Every consumer in the United States can lock down their credit files at Equifax, Experian, and TransUnion without paying a cent, yet most people never take that step until after a thief has already opened accounts in their name. Federal law requires all three nationwide credit bureaus to place and remove security freezes free of charge. Once a freeze is active, creditors generally cannot pull a credit report, which effectively blocks approval of new loans, credit cards, or lines of credit that a fraudster tries to open.
How federal law makes credit freezes free and effective
The statutory backbone for this protection is a provision of the Fair Credit Reporting Act codified at 15 U.S.C. 1681c-1. That section directs consumer reporting agencies to place and lift security freezes at no cost to the consumer. Before Congress added this requirement, many states allowed fees of up to $10 per bureau, which discouraged people from freezing their files unless they already knew they were victims. The federal mandate removed that financial hurdle and made freezes a standard, nationwide option.
The practical effect is straightforward. Lenders typically will not extend credit without first reviewing an applicant’s credit report. A freeze cuts off that access for anyone attempting to open a new account. Because the block operates at the bureau level, it does not matter how much stolen personal data a thief possesses. Without a viewable report, most applications stall or are rejected outright.
A freeze also carries no penalty for the consumer who places it. Credit scores remain unaffected, according to guidance from the Federal Trade Commission. Existing credit cards, mortgages, auto loans, and recurring payments continue to function normally. The freeze targets only new inquiries tied to fresh applications for credit, leaving day-to-day use of current accounts unchanged.
Gaps in freeze coverage and the three-bureau requirement
The protection is not automatic or universal. Consumers must contact each of the three nationwide bureaus separately to place a freeze. Freezing at Equifax alone, for example, leaves Experian and TransUnion files exposed. A thief who applies with a lender that checks one of the unfrozen bureaus can still succeed, even though one file is locked. That three-bureau requirement means a partial approach offers only partial protection.
The Consumer Financial Protection Bureau and other regulators also note a significant limitation: the federal free-freeze law focuses on credit used for lending decisions and does not extend to every type of background check. Employers and landlords often rely on specialty consumer reporting companies that may fall outside the statute’s reach. In practice, that means a security freeze at the big three bureaus will not necessarily stop an employer from running a background report or a property manager from screening a rental application.
No federal agency currently publishes comprehensive data showing how many consumers have active freezes or how many fraud attempts freezes have blocked in a given year. The FTC tracks identity-theft complaints and new-account fraud reports, but it does not isolate outcomes by freeze status. That gap makes it difficult to quantify the precise reduction in fraud that proactive freezes deliver. The idea that placing a freeze before any theft occurs leads to fewer successful new-account scams is consistent with how freezes work, but it has not been confirmed through a controlled federal study.
Equifax, Experian, and TransUnion also have not released detailed compliance metrics, such as average processing times for online or phone-based freeze requests, error rates, or the frequency of mistaken lifts. Consumers who encounter delays or technical problems when placing or lifting a freeze have limited recourse beyond contacting the bureau directly, submitting written documentation, or filing a complaint with the Consumer Financial Protection Bureau or their state attorney general.
What consumers should do first
For anyone who has not yet placed a freeze, the first step is to visit each bureau’s website and submit a request, either online, by phone, or by mail. The FTC’s overview of credit freezes explains that consumers will typically need to provide their name, address, date of birth, Social Security number, and other identifying details to verify their identity. Once a freeze is in place, most people can temporarily lift it for a specific creditor or time window when they plan to apply for a mortgage, auto loan, or new credit card.
Consumers who are not ready for a full freeze can consider a fraud alert instead, which requires creditors to take extra steps to verify identity before opening new accounts. Alerts are less restrictive than freezes but also less protective, because they do not block access to the credit report outright. For people who rarely apply for new credit, a freeze is generally the stronger and more set-it-and-forget-it option.
Ultimately, a free security freeze is one of the few tools that can stop many forms of new-account identity theft before they start. It does not prevent all misuse of personal information, and it does not replace the need to monitor bank and card statements or respond quickly to suspicious activity. But for the modest effort of contacting three companies and keeping track of login credentials or PINs, consumers can close off one of the most lucrative avenues for criminals who trade in stolen identities.
