Anyone who has had personal data exposed in a breach faces a straightforward question: how do you stop someone from opening a credit card or loan in your name? Federal law already provides a free tool that blocks exactly that, yet most consumers have never used it. A security freeze placed at Equifax, Experian, and TransUnion prevents creditors from pulling a credit report, and without that report, new accounts simply do not get approved. The mechanism became free nationwide on September 21, 2018, under the Economic Growth, Regulatory Relief, and Consumer Protection Act, and it remains one of the strongest defenses against new-account fraud available to any adult in the United States.
How a credit freeze blocks new-account fraud at all three bureaus
The logic behind a freeze is direct. Lenders check a consumer’s credit file before approving an application. When a freeze is active, the bureau refuses to release that file. Because creditors will not typically extend credit without reviewing a report, according to FTC guidance, a thief holding stolen Social Security numbers or addresses hits a wall. The application stalls or gets denied outright.
Section 605A of the Fair Credit Reporting Act spells out the requirement. Upon a consumer’s direct request and proper identification, a consumer reporting agency must place a security freeze free of charge. The statute also sets a speed standard: bureaus must activate the freeze within one business day when the request comes by phone or through a secure electronic channel, as the Consumer Financial Protection Bureau explains. Consumers must contact each of the three major bureaus separately, because no single request covers all three.
The practical effect is stark. While a freeze is in place, nobody can open a new credit account in that consumer’s name, according to the FTC’s IdentityTheft.gov resource. Existing accounts, employers running background checks, and companies with which a consumer already has a relationship can still access certain information, but prospective lenders cannot. That narrow opening keeps day-to-day financial life functioning while closing off the main channel criminals rely on to monetize stolen identities: brand-new accounts that will never be repaid.
Federal enforcement gaps and the TransUnion case
Free access to freezes does not guarantee that bureaus handle them properly. The CFPB brought an enforcement action against TransUnion, alleging the company failed to timely place or remove security freezes and did not consistently honor consumer requests. That case also documented how security freezes and locks block lenders and other third parties from accessing consumer credit reports to prevent identity theft. The action stands as the most prominent public example of a bureau falling short on freeze compliance, and no comparable enforcement records against Equifax or Experian have surfaced in federal regulatory filings.
That single-bureau enforcement record leaves a significant blind spot. Consumers placing freezes at all three bureaus have no public, side-by-side assessment of how reliably each company executes the process. If one bureau responds within minutes while another takes days, or if one mishandles removals, those differences remain largely invisible outside of scattered consumer complaints and individual lawsuits. Federal regulators have not published systematic data comparing freeze error rates, processing times, or complaint volumes across the three firms.
The TransUnion case nonetheless sends a clear signal: even when the law is unambiguous, compliance can falter without close oversight. The Fair Credit Reporting Act does not treat freezes as an optional convenience; it sets deadlines, mandates identity verification standards, and requires that consumers be able to lift or temporarily thaw a freeze when they choose. When a bureau fails to follow those rules, the consequences cut both ways. Victims of identity theft may find fraudulent accounts slipping through during delays, while legitimate applicants can be locked out of mortgages, car loans, or apartment leases if a requested thaw does not process on time.
What consumers can and cannot expect from a freeze
Within that imperfect enforcement environment, a freeze still offers powerful, predictable benefits. Consumers can expect that most mainstream lenders will not extend new credit when a freeze blocks access to a report. They can also expect that placing or lifting a freeze will be free, that each bureau will provide a way to manage the status online, by phone, or by mail, and that a freeze will not affect existing credit lines, credit scores, or the ability to use current cards.
There are, however, limits. A freeze does not stop misuse of existing accounts, such as someone running up charges on a stolen card, and it does not prevent non-credit-based fraud like tax refund theft or medical identity theft. It also does not erase the need to monitor statements, set up account alerts, or review credit reports periodically. In practice, a freeze works best as a backbone measure: a standing default that blocks the most damaging form of identity theft-new-account fraud-while other tools handle the rest.
Why using all three freezes still makes sense
The absence of broad enforcement actions against Equifax and Experian does not mean their processes are flawless; it simply means regulators have not brought public cases similar to the one involving TransUnion. Until more comparative data emerges, consumers have little reason to treat any one bureau as more trustworthy than the others. Because creditors may pull reports from different combinations of bureaus, leaving even a single file unfrozen creates an opening that a determined fraudster can exploit.
For now, the most practical strategy is straightforward. Place a freeze at each of the three major bureaus, store login credentials or PINs securely, and plan ahead to temporarily lift freezes before major applications. Federal law has made the tool free and widely available. Even with gaps in public oversight and uneven transparency about bureau performance, using all three freezes remains one of the simplest, highest-impact steps an individual can take to keep new debt from appearing in their name without consent.
Free for readers: The free Retirement Shield newsletter sends plain-English help keeping more of your money in retirement — the scams to dodge, the benefits you’re owed, and what’s changing with Social Security and Medicare, a couple times a week. Get the free newsletter.
