Most states in the U.S. have enacted laws that allow consumers to have the major credit reporting agencies place a “security freeze” on their credit reporting file (see map). This generally blocks access to their file. The primary purpose of these freezes is to make it more difficult for someone who has stolen that person’s identity to open a credit account. If the person who requested the freeze wants to apply for credit, they must “unfreeze” their credit file by contacting the credit reporting agency. In late 2007, all three major credit reporting agencies began voluntarily allowing freezes in the states that did not yet have laws in effect.


Federal and state laws provide a number of other protections for victm’s of identity theft, including the ability to place “red flag” alerts on their credit bureau file, stop collection calls, and obtain identity theft passports. In addition, federal law allows consumers to block use of their credit report for pre-approved credit offers.

Options When Lifting a Freeze

Consumers applying for credit will need to “lift” the freeze in some way by contacting the relevant credit bureau directly. They can choose to lift the freeze permanently, for a specific period of time (useful when they are shopping around) or for one specific creditor.

Disadvantages of a Security Freeze

To unfreeze a credit report the consumer must provide a security code issued by the relevant credit bureau at the time they requested the freeze. This can be real challenge for several reasons. First, it is very possible that neither the consumer seeking credit nor the person they are speaking with at the bank, car dealership or home improvement store will know which credit bureau is being used as the source of the credit report, so the consumer won’t know which one to contact. Combine this with the fact that each bureau issues a separate PIN, and the consumer will have to contact all three major bureaus and provide each the correct PIN. And since PINs are selected by the bureaus, not the consumer, the consumer is not likely to remember their PIN. It may be written down or printed someplace inconvenient (e.g., at home for a consumer who is applying for credit at a retailer such as a car dealership), lost or mislaid. Obtaining a new PIN requires the consumer to first prove that they are who they claim to be, generally paying a PIN-replacement fee.

If the consumer does provide the correct PIN, it might take some time for the credit bureau to release the requested credit information to the lender. State laws typically allow the bureau three business days to unfreeze the credit report, although some are requiring it be done within 15 minutes.

Finally, the credit bureaus are generally allowed to charge fees to consumers for unfreezing the credit report. These may vary based on whether the consumer is unfreezing their bureau for a specific period of time, or indefinitely.

Alternatives to a Security Freeze

Consumers concerned about misuse of their credit file do have alternatives to a security freeze. Consumers can place fraud alerts on their credit file. Consumers can also purchase credit monitoring services that will alert them if someone is applying for credit in their name. Consumers can also purchase insurance products that protect them from significant financial losses, although such insurance obviously does not compensate for the trouble involved. At the very least, consumers can regularly request a copy of their credit report from each of the major credit bureaus.

Exceptions to Security Freeze Laws

The state security freeze laws all have a number of exceptions that allow a credit bureau to provide a file without the consumer specifically authorizing it, such as:

  • To assist a credit review or collect on an existing debt
  • For fraud investigations
  • For making pre-approved offers of credit.

Visit the Security Freeze Blog.