The Federal Trade Commission received more than one million identity theft reports in 2023 alone, according to its Consumer Sentinel Network Data Book. A significant share of those cases involved someone opening a credit card, auto loan, or mortgage under another person’s name. And in most of those cases, a credit freeze could have stopped the fraud before it started.
A credit freeze locks your credit report at each bureau so that lenders cannot pull it. No credit check means no approval, which means a scammer holding your Social Security number, date of birth, and address still walks away empty-handed. The application simply gets denied.
Placing a freeze has been free at all three major bureaus since September 21, 2018, when a provision of the Economic Growth, Regulatory Relief, and Consumer Protection Act took effect. Before that, bureaus could charge fees that varied by state, sometimes up to $10 or more per bureau. Congress eliminated those charges entirely.
Despite that, the protection remains dramatically underused. The three nationwide credit bureaus do not publish combined freeze-adoption figures, and no federal agency tracks the number either. Even the Consumer Financial Protection Bureau’s annual reports on the credit reporting market do not include freeze counts. What is clear from complaint data is that new-account fraud has not slowed down. A tool that could prevent many of those cases is sitting unused in plain sight.
How a credit freeze actually works
When you place a freeze, each bureau locks your credit report so that most lenders and creditors cannot pull it. Because nearly every legitimate lender checks a credit report before approving a new account, a locked file stops fraudulent applications cold.
The FTC explains the distinction in its guide to freezes versus fraud alerts: a fraud alert asks lenders to verify your identity before extending credit, but it does not block access to your report. A freeze does. That makes the freeze the stronger defense against new-account fraud.
“A credit freeze is the single most underused consumer protection tool available today,” said Chi Chi Wu, a staff attorney at the National Consumer Law Center who has testified before Congress on credit reporting issues. “People hear about monitoring services after every breach, but monitoring only tells you the barn door is open. A freeze keeps it shut.”
A few things a freeze does not do:
- It does not affect your credit score in any way.
- It does not prevent you from using credit cards or bank accounts you already have.
- It does not stop you from pulling your own credit report through AnnualCreditReport.com.
- It does not block companies you already do business with from reviewing your account.
Credit monitoring, which many companies offer free after a data breach, is a different tool entirely. Monitoring watches for suspicious activity and sends you an alert after something happens. A freeze is designed to keep the suspicious activity from succeeding in the first place. Having one does not eliminate the need for the other.
You need to freeze at all three bureaus, not just one
This is the step people most often get wrong. Equifax, Experian, and TransUnion each maintain a separate credit file on you. A lender might pull your report from any one of them, or from two, or from all three. If you freeze your file at Equifax and Experian but skip TransUnion, a scammer who applies with a lender that checks only TransUnion can still get approved.
Each bureau has its own online portal for placing a freeze:
You will need to create an account (or log in) at each site, verify your identity, and request the freeze. The process typically takes under ten minutes per bureau. Each bureau will give you a PIN or confirmation number. Keep those somewhere safe; you will need them to lift or remove the freeze later. If you lose a PIN, each bureau has its own recovery process, usually involving identity verification by mail or online, so misplacing it is not permanent but it does slow things down.
The CFPB confirmed the no-cost requirement in a 2018 update to model disclosures under the Fair Credit Reporting Act. Its announcement on FCRA model disclosures specifies that nationwide consumer reporting agencies must provide security freezes at no charge. If any bureau’s website tries to steer you toward a paid product during the process, you are not required to buy it.
Lifting a freeze when you need new credit
A freeze is not permanent unless you want it to be. When you apply for a mortgage, car loan, new credit card, or even a new cell phone plan that requires a credit check, you can temporarily lift the freeze. Under federal law (15 U.S.C. § 1681c-1), each bureau must lift a freeze within one hour of receiving your request online or by phone. Requests submitted by mail take longer, up to three business days.
You have several options for how to lift it:
- For a specific lender: Some bureaus let you unlock your file only for a named creditor, so the rest of your report stays frozen.
- For a set time window: You can lift the freeze for a day, a week, or another period you choose, and it automatically goes back into place.
- Permanently: You can remove the freeze entirely if you decide you no longer want it.
The federal government’s identity theft portal, IdentityTheft.gov, describes a freeze as one of the most effective steps after learning your personal data has been exposed.
Why adoption remains so low despite zero cost
Neither the FTC nor the CFPB has published a formal study on why eligible adults skip the freeze. A 2017 survey by the U.S. Government Accountability Office, published in its report GAO-17-254 on consumer data protection, found that many consumers were unaware they could freeze their credit at all, and those who were aware often overestimated the difficulty or believed monitoring services offered equivalent protection.
“The biggest barrier is not cost or complexity. It is that people simply do not know the option exists,” said Eva Velasquez, president and CEO of the Identity Theft Resource Center, a nonprofit that has tracked identity crime trends since 1999. “We hear from victims every day who tell us they had no idea they could have frozen their credit before the fraud happened.”
Confusion about what a freeze blocks is another barrier. Some people worry that freezing their credit will prevent them from using their existing credit cards or checking their bank balance. It will not. Others assume that the free credit monitoring offered after breaches provides equivalent protection. It does not: monitoring is reactive, while a freeze is preventive.
The requirement to freeze at three separate bureaus also adds friction. Each bureau has its own website, its own account creation process, and its own PIN system. That is three sets of credentials to manage. For someone unfamiliar with the bureaus, the process can feel more complicated than it actually is.
There is also a lesser-known gap worth noting: the three major bureaus are not the only ones that matter. Specialty agencies like the National Consumer Telecom & Utilities Exchange (NCTUE), which covers utility and telecom accounts, and ChexSystems, which covers bank account applications, maintain separate files. Freezing those requires contacting each agency individually. Most people have never heard of them, let alone thought to freeze their reports there.
What a freeze cannot protect you from
A credit freeze is powerful, but it is not a complete identity theft shield. It blocks new-account fraud, the scenario where someone uses your stolen information to open accounts you never applied for. It does not protect against:
- Existing account fraud: If a thief gets your credit card number and makes charges on a card you already have, a freeze will not stop that. You need to monitor your statements and report unauthorized charges to your card issuer.
- Tax identity theft: Someone filing a fraudulent tax return in your name is not blocked by a credit freeze. The IRS offers an Identity Protection PIN for that.
- Medical identity theft: A freeze does not prevent someone from using your information to obtain medical care or prescriptions.
- Synthetic identity fraud: Criminals sometimes combine real and fabricated information to create entirely new identities. A freeze on your file helps, but it may not catch every variation.
None of those limitations diminish the value of a freeze. They simply mean it works best as one layer in a broader approach to protecting your information.
Thirty minutes now or months of cleanup later
Resolving identity theft after the fact is notoriously grueling. Victims often spend months disputing fraudulent accounts, correcting credit reports, and fielding calls from collection agencies chasing debts they never incurred. The FTC’s recovery process, outlined at IdentityTheft.gov, can involve filing police reports, sending dispute letters to multiple companies, and following up repeatedly over weeks or months.
A credit freeze will not eliminate every form of identity theft, but it directly blocks the type that causes some of the worst financial damage: fraudulent new accounts that can run up thousands of dollars in debt under your name and drag your credit score down before you even know they exist.
The process takes roughly 30 minutes if you do all three bureaus in one sitting. You do not need to buy anything, download anything, or hand over a credit card number. The protection lasts until you decide to change it, and as of June 2026 it still costs nothing.
