Any consumer in the United States can pick up the phone, call one of the three major credit bureaus, and place a fraud alert that lasts a full year at no cost. That single action triggers a federal requirement: any lender pulling the consumer’s credit report must verify the applicant’s identity before opening a new account, issuing an additional card, or raising a credit limit. The protection has been available since September 21, 2018, when a federal law extended the old 90-day alert to a full year and eliminated fees, yet many people still do not use it.
Why the one-year fraud alert changes the credit-opening process
A fraud alert works differently from a credit freeze. A freeze blocks access to the credit file entirely, which stops both thieves and legitimate lenders. A fraud alert keeps the file accessible but adds a verification step that forces the creditor to confirm the applicant is who they claim to be. That distinction matters for anyone who wants to keep applying for credit while still raising a barrier against unauthorized accounts.
The legal foundation sits in the federal fraud alert statute, which requires consumer reporting agencies to maintain an initial fraud alert for not less than one year. A parallel codification at 15 U.S.C. 1681c‑1 spells out that when a consumer report includes such an alert, any business using that report must take reasonable steps to verify the consumer’s identity before granting new credit or increasing existing credit. Banks, credit unions, auto lenders, and credit card issuers all fall under this obligation.
The friction is deliberate. When a lender encounters the alert, the lender must take extra steps, often contacting the consumer at a phone number the consumer provided when placing the alert. That added step slows down applications, which is exactly the point for someone worried about identity theft. For a consumer who has never frozen their credit, even this modest speed bump can reduce the chance that a fraudulent application sails through unchallenged.
Because the alert does not lock the file, it also avoids some of the hassles associated with freezes, such as temporarily lifting the freeze for each new application or dealing with separate PINs or passwords at each bureau. Consumers who apply for credit only occasionally may still prefer a freeze, but for people who anticipate shopping for a mortgage, auto loan, or new credit cards, the one-year alert offers a compromise between security and convenience.
Federal agencies that enforce the verification requirement
Three separate federal bodies have published guidance confirming what lenders must do when a fraud alert appears. The Consumer Financial Protection Bureau explains that creditors must take steps to verify the consumer’s identity before opening a new account, issuing an additional card, or increasing a credit limit whenever a fraud alert or active duty alert is present in the file. The Federal Deposit Insurance Corporation’s compliance examination manual reinforces that the Fair Credit Reporting Act requires identity verification by users of consumer reports when the report includes a fraud alert, and examiners can cite violations if institutions fail to follow those rules.
The Federal Trade Commission, which announced the 2018 changes, confirmed that the law extended fraud alert duration from 90 days to one year while making both fraud alerts and credit freezes free nationwide. In its 2018 press release, the agency emphasized that consumers could now place and renew alerts without paying fees and that lenders would be required to take additional steps to confirm identity before granting credit when such alerts are present.
Placing the alert requires only one contact. A consumer reaches out to any one of the three nationwide credit bureaus, and that bureau is required to notify the other two. The alert then appears on all three credit files. When it expires after one year, the consumer can renew it by making another request. There is no statutory limit on how many times a consumer can renew, allowing ongoing protection for as long as identity theft remains a concern.
Gaps in compliance data and open questions
The legal requirement is clear, but how consistently lenders actually follow through is harder to measure. No federal agency has published aggregate data showing how many fraud alerts are active nationwide in any given year, and no public enforcement action has specifically cited a lender for mishandling fraud alerts as a standalone issue. Instead, fraud alert compliance tends to appear, if at all, as one element within broader examinations or settlements involving credit reporting practices, data security failures, or unfair and deceptive acts.
This lack of granular data leaves open several questions. It is unclear how often lenders are unable to reach consumers at the contact numbers listed with the alert, how many applications are ultimately declined because verification fails, or how frequently criminals still manage to exploit weak identity checks despite the alert’s presence. Consumers also have little visibility into how different lenders interpret “reasonable steps” to verify identity, a standard that can vary depending on the institution’s risk tolerance and technology.
For now, the one-year fraud alert remains an underused but powerful tool. It does not replace the stronger protection of a full credit freeze, and it cannot prevent every form of identity misuse, such as existing-account takeover or certain types of loan fraud that do not rely on traditional credit reports. Yet for consumers who want a balance between security and convenience, the alert adds a federally backed verification hurdle at the precise moment a new account might otherwise be opened in their name. Until regulators release more detailed compliance data, its true effectiveness will be hard to quantify, but the legal framework gives consumers a straightforward way to tilt the process in their favor.
