A security freeze on your credit report tells Equifax, Experian, and TransUnion to stop releasing your file to anyone trying to open a new account in your name. Since September 2018, federal law has made both freezing and unfreezing free at all three nationwide bureaus, and it sets strict deadlines for the bureaus to act on your request.1Office of the Law Revision Counsel. 15 USC Chapter 41, Subchapter III – Credit Reporting Agencies A freeze doesn’t touch your credit score, doesn’t affect your existing accounts, and can be lifted quickly when you need it lifted.
What a Freeze Actually Blocks
When a freeze is in place, the bureau is prohibited from releasing the contents of your credit report to a party requesting it to open a new credit account.2Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts Because almost every lender pulls a report before approving an application, that block is what stops an identity thief from taking out a credit card or loan using your Social Security number.
You have to place the freeze at each bureau separately. Freezing your file at Experian does nothing at Equifax or TransUnion, and a lender who happens to check whichever bureau you skipped can still approve a fraudulent application.3Federal Trade Commission. Credit Freezes and Fraud Alerts Three requests, three confirmations.
It’s Free, and the Bureaus Have Deadlines
Section 301 of the Economic Growth, Regulatory Relief, and Consumer Protection Act amended the Fair Credit Reporting Act to require every nationwide bureau to place and remove freezes free of charge.1Office of the Law Revision Counsel. 15 USC Chapter 41, Subchapter III – Credit Reporting Agencies Before that law took effect, states allowed bureaus to charge $5 to $20 per freeze action. No longer.
The same statute sets response windows the bureaus must meet:
- Place a freeze online or by phone: within one business day.
- Place a freeze by mail: within three business days of receiving the request.
- Lift a freeze online or by phone: within one hour.
- Lift a freeze by mail: within three business days.
The one-hour lift is the detail most consumers don’t know about. If you’re at a car dealership or on the phone with a loan officer and a lender needs to pull your report, you can log in from your phone and the bureau is legally required to act within 60 minutes.
How to Place a Freeze
You can submit the request online, by phone, or by mail at each bureau. Online and phone requests trigger the one-business-day deadline; mail gives the bureau up to three.4USAGov. How to Place or Lift a Security Freeze on Your Credit Report You’ll need to provide:
- Your full legal name, including any suffix.
- Your Social Security number.
- Your date of birth.
- Your current address and every address from the past two years.
Mail requests usually require a copy of a government-issued ID and proof of your current address, such as a utility bill or bank statement.5Annual Credit Report.com. Security Freeze Basics
Once the freeze is in place, the bureau must send you written confirmation within five business days.6Consumer Financial Protection Bureau. What Is a Credit Freeze or Security Freeze on My Credit Report? That confirmation typically includes a PIN or password you’ll use to manage the freeze later. Keep it somewhere secure. If you lose it, each bureau has a recovery process, but it adds friction at exactly the wrong moment, usually when you’re trying to close on a loan.
Lifting the Freeze When You Need Credit
When a lender, landlord, or other party needs to see your file, you can lift the freeze temporarily for a set window or remove it permanently. Both are free.
Most bureaus let you manage the freeze through the same online account you used to place it. Some allow you to open access to a specific creditor; others simply open a time window, after which the freeze reactivates automatically. If you’re applying for a mortgage or auto loan, ask the lender which bureau they intend to pull so you can lift only that one.
Each bureau handles authentication a little differently. Equifax allows account-based online management without a PIN. TransUnion accepts account credentials online but still asks for a PIN on phone requests. Experian offers an online PIN recovery form with identity-verification questions. The statute requires the bureaus to give you a way to manage the freeze; it doesn’t dictate the exact mechanism.
What a Freeze Doesn’t Stop
A freeze is targeted at new-account credit checks. Several categories of access continue even while the freeze is active, and this is where consumers often get surprised.7Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
- Companies you already have accounts with can pull your file for account maintenance, credit line changes, monitoring, and upgrades. Collection agencies working on those accounts have the same access.
- Federal, state, and local agencies can access your report under a court order, warrant, or subpoena. Child support agencies, tax collectors, and fraud investigators also qualify when their purpose is permissible under the FCRA.
- Insurance underwriting, employment background checks, and tenant screening are not blocked by a freeze. An employer running a pre-hire credit check, a landlord screening you, or an auto insurer pricing your policy can still see your file.
- Your own requests for your report, credit monitoring services you’ve subscribed to, and prescreened credit and insurance offers are also unaffected.
If you want to shut off prescreened offers, that’s a separate action through OptOutPrescreen.com or 1-888-5-OPT-OUT.
The three nationwide bureaus also aren’t the only companies keeping files on you. Specialty consumer reporting agencies collect data for narrower uses, and a freeze at the big three doesn’t touch them. ChexSystems is checked by roughly 80% of banks and credit unions before opening a deposit account. The National Consumer Telecommunications and Utilities Exchange screens applicants for phone and utility service. LexisNexis feeds risk assessment at banks and insurers. Each of these accepts freeze requests through its own channels. Covering only the big three leaves gaps.
Security Freeze vs. Credit Lock
Each of the three bureaus sells a product called a credit lock, sometimes bundled into a paid subscription with monitoring and identity theft insurance. A lock does roughly the same thing as a freeze, but the legal footing is different.
A freeze is a right created by federal statute. If a bureau mishandles it, you can sue under the FCRA. A lock is a commercial product governed by the bureau’s terms of service; your recourse is whatever the contract provides. The Consumer Financial Protection Bureau has said credit locks are “no more effective than security freezes, which are free and which you have a right to by law.”6Consumer Financial Protection Bureau. What Is a Credit Freeze or Security Freeze on My Credit Report?
Fraud Alerts as a Lighter Option
A fraud alert is a different tool. It leaves your file accessible but flags it, telling lenders to verify your identity before extending credit. You only need to contact one bureau; that bureau must notify the other two.2Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
An initial fraud alert is available to anyone and lasts one year. An extended alert lasts seven years but requires an identity theft report filed through the FTC at IdentityTheft.gov or a police report; it also removes you from prescreened offer lists for five years and entitles you to two free credit reports from each bureau in the first 12 months.3Federal Trade Commission. Credit Freezes and Fraud Alerts Active duty service members can request a military-specific alert that lasts at least 12 months and excludes them from prescreened offer lists for two years.
Freezes for Children and Incapacitated Adults
The 2018 law created a “protected consumer” category for children under 16 and adults with legal guardians or conservators.8Federal Trade Commission. New Protections Available for Minors Under 16 Children rarely have credit files, which is precisely why their Social Security numbers are attractive to thieves; misuse can go unnoticed for years.
If a bureau has no file on a protected consumer, it must create one solely to apply the freeze, and that record cannot be used for credit purposes. A parent requesting a freeze for a child needs to submit proof of authority such as a birth certificate. Guardians need court-ordered guardianship papers. Child welfare or probation agencies can request a freeze for a child in their care with agency documentation.
If a Bureau Doesn’t Comply
The FCRA lets you sue in federal or state court when a bureau fails to meet its obligations, including the freeze placement and lift deadlines. For willful violations, you can recover actual damages or statutory damages of $100 to $1,000, whichever is greater, plus possible punitive damages and attorney’s fees and court costs.9Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance For negligent violations, you can recover actual damages and fees and costs, but no punitive damages and no statutory floor.10Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance
Actual damages are the practical hurdle. If a bureau takes two days to place your freeze instead of one and nothing bad happens in that gap, your damages may be zero. If the delay leads directly to a fraudulent account, the picture is different. You can also file complaints with the Consumer Financial Protection Bureau and the Federal Trade Commission, both of which have enforcement authority over the credit bureaus and can pursue patterns of noncompliance that wouldn’t support an individual suit.