Security freezes back in spotlight after high-profile data breaches
March 25, 2014 10:13 PM
By Patricia Sabatini / Pittsburgh Post-Gazette
In 2007 — on the heels of high-profile security breaches that left millions of consumers nationwide at risk for identity theft — Pennsylvania joined a growing list of states offering people the option of freezing their credit files and effectively blocking ID pirates from taking out loans and opening other credit accounts in their name.
In the wake of the massive data heist at the Target retail chain last fall, security freezes are again in the spotlight as a proven way for consumers to protect themselves.
“Any consumer, not only Target shoppers … should consider putting a security freeze on their three credit reports. Only a security freeze prevents identity theft,” said Ed Mierzwinski, consumer program director with U.S. PIRG in Washington, D.C., who successfully campaigned to get security freeze laws enacted nationwide.
When a freeze is in place, credit bureaus are prevented from releasing a file to potential creditors without the consumer’s permission. Since most businesses won’t open credit accounts without checking a consumer’s credit history, ID thieves are locked out.
Still, there are drawbacks to consider, including fees, which vary by state; some limitations; and the potential for delays when someone legitimately wants to apply for credit.
For Pennsylvania residents, it costs $10 to initiate a freeze and $10 to temporarily lift — or thaw — a freeze. People must lift a freeze if they want to apply for a mortgage, car loan, credit card or any other type of credit.
A thaw can be activated online or by phone by entering a personal identification number and selecting the number of days the consumer wants the freeze to be removed. The thaw can be a general one, or apply only to a specific creditor.
There’s no fee to permanently lift a freeze, which automatically expires in seven years.
Victims of ID theft who submit a police report can freeze and thaw their files at no charge, while people 65 and older can request a freeze for free but must pay $10 for a thaw.
To get the broadest protection, consumers should activate a freeze at all three of the major credit bureaus: Equifax, Experian and TransUnion.
One drawback of a freeze — besides requiring people to request a temporary thaw if they need credit — is that it also could interfere with other products and services that may require a credit check, such as getting insurance, renting an apartment, hooking up to a utility or opening a cell phone account.
And because it can take up to three business days for a thaw to take effect, shoppers could be prevented from getting instant store credit, the kind that promises 10 percent off or more on a purchase just for signing up for a credit card.
A credit freeze won’t stop misuse of existing bank or credit accounts, which is the most likely impact of the recent Target breach, Mr. Mierzwinski said.
The mass merchant reported hackers stole debit and credit card numbers that could be used to make fraudulent purchases with an existing account.
But the thieves didn’t get Social Security numbers needed to apply for new credit.
The fraudsters did grab customer contact information, such as addresses, phone numbers and email addresses. Those potentially could be used in targeted phishing scams designed to trick people into providing additional personal data needed to commit ID theft.
When thieves open new accounts in other people's names, they have the bills sent elsewhere so it takes time for consumers to catch on. Typically, people only learn about the fraud when they find out their credit is ruined or they get a call from a debt collector.
A security freeze is appropriate for people who don’t want to take the chance of spending an average of 40 hours cleaning up a credit mess and restoring their good name, according to Consumers Union, publisher of Consumer Reports magazine.
“Placing a security freeze can give you peace of mind that your consumer credit report and credit score won’t be hurt by a crook, even if someone steals your personal information,” Consumers Union said in an online tutorial.
To report inappropriate comments, abuse and/or repeat offenders, please send an email to
firstname.lastname@example.org and include a link to the article and a copy of the comment. Your report will be reviewed in a timely manner.