Credit freeze: Confusing — but so crucial to have

Susan Tompor

One year ago, consumers woke up and found that hackers had one heck of a field day with their Social Security numbers and other information in a massive data breach at Equifax.

Equifax’s screw-up would forever leave millions that much more vulnerable to ID theft. Face it, it’s not like you can change the locks on the side door. Once hacked, your Social Security number is out there indefinitely.

But beginning Sept. 21, a new federal law will help consumers stop intruders in their tracks. The three big credit reporting agencies — Equifax, Experian and TransUnion — will be required to offer you a credit freeze, free. Such a freeze will restrict access to your credit file and help stop crooks from opening credit cards in your name.

Also starting Sept. 21, parents across the U.S. will be able to get a free credit freeze for children under age 16. A child’s credit file would be frozen until the child is old enough to use credit.

The new law is a key step for regaining some control over our data. But there’s a not-so-small challenge ahead: Many have no idea what a credit freeze is and how it works, according to new research by a team at the University of Michigan School of Information in Ann Arbor.

Amazingly, some consumers wrongly think that a credit freeze stops them from using their own credit cards.

So what exactly is a credit freeze? A credit freeze stops many but not all businesses and others from reviewing your credit file. The consumer who signs up for a voluntary credit freeze is given a PIN — that you want to keep track of — to use if you want to unfreeze that credit file to apply for new credit.

Under the new law, if a consumer asks for a freeze online or by phone, the credit reporting agency has to put the freeze in place no later than the next business day, according to a Federal Trade Commission blog. If the consumer wants to lift the freeze — for example, to finance a new phone or fridge — that has to happen within an hour.

“It’s just assumed that people know what a credit freeze is,” said Florian Schaub, a University of Michigan assistant professor of information, whose research focuses on security and privacy issues. But Schaub, 35, said too often “credit freeze” is just swept into the jargon in the industry — jargon that many consumers do not understand. Many times, people only fully understand a credit freeze once they’re victims of ID theft and told that a credit freeze is essential.

Some consumers had a hard time understanding the term “fraud alert” as well. Some thought the alerts were when a bank or credit union would text you when fraudulent activity was detected on your account.

Instead, placing a fraud alert on your credit file actually means you’re adding a red flag, if you will, to your credit report to alert a lender to verify your identity before making a loan. Under the new law, a fraud alert will last a year, instead of 90 days. If a victim of identity theft, you’d still be able to extend a fraud alert for seven years.

But all that jargon — freezes, locks, alerts — can confuse consumers who are already overwhelmed in their financial lives.

Schaub said the credit bureaus don’t have much incentive to carefully explain things like credit freezes or fraud alerts. After all, their business model is to collect and aggregate our information to provide to lenders who want to sell us loans.

“We, as citizens, are not their customers,” he said. “What makes them money is sharing our credit reports with other businesses.”