A CPA's Guide to Credit Freezes: Your First Line of Defense Against Identity Theft

Bottom Line Up Front (BLUF)

A credit freeze, also known as a security freeze, is the single most effective action you can take to prevent criminals from opening new credit accounts in your name. By federal law, it is free to place, manage, and remove. A freeze works by restricting access to your credit report, which most lenders require before approving a new line of credit. To be effective, you must place a freeze independently with each of the three major credit bureaus: Equifax, Experian, and TransUnion. This action does not affect your credit score.

The System: Your Personal Security Framework

Think of your personal financial data like a house. A single lock on the front door isn't enough; you need locks on the windows, a security system, and perhaps a safe for valuables. Identity protection works the same way. It is a system of layered, independent defenses, not a single product.

A credit freeze is the foundational layer—the deadbolt on your financial front door. It excels at stopping one specific threat: new account fraud. However, it does not stop tax fraud, medical fraud, or fraudulent charges on your existing accounts. This guide will walk you through setting up this foundational layer and then introduce the other critical systems you need for comprehensive protection.

Layer 1: The Credit Freeze Mechanism

A credit freeze is a legal right granted by federal law. When you place a freeze, the credit bureau is legally prohibited from releasing your credit file to most third parties without your express permission.

• Input: You request a freeze online, by phone, or by mail with a credit bureau.
• Mechanism: The bureau places a restriction on your credit file. When a lender (e.g., a bank or car dealership) attempts to pull your credit for a new application, their request is denied.
• Output: The lender cannot assess your creditworthiness and will deny the fraudulent application.

This system is highly effective. If a criminal can't get your credit report, they can't get a loan in your name.

How to Place a Credit Freeze (Action Steps)

You must contact each of the three major bureaus individually. We recommend bookmarking their specific security freeze pages. For an added layer of protection, also freeze your file with Innovis, a smaller fourth bureau.

After you place the freeze, each bureau will provide you with a way to unfreeze it, typically a PIN or a username/password for an online account.

How to Temporarily "Thaw" Your Credit

A freeze is not permanent. When you need to apply for new credit (like a mortgage, auto loan, or credit card), you must temporarily lift the freeze. This is called a thaw.

The thaw mechanism provides you with precise control:

• If/Then Logic: If you are applying for a mortgage on Monday, then you can schedule a thaw to begin on Monday and end on Friday of that same week.
• Specific Creditor Access: You can also choose to lift the freeze for a specific creditor only, giving them one-time access.

By law, if you make the request online or by phone, the bureau must lift the freeze within one hour. Mail-in requests take longer. To thaw your credit, you will use the same links and phone numbers listed above and provide the PIN or password you secured.

Addressing Common Misconceptions

Understanding the precise function of a credit freeze is key to using it correctly.

• Myth 1: A Credit Freeze and a Credit Lock are the same.
  Fact: They are not. A credit freeze is a right guaranteed by federal law, which provides you with robust legal protections. A credit lock is a product sold by the credit bureaus, often as part of a monthly subscription. While it offers similar functionality (often via a convenient app), its terms are governed by a user contract, which can change. We recommend the legally protected freeze over a paid lock product.
• Myth 2: Freezing my credit protects me from all types of identity theft.
  Fact: A freeze only stops the opening of new credit accounts. It does not prevent a thief from using your existing credit card numbers, filing a fraudulent tax return to steal your refund, or committing medical identity theft. This is why a layered approach is necessary.
• Myth 3: Freezing my credit with one bureau is good enough.
  Fact: A lender can choose to pull your credit report from any of the three major bureaus. A criminal knows this. If you only freeze Equifax, they will simply find a lender who uses Experian or TransUnion. A freeze is only effective if it is placed with all three bureaus.

Layer 2: The IRS IP PIN System for Tax Fraud

Now that you have secured the "credit application" door, you must secure the "tax filing" door.

• The Threat: A criminal obtains your Social Security Number and files a fraudulent tax return in your name early in the tax season, directing your refund to their own bank account. When you file your legitimate return, the IRS rejects it as a duplicate.
• The Mechanism: The IRS Identity Protection PIN (IP PIN) is a six-digit number known only to you and the IRS. It acts as a second-factor authenticator for your tax return.
• The System in Action: If you have an IP PIN, your tax return cannot be e-filed without it. A criminal without your IP PIN is completely blocked from filing a fraudulent return, even if they have your SSN.

Action Step: You can voluntarily opt-in to the IP PIN program through the IRS website. Visit the Get an IP PIN tool at IRS.gov. The IRS will verify your identity and issue you a new IP PIN each year. We strongly recommend this for all clients.

Layer 3: Protecting Your Minor Children

A child's clean Social Security Number is a valuable target for criminals engaging in synthetic identity theft.

• The Threat: A criminal combines a real SSN (your child's) with a fake name and date of birth to create a new, "synthetic" identity. They can then build credit with this identity for years before it is discovered.
• The Mechanism: Federal law allows a parent or legal guardian to place a credit freeze on behalf of a minor. Since a child should have no credit file, this action prevents one from being created in the first place.
• Action Step: The process is more manual than an adult freeze. You will need to contact each bureau (Equifax, Experian, and TransUnion) by mail and provide documentation proving your identity and your relationship to the child (e.g., copies of your driver's license, your child's birth certificate, and their Social Security card). Each bureau's website provides specific instructions for this process.

The Solution: Building Your Personalized Protection Plan

This guide outlines the three most critical, non-negotiable layers of your personal security framework:

1. Place a Credit Freeze with all three major bureaus (and Innovis) to block new account fraud.
2. Enroll in the IRS IP PIN Program to prevent tax refund theft.
3. Place a Freeze for Your Minor Children to protect them from synthetic identity theft.

These actions form the foundation of your defense. However, your specific financial life—from how you manage investments to your online presence—may require additional, tailored protections. A complete plan considers all potential vulnerabilities.

To see how these layers fit together and identify gaps in your personal security, you need a systematic checklist. Use our upcoming Identity Protection Checklist to audit your current defenses and build a comprehensive plan tailored to your unique financial situation.