeze the others, in any country listed here.
• Tax, benefits and medical identity fraud. A fraudster can file a return or claim a benefit without touching your credit file. Use the tax and benefits protections offered by your national agency.
• Account takeover. Phishing, SIM swaps and stolen passwords bypass credit checks completely. This is where MFA and a password manager matter. Our MFA guide and the recovery steps in what to do if your phone is hacked cover that gap.
• Existing damage. A freeze is not a cleanup. If fraud has already happened, follow our identity theft recovery guide.

Freezing your child's credit

Children are attractive targets because nobody checks their files for years. In the US, the FTC says if your child is under 16 you can request a free credit freeze, and that it stays in place until you ask the bureaus to remove it. The process for a minor differs from the adult one, and each bureau publishes its own instructions (Experian, Equifax and TransUnion, linked from the FTC page). The CFPB adds that if the bureau has no file on the child, it will create a record that cannot be used for credit purposes but is frozen to protect against theft.

For Canada, the UK and Australia we did not find official pages offering a dedicated child freeze, so check with each bureau. Cifas's form says you must be over 14 to apply for Protective Registration yourself, so a younger child would need a different route.

After a data breach: the order of operations

If a company tells you your data was exposed, resist the urge to do everything at once. Work in this order:

1. Secure the accounts first. Change the password on the breached service and on anything that shares it, and switch on MFA. Start with email, because it resets everything else.
2. Freeze or ban your credit files. US: all three bureaus. Canada: both bureaus if you live in Quebec or Ontario. UK: Cifas and notices of correction. Australia: ban with all three bodies.
3. Add fraud alerts where a freeze is not available, for example in other Canadian provinces.
4. Get your reports and read them. Look for accounts, addresses or inquiries you do not recognise. The FCAC suggests checking with both Canadian bureaus.
5. Watch your existing accounts with transaction alerts, since a freeze will not protect them.
6. Report and document. US: IdentityTheft.gov. Canada: National Fraud Reporting System. UK: Report Fraud. Australia: ReportCyber and IDCARE. Keep a dated log.
7. Calendar the expiries. UK Protective Registration lasts two years, Australian bans lapse after 21 days unless extended, and US fraud alerts last one year unless renewed.

Be sceptical of any breach email that pushes you to click a link. Use the company's official site and our guide to warning signs that your computer is hacked if something else feels off.

Should you pay for credit monitoring or identity protection?

Probably not as a first step. The freezes and bans described above are free in the US, free where available in Canada, free in Australia, and cost £30 for two years in the UK through Cifas. Monitoring tells you after something changes, while a freeze prevents new accounts, so they do different jobs. The FCAC says monitoring usually costs money, though some institutions offer it free after a data breach. Equifax Canada's own page lists identity protection plans at paid monthly prices, so if you buy one, make sure you know what the free freeze already gives you.

When to ask for help

Most people can do all of this alone in about an hour. Ask for help if you are locked out of the email address tied to a bureau account, if you suspect your phone number has been hijacked, or if you want someone to check your devices for malware before you log in to a bureau. IT Cares offers remote help and a 60-minute Expert Consultation at 119.99 CAD (taxes extra). You can book a session online. We cannot place a freeze for you, because identity checks must be done by you, but we can help secure the devices and accounts around it.

Official resources worth bookmarking

• FTC (US): Credit Freezes and Fraud Alerts, page dated August 2025.
• CFPB (US): What is a credit freeze or security freeze on my credit report?, last reviewed September 2025.
• FCAC (Canada): Checking your credit report for errors and fraud.
• Cifas (UK): Protective Registration.
• OAIC (Australia): Fraud and your credit report.

Check the official page, rules change. Several of the Canadian provincial rules changed in 2026 alone.

Frequently Asked Questions

What to do next

1. Pick your country above and place the freeze, ban or registration today. Do not lose the PINs or expiry dates.
2. Turn on MFA for email, banking and every bureau account.
3. Pull your credit reports and read them line by line.
4. If fraud has already happened, follow the identity theft recovery guide.