A federal law that took effect on Sept. 21, 2018, eliminated fees for placing and lifting security freezes at all three nationwide credit bureaus, giving every consumer a free tool to block identity thieves from opening new accounts. The change, codified in 15 U.S. Code Section 1681c-1, requires Equifax, Experian, and TransUnion to process freeze requests at no charge. For anyone who has not yet locked down their credit files, the statute removed the last financial barrier standing in the way.
Why the September 2018 freeze law changed the calculus for consumers
Before the federal mandate, most states set their own rules on credit freezes. Some allowed bureaus to charge fees of $5 to $10 per freeze or per lift, and the patchwork meant that a consumer in one state might pay nothing while a neighbor across the state line paid $30 to freeze files at all three agencies. The federal law wiped out that inconsistency. A reasonable hypothesis is that states with pre-existing free-freeze laws would see faster adoption once the federal rule took effect, because residents there were already familiar with the process. No federal dataset tracking freeze placement volumes by state has been published by the FTC or the Consumer Financial Protection Bureau, so that question remains open. What is clear is that the statute created a single national standard: freezes and lifts are free, full stop.
A credit freeze, sometimes called a security freeze, limits access to a consumer’s credit file, which makes it harder for someone using stolen personal information to pass a credit check. The freeze does not affect existing accounts, credit scores, or the ability to request a free annual credit report. It simply stops new creditors from pulling a file they would normally need to see before approving a loan or credit card. Existing creditors, debt collectors acting on their behalf, and certain government agencies can still obtain reports for specific purposes, but would-be new lenders are effectively locked out unless the consumer lifts the freeze.
How the freeze works at Equifax, Experian, and TransUnion
Each bureau operates independently, so a single phone call or website visit does not cover all three. Consumers must reach out to each credit bureau separately to place a freeze. Requests can typically be made online, by phone, or by mail, and the bureau must implement the freeze within a short period after receiving the information it needs to verify identity. Once the freeze is in place, the bureau confirms in writing or electronically.
Each agency issues a PIN or password that the consumer needs later to temporarily lift or permanently remove the freeze. Losing that PIN can slow the process when a legitimate credit application requires a bureau to release the file. Consumers planning a major purchase can request a temporary lift for a specific creditor or for a set period of time. When that window closes, the freeze snaps back into place automatically, restoring the full block on new access.
The law also introduced free yearlong fraud alerts, which ask creditors to take reasonable steps to verify identity before opening an account but do not fully block access the way a freeze does. Fraud alerts require contact with only one bureau, which then notifies the other two. Freezes offer stronger protection because they lock the file entirely until the consumer acts, while alerts are designed more as a speed bump that encourages extra scrutiny rather than a hard stop.
Businesses that pull credit reports are also affected. The FTC published guidance directed at lenders, landlords, insurers, and other entities that rely on credit checks, reminding them that a frozen file cannot be accessed without the consumer’s consent. That means a legitimate applicant who forgets to lift a freeze before applying for a mortgage or auto loan will face a delay, not a denial, until the file is temporarily unlocked. For that reason, experts advise consumers to build in extra time when shopping for credit so they can lift and reapply their freezes as needed.
Gaps in public data on freeze effectiveness
Neither the FTC nor the CFPB has released aggregate data showing how many consumers have placed freezes since the law took effect, how often freezes successfully block fraudulent applications, or how frequently identity thieves simply move on to targets who have not frozen their files. Public reporting has instead focused on explaining how freezes fit into the broader toolkit of identity theft responses. The Consumer Financial Protection Bureau describes a freeze as a way to stop most new-credit access that depends on credit reports, while emphasizing that it does not prevent all forms of misuse, such as unauthorized charges on existing cards.
Because there is no centralized, public count of freeze usage or outcomes, policymakers and researchers cannot easily measure how the September 2018 law has changed identity theft patterns. It is not yet possible to say, for example, whether free freezes have reduced the number of successful new-account frauds or merely shifted criminal tactics toward other forms of exploitation. Advocates argue that better data collection would help regulators evaluate whether consumers are taking advantage of their new rights and whether additional reforms, such as automatic freezes after major data breaches, might be warranted.
In the meantime, the legal change has clearly altered the basic cost-benefit calculation for individuals. With fees removed and procedures standardized, placing a freeze is now a no-cost, reversible step that consumers can use to guard against one of the most damaging kinds of identity theft. Even without comprehensive statistics, the policy signal is unambiguous: federal law now treats free security freezes as a core consumer protection, and it is up to individuals to decide whether and when to deploy that protection on their own credit files.
