Fortunately, a new federal law is enhancing two key tools that Americans can use to help protect against identity theft: security freezes and fraud alerts.
Better yet, both tools are free.
The new law is known as the Economic Growth, Regulatory Relief, and Consumer Protection Act (EGRRCPA). It was signed into law by President Trump in May, and its changes went into effect in September, 2018.
What do these tools mean for you, and how can you take advantage of them? Read on to learn more.
Article at a Glance
- A security freeze prohibits a consumer credit report agency from sharing a consumer’s credit report with banks and other businesses considering extending the consumer credit.
- A fraud alert is a notice placed on a consumer’s credit report that requires any business considering extending credit to the consumer to take extra steps to verify his or her identity.
- Each of the three major credit reporting agencies will permit consumers to request a free credit freeze or fraud alert via its website. Links to those webpages will be available on IdentityTheft.gov.
What Is a Security Freeze?
The new law defines “security freeze” as “a restriction that prohibits a consumer reporting agency from disclosing the contents of a consumer report that is subject to such security freeze to any person requesting the consumer report.”
In short, when a security freeze is placed on a consumer’s credit file, credit reporting agencies are generally prohibited from disclosing the consumer’s credit report.
Security freezes help to protect a consumer against identity thieves who attempt to open new credit accounts in the consumer’s name. Because the organization being asked to extend credit is not able to check the consumer’s credit report (or will receive notice that the report is subject to a security freeze), the request for credit should be denied.
Starting September 21, 2018, the EGRRCPA requires that credit agencies place a security freeze on a consumer’s report upon request (and proof of the consumer’s identity). In the past, credit reporting agencies could charge for security freezes, but under the new law agencies must offer them for free. And typically, a security freeze will remain in place until the consumer requests its removal.
Many Credit Checks Are Exempt from the Freeze
Although the law defines “security freeze” broadly to prohibit disclosure to “any person requesting the consumer report,” its requirements are actually narrower than that definition suggests. Generally speaking, it only prohibits disclosure to “any person” considering extending credit to the consumer.
So, for example, a security freeze will not protect the credit report against disclosure to:
- A person or entity with which the consumer has an existing account if the request is made for the purpose of reviewing or collecting that account.
- Any court, government agency, or private collection agency acting under a court order, warrant, or subpoena.
- A child support agency enforcing a parent’s child support obligations.
- Government agencies investigating fraud or enforcing delinquent taxes or unpaid court orders.
- Insurance companies considering whether to insure the consumer.
- Anyone using the information to assess, verify, or authenticate a consumer’s identity for purposes other than granting credit, or for investigating or preventing fraud.
Caution: Security Freezes Have a Potential Downside
Security freezes can be critical to protecting yourself against identity theft. But they can also make obtaining credit more difficult. The law requires credit reporting agencies to notify consumers of this risk using the following language:
[Y]ou should be aware that using a security freeze to take control over who gets access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, or any other account involving the extension of credit.
The required notice points to an alternative that has also been improved by the new law: free fraud alerts.
What Are Fraud Alerts?
A fraud alert is a statement in a consumer’s credit report that clearly and conspicuously notifies recipients of the report that the consumer may be a victim of fraud, including identity theft. Anyone that receives a credit report with a fraud alert must take additional steps to verify the consumer’s identity before extending credit.
There are two types of fraud alerts: an initial fraud alert and an extended fraud alert. An extended fraud alert is free for seven years and is available if a consumer files an identity theft report with the credit reporting agency.
The initial fraud alert is the one that has been enhanced by the new law. Previously, credit reporting agencies were required to provide free initial fraud alerts for 90 days for any consumer who asserts in good faith a suspicion that he or she has been or is about to become a victim of fraud or related crime, including identity theft.
Under the new law, that free initial fraud alert has been extended to one year.
(Similar alerts, called “active duty alerts,” are also available for members of the military on active duty.)
How to Take Advantage of the New Law
Under the EGRRCPA, credit reporting agencies must establish a webpage where consumers can request a security freeze or fraud alert. They will also accept requests for those services via telephone or snail mail. (In any event, the agency will have to verify your identity before placing the freeze.)
As of now, only Equifax is offering free credit freezes. TransUnion and Experian have yet to update their websites to comply with the new law, but they should do so within the coming weeks. The federal government’s website IdentityTheft.gov will provide links to those pages.
If you are a victim of identity theft or are concerned about your identity being stolen, you should seriously consider taking advantage of the new free tools required under the EGRRCPA. Although there is no surefire protection against identity theft, a security freeze or fraud alert can go a long way in helping to prevent others from opening new accounts in your name.