New Report: Consumers Should Get Security Freezes Before Next Data Breach

Media Contacts

Security Freezes Are Only Way to Prevent New Account Identity Theft

MASSPIRG Education Fund

Boston, MA – Credit monitoring and other services that are usually offered to data breach victims and other concerned consumers do nothing to prevent identity theft; they only detect certain types of fraud after it has occurred. A report and consumer fact sheet released today by the MASSPIRG Education Fund aim to increase the awareness and use of the security freeze, also known as a credit freeze. The report explains that the freeze is the only security measure that can prevent new account identity theft.

“Only the security freeze can prevent someone from opening a new credit account in your name,” said Deirdre Cummings, Consumer Program Director for the MASSPIRG Education Fund. “Credit monitoring services may tell you about fraud, but only after you’ve already been victimized. Worse, they are often offered after many of these large scale retail credit breaches, even though they offer no help against unauthorized use of your existing accounts, which is the fraud most likely to occur from that type of breach.”

A security freeze works by preventing a consumer’s credit report from being shared with potential new creditors, such as banks or credit card companies. Most creditors will simply not issue credit if they cannot see the applicant’s credit report or score derived from it. The report recommends that the best course of action for most consumers is to place security freezes with the three major national credit bureaus until they want to apply for credit, at which time they can easily unfreeze or “thaw” their reports. 

“Whether your personal information has been stolen or not, your best protection against someone opening new credit accounts in your name is the security freeze, not the often-offered credit monitoring services, which only alert you after a new account has been applied for or opened,” added Cummings. 

The report, “Why You Should Get a Security Freeze Before Your Information is Stolen,” offers the following information for consumers:

  • It explains the best steps consumers can take against new account financial identity theft, such as placing a security freeze on their “Big 3” credit reports.
  • It explains the process of freezing and temporarily unfreezing reports when opening new credit.
  • It warns consumers about “phishing” and social engineering schemes used by thieves trying to obtain more information to enable more complex forms of identity theft. For example, a thief who has obtained only a credit card number may call and trick consumers into giving up their Social Security Number, which is needed to facilitate new account identity theft. Thieves will also send “phishing” emails containing malicious links. They will also seek to combine breached information with additional information easily available about consumers online.
  • The report warns of newer types of identity theft and additional harms enabled by breaches of health insurance companies (theft of medical services), the IRS (theft of tax refunds) and even the federal government’s Office of Personnel Management (new account identity theft and reputational harm). 

“Only the security freeze offers peace of mind against new account financial identity theft, but consumers still need to be vigilant about other identity threats and potential harms posed by the easy availability of non-public personal information, from both breaches and other sources,” said Cummings. “Check your accounts regularly, don’t give out information to someone who phones – call the number on your bank or health insurance card to verify request — and don’t click on email links.” 

In Massachusetts, if you or your spouse is a victim of identity theft and submit or have previously submitted a copy of a valid police report, investigative report or complaint filed with a law enforcement agency about the unlawful use of your personal information by another person, no fees will be charged by the credit bureaus to place, thaw or lift – temporarily or permanently- a security freeze from your credit file, or replace a forgotten PIN. If you have not been a victim of identity theft, each of these transactions will cost $5. 

The report reiterates that neither credit monitoring nor a security freeze can detect or prevent unauthorized use of existing credit accounts or other types of fraud or identity theft. Regarding fraud on existing accounts, many banks and credit card companies already have mechanisms in place to detect such fraud and remove unauthorized purchases. Positively, the report notes that as of October 1, nearly all credit and debit cards have been replaced with “chip” cards. At the same time, most merchants will also replace their “swipe” terminals with “swipe or dip” terminals. A “chip” card that is dipped does not transfer actual account numbers to the merchant’s computer at all, greatly reducing the likelihood of existing account fraud victims. However, consumers should be aware that while chip cards will stop most in-person retail fraud they will have no effect on online fraud, although PIN debit cards will. Most banks, however, are only issuing “Chip and Signature,” not “Chip and PIN” cards.

“If you can avoid running up credit card debt, always use credit cards online, not debit cards,” added Cummings. “If you haven’t lost your actual debit card, but only had the account number stolen, your legal rights are quite strong, but why face cash flow problems after losing money from your bank account while you wait for the bank to investigate and put it back?”

The report also notes that paid credit monitoring services, which generally range from $9.99/month-$19.99/month or more, are not necessary because federal law requires each of the three major credit bureaus to provide a free credit report every year to all customers who request one — if requests for reports from one of the three credit bureaus are staggered every four months or so, free credit monitoring can essentially be achieved.

“Sure, a credit monitoring service might detect theft faster than you might on your own, depending on when the theft occurs and when you check your reports. But is it worth the $10 – $20 or more in monthly fees to find out about theft after someone has already attempted to or successfully opened a new account in your name when you can monitor your own accounts and prevent such activity with less costly security freezes?” asked Cummings.


MASSPIRG Education Fund works to protect consumers and promote good government. We investigate problems, craft solutions, educate the public, and offer meaningful opportunities for civic participation.


Download the report, “Why You Should Get a Security Freeze before Your Information is Stolen.”

This is one of a series of reports by the MASSPIRG Education Fund that educates consumers about privacy and data security issues. 

Links to our online fact sheets:

How to Avoid Identity Theft:

How to use a Security Freeze: