A federal law that took effect in September 2018 replaced the old 90-day fraud alert with a free, one-year version, giving any consumer the ability to flag their credit file so that lenders must verify the applicant’s identity before opening a new account. The change, driven by the Economic Growth, Regulatory Relief, and Consumer Protection Act, doubled the protection window and eliminated fees that some bureaus had charged for extended alerts. Yet most people who could benefit from this tool have never used it, leaving their credit files exposed to identity thieves who face little friction when applying for accounts in someone else’s name.
How the One-Year Fraud Alert Shifts Risk to Lenders
Before the 2018 law, initial fraud alerts expired after just 90 days, forcing consumers to remember to renew them repeatedly or lose protection. The Federal Trade Commission explained that the new statute extended that window to a full year and made both fraud alerts and credit freezes free nationwide. That single change shifted the burden: instead of consumers scrambling to re-file every three months, creditors now carry a year-long obligation to confirm that the person seeking credit is actually the account holder.
The practical effect is straightforward. When a fraud alert sits on a credit file, a lender that pulls the report sees a notice requiring extra verification, typically a phone call or document check, before approving the application. The FTC’s consumer advice states that fraud alerts make lenders verify identity before granting new credit, and the alert can be renewed once it expires. A thief armed with a stolen Social Security number and address still has to clear that verification step, which is often enough to stop a fraudulent application cold.
The Consumer Financial Protection Bureau reinforces this point in its own materials, noting that creditors must take reasonable steps to confirm the person requesting new credit is the actual consumer when an initial fraud alert is active. That dual-agency confirmation, from both the FTC and the CFPB, makes the one-year alert one of the few consumer protections backed by explicit regulatory language from two federal bodies simultaneously. The CFPB also tells people who suspect fraud to follow specific identity theft response steps, which include contacting the credit bureaus promptly.
Free Credit Reports and State-Level Gaps in Awareness
Placing a fraud alert triggers an additional benefit that many consumers miss. According to Massachusetts state consumer guidance, the three major credit bureaus are required by law to send free credit reports after an alert is placed. That means a single phone call or online request to one bureau, which then notifies the other two, unlocks both a year of identity verification protection and a fresh look at all three credit files for unauthorized activity.
The question of awareness, though, remains uneven. States like Massachusetts that prominently link federal tools such as IdentityTheft.gov on their consumer-protection pages give residents a clear path from suspicion to action. Other states bury the information or omit direct links entirely. No federal agency publishes state-by-state data on how many consumers have placed one-year alerts, but the lack of uniform messaging suggests that usage is likely concentrated in places where state regulators actively promote these protections.
This patchwork of outreach matters because fraud alerts are most effective when they are in place before a thief starts applying for credit. A consumer who only learns about alerts after discovering a fraudulent account has already been opened faces a more complicated cleanup process, including disputes with lenders and potential damage to credit scores. By contrast, someone who understands the tool and activates it promptly after a data breach or lost wallet can force would-be impostors to clear an extra hurdle that many will not bother to attempt.
Fraud Alerts vs. Credit Freezes
The 2018 law also made credit freezes free nationwide, and consumers often struggle to decide whether to use an alert, a freeze, or both. A fraud alert leaves the file accessible to lenders but imposes the verification requirement. A freeze, by contrast, generally blocks new creditors from accessing the credit file at all until the consumer lifts it, which can be more secure but less convenient for people who expect to apply for credit in the near term.
For many, the best approach is layered. A one-year alert can serve as a baseline protection, especially after large data breaches that expose millions of Social Security numbers. A freeze can then be added when someone knows they will not be seeking new credit for a while or wants maximum control over who can access their reports. Because both tools are now free, the main cost is time and attention, not money.
What Consumers Can Do Now
The first step is simply knowing that one-year alerts exist and that they are available to anyone, not just confirmed victims of identity theft. Consumers who have experienced a data breach notice, lost identification, or unusual account activity can contact any one of the three major credit bureaus to place an alert, which will be passed along to the others. Once the alert is active, they should take advantage of the free credit reports that follow, reviewing each file carefully for accounts or inquiries they do not recognize.
Beyond that, regularly revisiting state and federal guidance can help keep pace with evolving scams. Federal resources from the FTC and CFPB, combined with state-level instructions where available, create a framework that is only effective if people know it exists and take the time to use it. The one-year fraud alert is a powerful example of that gap: a stronger, free protection that quietly shifted risk back to lenders, but only for those who actually turn it on.
