A federal law that took effect in September 2018 made it free, nationwide, to freeze a credit report at each of the three major credit bureaus, and a freeze in place stops any new creditor — including one contacted by an identity thief — from opening an account against that file. The tool requires no proof of theft and carries no ongoing cost to place, lift, or leave in place indefinitely. The catch is procedural rather than financial: a freeze has to be requested separately at Equifax, Experian, and TransUnion, since no single bureau can freeze the other two on a consumer’s behalf.
A 2018 Federal Law Made the Freeze Free Everywhere
Before September 21, 2018, some states required credit bureaus to waive freeze fees and others did not, leaving a patchwork where the protection cost real money in parts of the country. The CFPB confirmed that starting that date, consumers nationwide could freeze and unfreeze a credit file for free under a new federal law, along with a free freeze for children under 16 and for people under a guardianship, conservatorship, or valid power of attorney. The change also extended standard fraud alerts from 90 days to a full year, though that is a separate tool from the freeze itself.
The law attached specific deadlines to how fast a bureau has to act once free freezes became mandatory. A request made online or by phone must be placed within one business day, a mailed request within three business days, and a temporary lift of an existing freeze must happen within one hour for an online or phone request. Those deadlines still apply today and give a freeze a predictable turnaround that a consumer can plan around when they need credit checked for a specific purchase.
None of this should be confused with a “credit lock,” a similar-sounding product some bureaus sell as a subscription. A lock is a private contract feature, not the federal right described above, and the CFPB has been explicit that credit locks are no more effective than security freezes, which are free and which consumers have a right to by law. Anyone offered a paid lock as the recommended fix for identity-theft risk is being sold a version of a protection that is already free.
Free retirement updates: Want plain-English help keeping more of your money in retirement? The free Retirement Shield newsletter covers the benefits, deadlines, and money mistakes that cost retirees, a couple times a week. Subscribe free.
What a Freeze Actually Blocks — and What Still Gets Through
A freeze does not merely slow a new-account application down; it removes the file from view entirely for the purpose of opening credit. Because nobody can open a new credit account in a person’s name while a credit freeze is in place, a thief with a stolen Social Security number and birth date has nothing to hand a lender — there is no file for the lender to pull. That also means the account holder themselves cannot open new credit while frozen, which is the tradeoff for the protection and the reason a temporary lift exists for the moments a real application is in progress.
A frozen file is not sealed from everyone. Current creditors already on an account, certain government entities such as child-support agencies, and companies a consumer has already hired to monitor their own credit retain access even during a freeze. A freeze also does nothing to a credit score one way or the other — placing or lifting one has no scoring effect, so there is no downside to leaving a freeze in place indefinitely between the occasions a new account actually needs to be opened.
The mechanics differ from a fraud alert in a way that matters for anyone deciding which tool to use. A freeze must be requested at each bureau individually because no bureau is authorized to freeze the other two on a consumer’s behalf — three separate requests, three separate confirmations. That extra step is what buys the stronger protection: a freeze blocks access outright, while the lighter-weight fraud alert only requires a lender to verify identity before proceeding.
Nothing About Placing a Freeze Requires Being a Victim First
Unlike some identity-theft protections that only activate after a report or a police filing, a freeze is available to anyone at any time for any reason, including someone who has never had a problem and simply wants the file closed off by default. Parents and guardians can request a free freeze for a child under 16 even though a minor typically has no credit file yet, precisely because an empty file is exactly what a thief looks for when opening fraudulent accounts in a child’s name years before anyone would think to check.
The freeze’s only real cost is inconvenience at the moment a legitimate new account is actually wanted — a mortgage application, a new credit card, a car loan — when the file has to be temporarily lifted at whichever bureau the lender uses. For a consumer not actively shopping for new credit, that inconvenience essentially never arises, which is why identity-theft guidance increasingly treats a standing freeze less as an emergency response and more as a default setting a credit file should carry most of the time.
Retirees are frequently told to freeze their credit only after a specific breach notification arrives in the mail, but nothing about the tool requires waiting for that letter. A retiree who has largely stopped applying for new credit — no more mortgages, no more auto loans, no reason to open another card — gives up almost nothing by freezing all three files today and simply lifting one temporarily on the rare occasion a new account is genuinely wanted, while permanently closing off the account-opening scams that specifically target older Social Security and Medicare recipients.
This article was researched and drafted with the assistance of artificial intelligence.
More Financial Reading
