Boston credit freeze rights. Free does not mean automatic

A credit freeze restricts access to a consumer credit file without a subscription. The CFPB’s published rules require separate requests to three companies, and they do not block every kind of screening.

The Consumer Financial Protection Bureau’s credit freeze guidance, last reviewed September 5, 2025, says consumers can restrict access to their credit files free of charge without affecting their scores. Boston households do not need a paid monitoring subscription to use that protection.

These are federal protections, not a Boston-only program or a new Massachusetts law. They are useful to understand before applying for a card or loan, as well as after a suspected theft of personal information. A freeze limits access to the credit file; it does not simply put a warning label on an application.

What a credit freeze actually stops

In its security-freeze guidance, the CFPB explains that prospective creditors cannot access a frozen file. Because creditors typically will not offer credit without seeing that information, the restriction can prevent an identity thief from opening a new credit account. It can also prevent the legitimate consumer from doing so while the freeze remains in place.

The distinction matters for someone preparing a credit application. A freeze is not evidence that an application is fraudulent, and lifting it is not a guarantee that a lender will approve the application. It controls access to information used in the decision. Treat the freeze and the lending decision as separate steps.

A frozen file is not sealed against everyone. The bureau lists existing creditors, certain government entities such as child support agencies, and companies hired to monitor the file among the limited groups that can still see it. The consumer can also request, inspect and review their own file while it is frozen.

Contact all three companies, not just one

The CFPB directs consumers to Equifax, Experian and TransUnion and says each must be contacted separately. Its guidance links to the companies’ websites. Completing one request should therefore not be treated as completing the whole task. Keep a separate record of each confirmation and the instructions for removing that company’s freeze.

There are statutory processing periods. For a request made by telephone or secure electronic means, a nationwide reporting company must place the freeze within one business day. For a mailed request, the limit is three business days after receipt. Written confirmation must follow no later than five business days after the freeze is placed, along with instructions on how to remove it.

Those periods are a reason to plan ahead rather than trying to manage a freeze while a lender waits. For a removal requested by toll-free telephone or secure electronic means, the bureau says the deadline is one hour after receipt. Mailed removal requests have a three-business-day deadline. A consumer can also lift the freeze temporarily for a specified period, without charge, under the same timing rules.

A paid lock is not the same purchasing decision

Credit reporting companies may sell credit locks alongside other paid services. The CFPB says those locks are no more effective than free security freezes. Before accepting a subscription, identify whether the product being offered is the free statutory freeze or a paid package with additional features. The existence of a paid offer does not remove the right to request a free freeze.

Do not assume a freeze controls every screening process. The CFPB expressly says the federal law requiring free security freezes does not apply to requests for credit reports for employment, tenant-screening or insurance purposes. For a Boston renter or job applicant, that is an important limit: the consumer-credit protection should not be mistaken for a universal block on background checks.

A fraud alert has a different function

The bureau also distinguishes a fraud alert, which requires creditors checking a report to take steps to verify identity before opening a new account, issuing an additional card or increasing an existing account’s credit limit at a consumer’s request. An initial alert lasts up to one year unless removed sooner. It is not described as the same access restriction as a freeze.

For Boston households, the practical starting point is to decide which task needs doing: restricting access to credit files, verifying an applicant’s identity or arranging access for a legitimate application. This is a guide to the CFPB’s published consumer information, not an assessment of an individual’s legal dispute. The agency’s page supplies the official company links and the detailed rules to check before acting.

For a separate court procedure, see TockBOS’s small-claims court guide. A consumer-information request is not a court filing.