How to Place a Credit Freeze at All Three Bureaus

A credit freeze — also called a security freeze — is among the strongest tools available to U.S. consumers for blocking unauthorized new account fraud. Federal law governs the process at all three major credit reporting agencies, making placement free, permanent until lifted, and enforceable by statute. This page describes the mechanism, the regulatory framework, the distinct process at each bureau, and the circumstances under which a freeze applies or falls short.

Definition and Scope

A credit freeze restricts a consumer's credit file at a credit reporting agency (CRA) so that new creditors cannot access it to evaluate an application. Under the Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681c-1, as amended by the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018, every nationwide CRA must offer security freezes at no charge to any consumer upon request.

The three nationwide CRAs subject to this requirement are Equifax, Experian, and TransUnion. Because each agency maintains an independent file, a freeze placed at one does not propagate to the others — all three require separate actions. A freeze at all three is necessary to block any new credit check that a lender might route through any single bureau.

The FCRA framework also distinguishes between a security freeze and a fraud alert, which are not equivalent tools. A comparison of a credit freeze versus a fraud alert clarifies which instrument applies to which threat scenario. The freeze is the more restrictive instrument: it blocks access entirely rather than flagging the file for enhanced review.

Specialty consumer reporting agencies — including ChexSystems (used by banks for deposit account screening) and the National Consumer Telecom and Utilities Exchange (NCTUE) — are not covered by the same three-bureau freeze and maintain separate freeze processes.

How It Works

When a security freeze is active on a credit file, any creditor requesting that file to evaluate a new credit application receives a response indicating the file is frozen and cannot be released. The transaction is declined at the verification stage before credit is extended.

Placement, temporary lifting (called a "thaw"), and permanent removal are all governed by FCRA § 1681c-1. The 2018 amendments set the following timelines, which CRAs are required to honor (FTC: Free Credit Freezes):

1. Online or phone requests: The CRA must place or lift the freeze within one business day of receiving the request.
2. Mail requests: The CRA must place or lift the freeze within three business days of receiving the written request.
3. Confirmation: Upon placement, each CRA must provide a unique PIN or password used to authenticate future lift requests (Equifax eliminated the PIN model and uses identity verification instead).

The placement process at each bureau follows a distinct channel:

• Equifax — Freeze requests are processed via Equifax's online security freeze center, by phone at 1-800-685-1111, or by mail to Equifax Security Freeze, P.O. Box 105788, Atlanta, GA 30348. Identity verification uses account-based authentication rather than a PIN.
• Experian — Requests are processed via Experian's freeze center online, by phone at 1-888-397-3742, or by mail to Experian Security Freeze, P.O. Box 9554, Allen, TX 75013. Experian issues a 10-digit PIN upon placement.
• TransUnion — Requests are processed online, by phone at 1-888-909-8872, or by mail to TransUnion LLC, P.O. Box 160, Woodlyn, PA 19094. TransUnion also issues a PIN and offers account-based management.

A temporary lift — used when the consumer needs to apply for new credit — can be set for a specified date range or for a single named creditor, depending on the bureau's available options. After the lift period expires, the freeze automatically reactivates.

Minors under 16 and incapacitated individuals are eligible for protected-consumer freezes under FCRA § 1681c-1(b), which require a designated representative to submit documentation of authority (such as a birth certificate or power of attorney).

Common Scenarios

A freeze at all three bureaus is most operationally relevant in the following circumstances:

• Post-data breach exposure: After a breach involving Social Security numbers or financial account data, affected consumers face elevated risk of new account fraud. A freeze prevents unauthorized actors from opening credit lines using stolen credentials.
• Confirmed identity theft: Consumers who have filed an FTC Identity Theft Report at IdentityTheft.gov typically place a freeze as part of the containment phase of the recovery process.
• Proactive protection for non-credit-active individuals: Consumers who do not expect to apply for credit — including retirees, children, and individuals with existing accounts sufficient to their needs — may maintain a permanent freeze as a baseline control with no functional cost.
• Synthetic identity fraud risk: Individuals whose Social Security numbers have been compromised face synthetic identity fraud risk even if their own credit history is clean. A freeze limits the ability of fraudsters to attach a fabricated identity profile to a real SSN and apply for credit.
• Senior and child populations: Senior identity theft and child identity theft are two categories where victims frequently do not detect unauthorized accounts for extended periods. Preventive freezes for these populations reduce window exposure significantly.

Decision Boundaries

A credit freeze is not a universal solution. Understanding where it applies and where it does not is essential to accurate risk management.

A freeze does not block:
- Access by existing creditors to the consumer's file for account maintenance or pre-approved offer purposes
- Access by government agencies acting under court order or statutory authority
- Access by employers, landlords, or insurers (who use different permissible-purpose pathways under FCRA § 1681b)
- Activity on existing accounts — account takeover fraud involving currently open accounts is not mitigated by a credit freeze
- Medical or non-credit identity theft — medical identity theft does not rely on credit bureau access

A freeze versus a fraud alert represents the primary comparison in this decision space. A fraud alert — available as a 1-year initial alert or a 7-year extended alert for confirmed identity theft victims — places a notice on the file but does not block access. Lenders are required to take reasonable steps to verify identity before extending credit. A freeze is structurally more restrictive; a fraud alert is less disruptive to routine credit activity.

A freeze versus credit monitoring is a category error that appears frequently in consumer guidance contexts. Credit monitoring detects unauthorized activity after it has occurred and reports to the consumer. A freeze prevents the inquiry that initiates new account fraud from succeeding. The two serve different phases of the identity protection process — prevention versus detection — and are not substitutes.

Consumers managing active financial identity theft cases typically require both instruments plus formal dispute processes under FCRA § 1681i, which governs the right to dispute inaccurate information on a credit file. The freeze protects against further exposure while disputes are resolved.

References

• Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq. — FTC Full Text
• FTC: Free Credit Freezes — Consumer Information
• FTC: IdentityTheft.gov — Official Recovery Site
• Consumer Financial Protection Bureau (CFPB): Credit Freeze Explainer
• Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018, Pub. L. 115-174 — Congress.gov
• Equifax Security Freeze Center
• Experian Security Freeze Center
• TransUnion Credit Freeze Center