Anyone who has had personal data exposed in a breach, or simply wants to prevent identity thieves from taking out credit in their name, can place a security freeze at Equifax, Experian, and TransUnion at no cost. A federal law that took effect in September 2018 made these freezes free nationwide, replacing a patchwork of state rules that sometimes charged consumers fees. The protection works by restricting access to a consumer’s credit file so that most new lenders cannot pull a report, which stops fraudulent account openings before they start.
Why the free federal freeze still matters in 2026
New-account fraud typically begins when a thief applies for a loan, credit card, or utility service using stolen personal information. The lender requests a credit report, and if the file is accessible, the application can sail through. A security freeze breaks that chain. As the Federal Trade Commission explained when the law launched, a freeze “restricts access to a consumer’s credit file, making it harder for identity thieves to open new accounts.” Because the freeze sits on the file itself, it does not affect a consumer’s credit score or prevent use of existing accounts.
The statutory framework behind this protection is codified in 15 U.S.C. 1681c-1, which requires all three nationwide consumer reporting agencies to place, temporarily lift, and remove security freezes under defined timelines and at zero cost. Before the May 2018 Economic Growth, Regulatory Relief, and Consumer Protection Act, many states allowed the bureaus to charge up to $10 per freeze action. Congress eliminated those fees and directed the Consumer Financial Protection Bureau to update Fair Credit Reporting Act model disclosures so that every consumer receives written notice of the freeze right.
One common point of confusion is the difference between a freeze and a credit lock. The CFPB has noted that only a security freeze, not a paid lock product marketed by the bureaus, carries the federal guarantee of free placement and removal. Lock products may offer convenience features such as app-based toggling, but they operate under the bureaus’ own terms of service rather than federal statute. For consumers deciding between the two, the legally defined freeze is the baseline protection that cannot be withdrawn or repriced by a private contract.
Freeze mechanics and what federal records confirm
Under the statute, each bureau must place a freeze within one business day of receiving an online or phone request. Lifting a freeze temporarily, for example when a consumer applies for a mortgage or a new cell phone plan, must also happen within one business day of an electronic request. Requests submitted by mail follow a longer timeline of three business days. Removal of a freeze is likewise free and subject to the same deadlines. These operational requirements give consumers control over when and how their files become accessible without paying recurring subscription fees.
The CFPB issued updated Fair Credit Reporting Act model disclosures requiring the bureaus to inform consumers about the freeze option whenever they provide a credit report or adverse-action notice. That regulatory step was designed to close an awareness gap: many people eligible for a free freeze simply did not know the option existed. Consumers who suspect identity theft can also file reports through IdentityTheft.gov, the FTC’s centralized portal for creating recovery plans and generating letters to send to creditors and credit bureaus.
In its consumer education, the CFPB describes a security freeze as a way to block most new creditors from accessing your file unless you lift the restriction in advance. The bureau’s plain-language guidance on what a freeze does underscores that existing creditors, certain government agencies, and collection firms may still have limited access, so the measure is not a complete privacy shield. Instead, it is a targeted tool aimed at stopping new-account fraud, which remains one of the most damaging forms of identity theft.
Freeze versus fraud alerts and locks
The 2018 federal law also extended the duration of initial fraud alerts from 90 days to one year. A fraud alert tells potential lenders to take extra steps to verify identity before opening new credit, but it does not block access to the file the way a freeze does. For victims of identity theft, an extended alert can last seven years, yet even that stronger flag still allows reports to be pulled. By contrast, a freeze assumes “no access” as the default until the consumer chooses otherwise.
The CFPB has cautioned that paid lock services are optional add-ons, not substitutes for the rights Congress created. Its public blog on free freezes emphasizes that consumers should not feel pressured to buy a lock in order to receive the core protections of a freeze. For many households, using the free statutory tool at all three bureaus and lifting it only when necessary offers a strong, low-maintenance defense against new-account fraud.
Practical steps for consumers in 2026
To use this protection effectively, consumers should place a freeze separately with Equifax, Experian, and TransUnion, keeping track of login credentials or PINs for each. Before applying for credit, they can either lift the freeze for a specific creditor or open a time-limited window during which applications are allowed. Afterward, they can restore the freeze at no cost. Combined with regular review of bank and card statements and prompt response to any suspected misuse, the federal freeze remains a central tool for limiting the damage from data breaches and identity theft in 2026.
