Anyone whose personal data has been exposed in a breach can now lock down all three credit bureaus at no cost, stopping thieves from taking out loans or opening accounts in their name. Federal law, codified at 15 U.S.C. 1681c-1, requires Equifax, Experian, and TransUnion to place, lift, and remove security freezes free of charge. The protection is simple in concept: while a freeze is active, lenders generally cannot pull a credit file, so they will not approve new credit. Yet most consumers still have not placed one, leaving a gap between the tool’s power and its actual use.
Why the free freeze mandate changed the calculus for consumers
Before the federal change took effect in September 2018, many states allowed bureaus to charge fees for placing or lifting a freeze. Those fees, often ranging from a few dollars to more than ten per bureau, discouraged people from using the single strongest defense against new-account fraud. The federal law that eliminated fees also introduced yearlong fraud alerts, replacing the shorter 90-day alerts that had been the default. The distinction matters: a fraud alert only requires a business to take extra steps to verify the applicant’s identity, while a freeze blocks access entirely.
The FTC frames a credit freeze as the “best way” to protect against an identity thief opening new accounts, according to its consumer guidance comparing freezes and fraud alerts. The Consumer Financial Protection Bureau reinforces that point, noting that creditors typically will not extend new credit when they cannot access a file. That practical reality is the freeze’s core strength: it does not rely on a lender’s willingness to verify identity. It removes the lender’s ability to see the file at all.
A reasonable hypothesis is that states with their own credit-freeze laws already on the books before 2018 would see faster drops in new-account identity-theft complaints to the FTC, because residents in those states were already familiar with the tool. No publicly available FTC complaint dataset broken down by state and freeze-law status has surfaced to confirm or reject that idea. The absence of granular data is itself telling: federal agencies have promoted the freeze aggressively without publishing adoption rates or tracking how complaint patterns shifted after the cost barrier disappeared.
How the statute and agency guidance define the freeze’s reach
The controlling text sits in the Fair Credit Reporting Act at section 1681c‑1, which spells out the “free of charge” mandate and the timelines bureaus must follow when consumers request a freeze or a lift. Each of the three nationwide bureaus must be contacted separately; placing a freeze at one does not activate it at the others. USA.gov, the federal government’s consumer portal, directs people to contact all three bureaus individually and confirms that both placing and lifting a freeze cost nothing.
The FTC’s IdentityTheft.gov site states the protection plainly: while a freeze is in place, nobody should be able to open a new credit account in your name using your frozen file. That language, echoed across multiple agency resources, underscores that the freeze is aimed at new-account fraud, not at stopping every form of identity misuse. Existing obligations, such as current credit cards, mortgages, or auto loans, continue to function normally, and a freeze does not erase fraudulent debts that were opened before it was activated.
The statute also carves out specific exceptions. Certain parties can still access a frozen file, including existing creditors reviewing or collecting on an account, debt collectors working for those creditors, and some government agencies acting under court orders or in connection with child support, taxation, or criminal investigations. These exceptions reflect a policy choice: Congress sought to block opportunistic new credit applications without disrupting ongoing relationships or lawful government functions.
Timelines are another critical element. Under the law, bureaus must place a freeze within a short period after receiving a request, and they must lift it quickly when a consumer asks for a temporary thaw. That responsiveness is designed to minimize friction when a consumer legitimately needs new credit, such as applying for a car loan or a mortgage, while maintaining strong protection the rest of the time.
Practical steps for consumers after a data breach
In practice, activating a freeze is straightforward. Consumers can submit requests online, by phone, or by mail to each bureau. The FTC’s recent guidance urging people to get a credit freeze after data breaches walks through those options and emphasizes that the process should not require payment. Once set up, a freeze can typically be lifted temporarily for a specific creditor or date range, allowing a loan application to proceed without fully exposing the file.
Fraud alerts remain useful, especially for people who do not want to manage freezes at all three bureaus. With a fraud alert, a business is supposed to take extra steps to confirm identity before granting credit, and placing one at a single bureau should propagate it to the others. Still, the reliance on lender diligence makes alerts a weaker barrier than a freeze, particularly in an environment where automated approvals are common.
The policy shift that made freezes free was meant to nudge consumers toward a more proactive stance on identity protection. Yet without public data on how many people have acted, it is impossible to know whether that nudge has taken hold. For now, the legal framework is clear: the strongest available shield against new-account identity theft costs nothing to use, but it only works for those who take the time to turn it on.
