Credit Freeze Request Letter — Free Security Freeze Under FCRA § 605A (15 U.S.C. § 1681c-1)

A security freeze (sometimes called a 'credit freeze') is your strongest free tool against new-account identity theft. When your file is frozen, the consumer reporting agency is prohibited from releasing your credit report to most third parties — which means a lender who pulls your credit before opening a new account gets nothing, and the application stalls. The freeze does not affect your credit score, your existing accounts, or your own access to your report; it only blocks NEW creditors from seeing your file until you lift it. The controlling law is the Fair Credit Reporting Act, § 605A, codified at 15 U.S.C. § 1681c-1. The national security-freeze provisions in subsection (i) were added by Title III of the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 (Pub. L. 115-174), effective September 21, 2018 — which is why freezes are now free and uniform in all 50 states, superseding the patchwork of state fee laws that existed before.

The numbers are statutory, not bureau policy. Under 15 U.S.C. § 1681c-1(i)(2)(A), the agency must place a freeze 'free of charge' within 1 business day of a request made by toll-free phone or secure electronic means, or within 3 business days of a request made by mail. Under § 1681c-1(i)(3)(C), it must lift or remove the freeze 'free of charge' within 1 hour of an electronic or phone request, or within 3 business days of a mail request. Under § 1681c-1(i)(2)(B), within 5 business days of placing the freeze the agency must confirm it and give you what you need to lift it later (typically a PIN). Because the statute says 'free of charge,' a bureau may not charge you to place, temporarily lift, or permanently remove a freeze — for you, your spouse, your minor children, or a protected adult — ever.

Know the three distinct tools, because the bureaus blur them. (1) A security freeze, § 1681c-1(i): free, blocks new creditors, you control it with a PIN, lasts until you lift it. This is the strongest and the subject of this letter. (2) A fraud alert, § 1681c-1(a): also free, but weaker — it does NOT block access to your file; it tells anyone who pulls your report to take reasonable steps to verify your identity before extending credit. The 2018 Act extended the initial fraud alert to a minimum of 1 year (it was 90 days), renewable; an extended 7-year alert under § 1681c-1(b) requires an identity-theft report. A fraud alert at one bureau must be referred to the other two; a freeze must be requested at each. (3) A credit lock is NOT a statutory creature at all — it is a contractual product the bureaus sell (sometimes inside a paid monitoring bundle), governed by their terms of service rather than by 15 U.S.C. § 1681c-1. Locks can be convenient (instant app-based toggling), but you trade away the federal free/timing guarantees and any FCRA enforcement leverage. When you want the law on your side, ask for the security freeze by name.

Practically, the freeze regime is federally uniform, so there are no real 'tiers' on the core right — the free, 1-business-day, all-50-states standard is the floor everywhere, and you can rely on the federal cite alone no matter where you live. Two wrinkles remain state-flavored. First, 'protected consumer' freezes — for minors under 16 and for incapacitated adults or those under guardianship — are addressed both in § 1681c-1 and in many state statutes; placing one usually requires proof of authority (birth certificate, power of attorney, or court order) in addition to the standard ID. Second, a handful of states layer on extra identity-theft remedies (for example, a state-law private right of action or a deceased-person freeze) on top of the federal floor; those are bonuses, not substitutes. The federal default in the letter works in every state; the state notes below flag the common add-ons.