The Case for Security Freezes
More than ten years ago, representatives from several leading consumer advocacy groups teamed up with California state lawmakers to answer a question about a serious problem: How does identity theft occur? Their conclusion was simple: in every known case of identity theft, a scam artist determined an unsuspecting victim’s name and social security number. If the victim had a satisfactory credit score, his or her information was then used to open a new line of credit, usually a credit card shipped to an address known only to the perpetrator.
Identity thieves make quick, high-volume hits—often charging, in a short space of time, thousands or tens of thousands of dollars worth of clothes, computers, digital television sets or other merchandise. Responsibility for the price tab on a fraudulent spending spree often falls on either the bank that issued the card, or the merchant who sold the goods to a thief. However, the victims shoulder other ongoing costs: legal fees, denied mortgages, threatening phone calls from debt collectors, and tedious hours spent trying to vindicate damaged financial reputations.
The California activists, among them members of PIRG (Public Interest Research Groups) and the Privacy Rights Clearinghouse, quickly realized the challenge of attacking the problem at the source of the breach. Thieves obtain names and social security numbers from any number of places—garbage bins, insecure computer databases, and other sources as yet unknown. Rarely is an identity theft’s exact method ever determined. Fighting the crime would be easier, then, at the next step in the process of a fraud—the point at which a thief creates a fraudulent account—through greater protection of the credit report itself. By limiting access to this key source of personal information, identity theft might be more effectively deterred.
Their solution was the “security freeze.” Known alternately as a “credit freeze,” this offers consumers the opportunity to deny potential creditors access to their credit reports. With access to a consumer’s credit report cut off, creditors will generally deny an application for a new account. “It’s the only way that you can protect yourself,” says Ed Mierzwinski, an attorney with the National Association of State Public Interest Research Groups (U.S. PIRG) who worked on the issue in California.
Though credit bureaus offer fraud alert services for known victims and monitoring services that can help spot fraudulent spending on existing accounts, security freezes are the only tool available to consumers to stop identity theft before it occurs, says Scott Mitic, CEO of the California-based identity theft prevention company Trusted ID. He adds, “Every American should have the right to protect their data should they choose to do so.”
However, granting consumers the right to allow and deny access to their credit reports at will is new to the credit reporting system in this country. The credit histories of millions of Americans are shepherded exclusively by three private companies— TransUnion, Equifax, and Experian – which began allowing individuals free access to their credit reports when Congress mandated they do so at least once a year. Before then, consumers wielded very little oversight of their personal credit histories. A credit freeze was unprecedented in the amount of control it turned over to private citizens.
To the chagrin of the credit bureaus, Mierzwinski and fellow consumer advocates began their push to enact state-level legislation that would make “security freezes” open to all consumers. (He prefers the term to “credit freeze,” which he derides as an industry expression with a more negative connotation.) The activists met early success in California, which approved the country’s first security freeze statute in January 2003. Since then, 47 other states and the District of Columbia have followed suit. Most, like California, extend security freeze privileges to all consumers. Only two are more restrictive, limiting the opportunity to freeze credit to those who’ve been victims of identity theft.
Credit card-issuing banks and retail stores joined the bureaus in opposing these measures. The organizations expressed fear that credit freezes would interfere with day-to-day consumer activity. For example, a credit freeze might dissuade consumers from signing up for a store-branded credit card, because they wouldn’t want to bear the hassle (and cost) of unfreezing their credit reports. Even worse, the industry argued, confusion over how to unfreeze a credit report could prevent a consumer from securing a job or renting an apartment. Testifying in front of a Louisiana legislative committee in May 2004, a lobbyist for the Consumer Data Industry Association, which represents the credit reporting bureaus, referred to freezes as “the most dramatic and draconian alteration” ever to hit the credit reporting system.
A policy analyst with Consumers Union, the non-profit organization that publishes Consumer Reports magazine, sees the issue through a different lens. “This is one concrete tool we can give consumers,” says Susanna Montezemolo in a recent interview. “This is about giving people a choice.”
How A Credit Freeze Works
In order to “freeze” their credit file, consumers contact the three major credit reporting agencies (Equifax, Experian and TransUnion). These agencies, in turn, will require consumers to provide certain information, such as identification information, before they will place a freeze on their credit report. In states like Colorado, there is no fee to freeze credit for the first time. Other states, including California, charge everyone except victims of identity theft, who must provide legal documentation of a breach. Placing a security freeze usually costs around $10.
To undo a freeze (a “thaw” according to industry jargon), consumers typically incur a separate fee of $5 to $10. Most states ask for “thaw” requests to be sent to credit bureaus in writing, and they grant the bureaus three to five business days to honor them. But states including Utah and New Jersey have already mandated, effective September 2008, that bureaus unfreeze files within fifteen minutes.
Inevitably, procedural changes will lead to some confusion, and credit reporting agencies worry that the risks of a credit freeze may outweigh its advantages as an identity theft deterrent. “Any kind of credit transaction or other use of credit reports, which people many times don’t think about, can be held up, delayed or denied,” says Experian’s Sweet. Among the most significant legitimate transactions are those that deal with acquiring jobs or apartments. Some states have reacted to this viewpoint by exempting landlords and employers from a credit freeze, allowing them access to a consumer’s credit report even if it is frozen. Currently, only eight states allow landlords such unfettered access, while employers are granted the exemption in only three.
But then there are also less obvious concerns. “People just get surprised if they go to get a cell phone and they don’t realize that a cell phone, for example, is one of the biggest areas of fraud and most cell phone companies will check a credit report,” Sweet says. “People might not have their password at hand and aren’t prepared to get the freeze turned off.” She laughs when she adds, “You might say that’s a frivolous one—for most of us it’s not. It’s more emotional for people sometimes than a mortgage.”
However, some circumstances are clearly not frivolous, Rubinger says. “There might be more of an emergency situation. It’s ten degrees outside and suddenly your apartment is freezing. You don’t have money to pay for [a new hot water heater], and need somebody to come out to do the repair.” In order to open a new credit card to pay for this repair, Rubinger explains, a person would need to unfreeze their credit report, which by law could take up to three days.
Should You Freeze Your Credit?
When consumers have been victims of identity theft (a thief has used their information to open credit accounts), it usually makes sense for them to freeze their credit to prevent the crook from opening additional accounts.
For consumers who are just worried about the possibility of fraud – those who have been victim of a data breach at a retailer, for example, or who have had a single credit card compromised or a wallet lost or stolen – it may be overkill. Instead they may want to place a “fraud alert” on their credit file, which instructs creditors to verify the applicant’s identity before opening a new account. While a fraud alert does not lock down the file the way a freeze does, it can still be useful and it won’t require them to unfreeze their reports if they apply for credit, try to get a cell phone, etc.
All consumers, fraud victims or not, should monitor their credit. At a minimum, it’s important to take advantage of the opportunity to get your credit reports once a year for free from each of the major credit reporting agencies, and to monitor your credit scores each month, which you can do for free at Credit.com. If you do suspect fraud, subscribing to a credit monitoring service with alerts can be useful.