A security freeze, under the Fair Credit Reporting Act (15 U.S.C. § 1681c-1(i)(1)(C)), is a restriction that prohibits a consumer reporting agency from disclosing the contents of a consumer report that is subject to the freeze to any person requesting the consumer report, subject to the exceptions in § 1681c-1(i)(4). In that subsection, "consumer reporting agency" means the nationwide agencies described in 15 U.S.C. § 1681a(p) (§ 1681c-1(i)(1)(A)). The CFPB says it is also called a credit freeze.
Placed free, within 1 or 3 business days: on a direct request from the consumer and proper identification, the agency must place the freeze free of charge not later than 1 business day after a request by toll-free telephone or secure electronic means, or 3 business days after a request by mail (§ 1681c-1(i)(2)(A)).
Removed free, within 1 hour or 3 business days: on a direct request and proper identification, not later than 1 hour after a request by toll-free telephone or secure electronic means, or 3 business days after a request by mail; a temporary removal covers the period of time the consumer specifies (§ 1681c-1(i)(3)(C), (E)).
Not every report is covered: § 1681c-1(i)(4) lists uses the freeze does not apply to, including review or collection of an account the consumer has or had with the requester or its subsidiaries, affiliates, agents, or assignees, insurance underwriting, and employment, tenant, or background screening.
Where you'll see it
In the confirmation. Not later than 5 business days after placing a freeze, the agency must send the consumer confirmation of the placement and inform the consumer of the process for removing it, including a mechanism to authenticate the consumer, and of the consumer's right described in § 1681m(d)(1)(D) (§ 1681c-1(i)(2)(B)). Whenever a consumer is required to receive the FCRA summary of rights under § 1681g, § 1681c-1(i)(5) adds a notice titled "Consumers Have the Right To Obtain a Security Freeze." Each agency must also have a webpage that allows a consumer to request a freeze, and that webpage must not be the only mechanism by which a consumer may request one (§ 1681c-1(i)(6)(A)).
The rule behind it
The term "security freeze" means a restriction that prohibits a consumer reporting agency from disclosing the contents of a consumer report that is subject to such security freeze to any person requesting the consumer report.
Upon receiving a direct request from a consumer that a consumer reporting agency place a security freeze, and upon receiving proper identification from the consumer, the consumer reporting agency shall, free of charge, place the security freeze not later than— (i) in the case of a request that is by toll-free telephone or secure electronic means, 1 business day after receiving the request directly from the consumer; or (ii) in the case of a request that is by mail, 3 business days after receiving the request directly from the consumer.
Under § 1681c-1(i)(3)(A), the agency removes a freeze only upon the direct request of the consumer, or if the freeze was placed due to a material misrepresentation of fact by the consumer, in which case it must notify the consumer in writing before removing it (§ 1681c-1(i)(3)(B)). If a third party requests the consumer's report in connection with an application for credit while a freeze is in effect, and the consumer does not allow the report to be accessed, the third party may treat the application as incomplete (§ 1681c-1(i)(3)(D)).
Who the freeze does not apply to (§ 1681c-1(i)(4)), each with its own conditions: a person or entity with which the consumer has or had an account or contract, or to whom the consumer issued a negotiable instrument, and its subsidiaries, affiliates, agents, assignees, and certain prospective assignees, for the purposes of reviewing the account or collecting the financial obligation owed; government agencies, law enforcement agencies, trial courts, or private collection agencies acting pursuant to a court order, warrant, or subpoena; child support agencies acting under part D of title IV of the Social Security Act; a Federal agency, or a State or its agents or assigns, acting to investigate fraud, to investigate or collect delinquent taxes or unpaid court orders, or to fulfill other statutory responsibilities consistent with a permissible purpose under § 1681b; a person using credit information for the purposes described in § 1681b(c); a person or entity administering a credit file monitoring subscription or similar service to which the consumer has subscribed; a person providing a consumer with a copy of the consumer's own report or credit score on request; and any person using the information for insurance underwriting; for employment, tenant, or background screening; for assessing, verifying, or authenticating a consumer's identity for purposes other than the granting of credit; or for investigating or preventing actual or potential fraud.
What the CFPB says
A credit or security freeze prevents prospective creditors from accessing your credit file.
The federal law requiring free security freezes does not apply to someone who requests your credit report for employment, tenant-screening, or insurance purposes.
Security freeze vs. fraud alert
Both are in the same section of the FCRA, and both are placed by the nationwide agencies described in § 1681a(p). A freeze restricts disclosure of the report itself. A fraud alert is a notice included in the file. Under § 1681c-1(a)(1), on the direct request of a consumer who asserts in good faith a suspicion that the consumer has been or is about to become a victim of fraud or related crime, including identity theft, a nationwide agency that maintains a file on the consumer and has received appropriate proof of the identity of the requester must include an initial fraud alert in the file for a period of not less than 1 year, unless the consumer asks to remove it sooner, and must refer it to each of the other nationwide agencies. Under § 1681c-1(b), on the direct request of a consumer who submits an identity theft report to a nationwide agency that maintains a file on the consumer, if the agency has received appropriate proof of the identity of the requester, the agency must include an extended alert covering the 7-year period beginning on the date of the request, unless the consumer asks to remove it sooner. The CFPB says a fraud alert requires creditors who check your credit report to take steps to verify your identity before opening a new account, and, for a freeze, says you must contact each nationwide credit reporting company separately.
Questions people ask
Does a security freeze affect your credit score?
The CFPB says: "Security freezes do not impact your credit scores in any way whatsoever."
Is a credit freeze free?
At the nationwide consumer reporting agencies covered by § 1681c-1(i), placing and removing a freeze on a direct request from the consumer with proper identification is free of charge under § 1681c-1(i)(2)(A) and (i)(3)(C).
How long does a security freeze last?
Under § 1681c-1(i)(3)(C), except where it was placed due to a material misrepresentation of fact by the consumer, a freeze remains in place until the consumer directly requests that it be removed.
Who can still see my credit report with a freeze?
The uses listed in § 1681c-1(i)(4), described above. The CFPB's examples are creditors of accounts you currently hold, certain government entities, such as child support agencies, and companies you've hired to monitor your credit file, and it says you can also request, see and review your files when a freeze is in place.
Can you freeze a child's credit?
Section 1681c-1(j) covers a protected consumer: an individual under the age of 16 years at the time a request for the placement of a security freeze is made, or an incapacitated person or a protected person for whom a guardian or conservator has been appointed. On a direct request from the protected consumer's representative, with sufficient proof of identification and sufficient proof of authority, the agency must place the freeze free of charge, and if it has no file on the protected consumer, it must create a record for the protected consumer (§ 1681c-1(j)(2)). In that subsection, a security freeze is defined as a restriction that prohibits the agency from disclosing the contents of the consumer report or, for a protected consumer with no file at the agency, the record, to any person requesting the consumer report for the purpose of opening a new account involving the extension of credit (§ 1681c-1(j)(1)(E)); after placement, unless the freeze is removed under that subsection, the agency may not release the protected consumer's consumer report, any information derived from it, or any record created for the protected consumer (§ 1681c-1(j)(3)).
Sources: 15 U.S.C. § 1681c-1 · 15 U.S.C. § 1681a · CFPB: What is a credit freeze or security freeze on my credit report?
Sources last checked: October 23, 2026.
Everything here is consumer information — not financial or legal advice. It covers what a rule says and where to find it; the decisions stay yours.