A credit freeze (also known as a security freeze) allows an individual to control how a consumer reporting agency (also known as a credit bureau such as Equifax, Experian, TransUnion, and Innovis) is able to sell personal financial identity data.[1] The credit freeze locks the data at the consumer reporting agency until the individual gives permission for the release of the data.[2] [3] [4] [5]
Typically, consumer reporting agencies only develop such a feature when prompted to by legislation. In Canada, this has led to TransUnion and Equifax not offering any form of credit freeze (instead directing consumers to their paid identity monitoring services, which have been described as 'ineffective'), until the passage of Quebec's Bill 53, the Credit Assessment Agents Act.[6] [7]
Lifting a credit freeze requires a PIN.[8] However, in September 2017, a security vulnerability in this system was identified: the PIN is in many cases guessable, and difficult or impossible to reset.[9] Freezing one's credit will not prevent the credit score from changing. Existing companies with access to one's credit profile can still report positive and negative feedback on a credit profile, meaning if the credit profile is frozen, one's credit can still go up or down.[10]
The first jurisdiction in Canada to legislatively provide for credit freezes was Quebec, with the passage of Bill 53 (the Credit Assessment Agents Act). Starting in February 2023, Quebec residents can place a freeze.[11] As of February 2021, Ontario was considering changes to its Consumer Reporting Act that would provide for credit freezes.[12]
All 50 states and the District of Columbia have a credit freeze law, the last state to pass such a law being Michigan in 2018.[13] [14] [15] [16]
The first state to pass a credit freeze law was California, with SB 1386 sponsored by Debra Bowen in 2002, effective 2003.[17] In late 2007, all three of the major credit bureaus (following TransUnion's lead) announced that they would let consumers freeze their credit reports, regardless of the state of residency.[18] State laws still apply, however, in instances where the cost or other details of the freeze are more favorable than they are under the industry-sponsored alternative.
Credit freezes are frequently viewed as the most effective way to prevent financial identity theft. Each year in the United States, approximately 15 percent of all cases of identity theft are cases of new account origination identity theft, according to the Federal Trade Commission.[19] This form of identity theft occurs when a criminal opens credit in another individual's name. In the credit origination process, access to a credit report is critical for a lender to make a risk assessment. Because a credit freeze effectively stops any access to the credit report, it places a block in the process of issuing credit. Individuals who freeze their credit reports must therefore unfreeze their reports before they wish to apply for credit themselves. However, these can be avoided with proper preplanning. With proper documentation, most individuals should be able to unfreeze your credit scores with all three bureaus within 15 to 20 minutes. Generally, electronic unfreezing process takes effect immediately.
A credit freeze can also be placed on the credit file with The National Consumer Telecom & Utilities Exchange (NCTUE) in order to limit fraud through a bad actor creating a utilities account in some else's name.[20]
In 2018 the Economic Growth, Regulatory Relief and Consumer Protection Act, was passed which includes a provision to preempt state laws replacing the large variation of state laws with a federal one that requires all credit freeze to be free of charge. The law is effective September 21, 2018 at which point the credit bureaus will no longer be able to charge for a freeze and a request must be completed within one business day if made online or via phone. They will have three business days to comply with a request if received via mail.[21]