Credit protection works on three layers: the federal liability caps that already apply to your accounts, free tools from the credit bureaus that block or flag new-account fraud, and optional paid services that watch for identity theft beyond your credit file. Knowing how credit protection works means knowing which layer handles which threat, so you don’t pay for something the law already gives you or skip a free step that would have stopped the fraud outright.
What Federal Law Already Covers
Before any product or subscription enters the picture, two federal statutes cap what you can lose to account fraud. The caps are very different for credit cards and debit cards, and the difference matters.
Under the Truth in Lending Act, your maximum liability for unauthorized credit card charges is $50, and only for charges made before you notify the issuer. After you report the card lost or stolen, you owe nothing.1Office of the Law Revision Counsel. 15 U.S. Code 1643 – Liability of Holder of Credit Card Most major issuers advertise zero-liability policies that waive even that $50, though those are voluntary and not required by law.
Debit card fraud is riskier because the money leaves your checking account immediately, and your liability depends on how fast you report it. Under the Electronic Fund Transfer Act:
- Report within two business days and your liability tops out at $50.
- Report after two business days but within 60 days of your statement and liability can reach $500.
- Report after 60 days from your statement and you could lose everything a thief took after that window and before you finally notified the bank.2Office of the Law Revision Counsel. 15 U.S. Code 1693g – Consumer Liability
Even if you did something careless, like writing your PIN on the card, the bank cannot use that as grounds to impose higher liability than these tiers allow.3Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers The practical takeaway: check your bank statements often enough that the 60-day clock never runs out on you.
Credit Freezes: The Strongest Free Tool
A credit freeze blocks lenders from pulling your credit report. Without that report, a creditor almost certainly will not approve a new account, which makes a freeze the single most effective defense against new-account fraud. While a freeze is in place, nobody can open credit in your name, including you.4Consumer Advice. Credit Freezes and Fraud Alerts
Freezing is free at all three bureaus under federal law, whether you’re placing, lifting, or removing the freeze. It doesn’t affect your credit score, and it doesn’t touch your existing accounts. Your current credit cards, mortgage, and auto loan keep working normally. When you actually need to apply for new credit, you temporarily lift the freeze. Bureaus must place a freeze within one business day of your request and lift it within one hour when you request the lift online or by phone.5USAGov. How to Place or Lift a Security Freeze on Your Credit Report
You have to contact each bureau separately. There’s no single portal that covers all three.
Credit locks are a related product the bureaus sell, often bundled with paid monitoring. They do a similar job through a mobile app, sometimes with instant toggling, but they operate under a service agreement rather than federal law. If terms change or something goes wrong, your remedies are weaker than they would be with a statutory freeze. For most people, the free freeze is the better call.
Fraud Alerts: A Lighter Alternative
A fraud alert flags your credit file so lenders are supposed to take extra steps to verify your identity before approving new credit. It doesn’t block access the way a freeze does. You only contact one bureau, and that bureau is required to notify the other two.4Consumer Advice. Credit Freezes and Fraud Alerts
There are three types:
An initial fraud alert is available to anyone, no documentation needed. It lasts one year and entitles you to a free credit report from each bureau.6Office of the Law Revision Counsel. 15 U.S. Code 1681c-1 – Identity Theft Prevention; Fraud Alerts Good first step if you suspect your data has been exposed but haven’t confirmed fraud.
An extended fraud alert lasts seven years and is available to confirmed identity theft victims who can submit proof, such as an identity theft report. It also gets you two free reports from each bureau during the alert period.7TransUnion. Fraud Alerts
An active duty alert is for military servicemembers on deployment. It lasts one year, is renewable for the length of deployment, and removes you from prescreened credit and insurance offer lists for two years.8Military OneSource. FTC Active-Duty Fraud Alert
Alerts are weaker than freezes because they depend on the lender actually following through on identity verification. A freeze mechanically blocks the report. An alert asks someone to double-check. Some lenders are more diligent than others.
Monitoring and Free Credit Reports
Monitoring is a detection tool, not a prevention tool. It watches your credit files at Equifax, Experian, and TransUnion and alerts you to new activity: hard inquiries, new accounts, address changes, and public records like bankruptcies or judgments.9USAGov. Learn About Your Credit Report and How to Get a Copy The point is speed. The sooner you spot unauthorized activity, the sooner you can shut it down.
Free single-bureau monitoring is widely available through banks, card issuers, and the bureaus themselves. The gap: not every creditor reports to every bureau, so monitoring just one file can miss fraud entirely. Paid three-bureau services close that gap, but before you pay for anything, use what’s free. The three bureaus now permanently offer free weekly credit reports at AnnualCreditReport.com, so you can check all three files on a rolling basis without a subscription.10Consumer Advice. You Now Have Permanent Access to Free Weekly Credit Reports
What Credit Protection Doesn’t Cover
Credit protection tools guard what shows up on your credit report: unauthorized credit cards, loans, and inquiries. Several kinds of identity theft never appear there, at least not right away.
Medical identity theft happens when someone uses your information to get healthcare or file insurance claims. Criminal identity theft occurs when someone gives your name during an arrest. Tax identity theft involves filing a fraudulent tax return under your Social Security number to steal a refund. None of these register as credit-file events, so credit monitoring alone won’t catch them.
Paid identity theft plans typically add dark web scanning for exposed login credentials and Social Security numbers, plus restoration specialists who handle cleanup with creditors and agencies. Whether that’s worth a monthly fee depends on your situation. If your data has already been exposed in a major breach, the added monitoring and hands-on restoration help can pay for itself. If your main worry is someone opening a credit card in your name, a free freeze already handles that.
Protecting a Child’s Credit
Children are attractive targets because the fraud can go undetected for years. A child under 18 generally shouldn’t have a credit report at all, so its existence is itself a warning sign.11Consumer Advice. How To Protect Your Child From Identity Theft Red flags include collection calls for accounts you never opened, denial of government benefits because the child’s Social Security number is already in use, and IRS notices about unreported income tied to the child’s number.
Federal law lets parents and legal guardians place a credit freeze on the file of a child under 16. You’ll need to provide proof of authority, such as a birth certificate. For children in foster care, the agency representative provides documentation certifying the child is in the agency’s care.12Consumer Advice. New Protections Available for Minors Under 16 Freezing a child’s credit before anything goes wrong is worth the small effort. Discovering at 18 that someone has been racking up debt on your kid’s Social Security number for years can hold up student loans and first apartments.
If Fraud Happens Anyway
When you find unauthorized activity, the order of your next steps matters.
Start with an initial fraud alert at any one of the three bureaus. That bureau notifies the other two, and you’ll receive a free credit report from each.4Consumer Advice. Credit Freezes and Fraud Alerts If you want stronger protection while you sort things out, place a freeze at the same time.
Next, file a report at IdentityTheft.gov. The FTC’s site generates a personalized recovery plan with pre-filled dispute letters for creditors and bureaus.13Federal Trade Commission. Report Identity Theft The report doubles as your official FTC Identity Theft Report, which you’ll need for disputes and for qualifying for an extended fraud alert. File a police report too, and bring the FTC report with you.
Then dispute the fraudulent items with each bureau and each creditor involved. Written disputes sent by certified mail create a paper trail. A bureau generally has 30 days to investigate, plus five business days to notify you of the results. If you send in additional information during the investigation, the bureau can extend to 45 days.14Consumer Financial Protection Bureau. How Long Does It Take to Repair an Error on a Credit Report?
Tax identity theft has its own track. If someone filed a fraudulent return using your Social Security number, submit IRS Form 14039 to flag your account for the IRS’s specialized identity theft process.15Internal Revenue Service. Form 14039 – Identity Theft Affidavit The credit bureaus can’t resolve it for you.
Recovery isn’t fast. Bureau disputes, creditor investigations, and IRS cases each run weeks to months. Keep records of every letter, confirmation number, and phone call from day one. When a dispute stalls or needs to be escalated, those notes are what get you unstuck.