How long does a fraud alert last?

In the US, an initial fraud alert lasts one year, an extended fraud alert lasts seven years, and an active duty alert for service members lasts one year. All three are free and can be placed again when they run out. A credit freeze, which many people confuse with an alert, has no expiry at all: it stays until you lift it. If you read that a fraud alert lasts 90 days, the source is out of date. That was the rule until September 21, 2018, when a federal law stretched the initial alert to a full year.

The time limits side by side

The table gathers the four US options from the Fair Credit Reporting Act and the FTC, then the nearest equivalents in the UK, Canada and Australia, where the same idea runs on very different clocks. Read the third column before the second: the length of an alert matters less than who is allowed to get one.

Note what the rows share: the longest US alert goes to people already hit, not to the worried, and no alert of any length blocks as much as a freeze.

Why you still read "90 days"

Both answers circulate because both were true. Before 2018 the initial fraud alert lasted 90 days, and years of articles and bank leaflets repeated it. The Economic Growth, Regulatory Relief, and Consumer Protection Act changed it. In the FTC's words when the change took effect on September 21, 2018, "the new law extends the duration of a fraud alert on a consumer's credit report from 90 days to one year." The same law made freezes free everywhere, including for children under 16.

The statute now reads that an initial alert stays in the file for "not less than 1 year", so one year is the floor, not a cap. Any page still quoting 90 days, or telling you to renew every three months, was written for the old rule.

Initial, extended or active duty: which one you can get

The initial alert is the one most people place. You need nothing more than a good faith suspicion: a breach letter, a lost wallet, a phone call from a spoofed number that asked for your Social Security number. You contact one of the three nationwide bureaus (Equifax, Experian or TransUnion) and that bureau must pass the alert to the other two. It also entitles you to a free copy of your file from each. After a breach, what a breach notice actually tells you shows which fields leaked, and that decides whether an alert is enough.

The extended alert lasts seven years and is only for confirmed victims. The bureau will ask for an identity theft report, meaning the report you file with the FTC. In return you get stronger protection: a lender must contact you in person or by the contact method you put on the alert before approving credit, you can get two free copies of your file from each bureau in the first 12 months, and the bureaus take you off the lists used for prescreened credit and insurance offers for five years. If you are still working out whether you are a victim, the early signs of identity theft lists the letters and declined applications that usually give it away.

The active duty alert lasts at least 12 months for service members and can be renewed to match a deployment.

One asymmetry trips people up. Adding an alert at one bureau covers all three, but Experian notes that removing one early means contacting each bureau separately.

A freeze does not expire, and that changes the choice

A fraud alert asks lenders to be careful. A credit freeze stops them pulling your file at all, which in practice means nobody can open new credit in your name. The FTC puts the difference in one line: a freeze "lasts until you lift it". It is free, it does not affect your credit score, and the law sets how fast the bureaus must act.

• Placing a freeze: within 1 business day of an online or phone request, 3 business days by mail.
• Lifting it: within 1 hour of an online or phone request, 3 business days by mail.

That one hour is why the freeze is the better default for most people. The old case for an alert was that a freeze got in the way of applying for credit; now the cost is a few minutes before you apply. The catch is that a freeze is per bureau: unlike an alert, there is no single request that covers all three. The breach checklist in priority order puts the freeze straight after passwords for exactly this reason.

Outside the US: two years, six years, 21 days

United Kingdom. There is no statutory alert. The nearest thing is Cifas Protective Registration, a warning flag on your details in the National Fraud Database. It costs £30 for two years, it does not renew itself, and to keep it you reapply. Organizations carry out extra checks, so genuine applications can take slightly longer. It does not affect your credit score, and each person at an address must register separately.

Canada. Equifax Canada and TransUnion both keep a fraud alert on file for six years. Equifax offers two kinds: an identity alert that anyone can add, with a statement and a phone number, and a fraud alert for confirmed victims. Both are free. Equifax says lenders in Manitoba and Ontario are legally required to call before extending credit when an identity alert is on file; elsewhere in Canada they are encouraged to but need not. The two bureaus are separate, so place the alert with each.

Australia. The tool is a ban period, and it is short. According to the privacy regulator, the OAIC, a ban "will last for 21 days" after your request, but the credit reporting body must extend it if it believes you have been or are likely to be a victim of fraud, and there is no limit on extensions. It must warn you at least 5 business days before the ban ends, and you can ask one of the three bodies to pass the request to the other two. During a ban it may be harder for you to get credit too.

Where these numbers stop

This is general information, not legal or financial advice for your situation. An alert or freeze only touches credit files. It does nothing about accounts you already have, so a thief with your banking password is not slowed down at all; that is a job for locking down the email account that resets everything, then the bank. Fraud on a card or a transfer you made runs on its own clock, covered in how long you have to report fraud to your bank.

What to do before it runs out

1. Write the end date down today. One year from the day you placed an initial alert, two years from a Cifas registration, 21 days from an Australian ban. A calendar reminder a week before is the whole system.
2. Decide whether you still need it. If nothing odd has happened, a freeze you lift when needed is less work from here on. If fraud has happened, ask for the extended alert instead, alongside the freeze.
3. Check the phone number on it. Every alert relies on a lender reaching you. If the number has changed, update it at each bureau before you renew.
4. Pull your reports while they are free. Read the copies each alert entitles you to for accounts you did not open.
5. Report what you find. An unfamiliar account belongs with the lender, the bureau and the authorities, and who to report fraud to and what each can do sets out the order.