(CNN Money) — After the massive data breach at Equifax, consumer advocates called on Congress to make credit freezes free.
After the major hack exposed the personal information of millions of consumers, experts recommended credit freezes as a way to prevent identity theft.
While a credit freeze won’t prevent your personal information from being stolen in another data breach, it can protect you from thieves who try to open a line of credit in your name by blocking access to your credit reports.
The catch is that under current state laws, there’s often a fee to freeze. Plus you have to temporarily lift the freeze if you want to get a loan or open a credit card yourself. That may come with another fee.
States currently set the fees for placing and/or lifting the freeze. Most security freezes cost anywhere between $2 and $10, though several states have already made them free.
The new federal law, if passed, would make placing, temporarily lifting, and permanently removing freezes free for everyone. It would require consumer rating agencies like Equifax to fulfill the request within one business day if made online or over the phone, and within three business days if requested by mail.
The Senate bill has bipartisan support and is expected to pass this week. But it must be reconciled with the House. A similar bill passed by the House last year did not include a provision to make credit freezes free.
Seventeen consumer groups wrote to Congress in October asking lawmakers to make credit freezes free for everyone.
A spokesman for one of the groups, US PIRG, said the new bill doesn’t go quite far enough.
“Free credit freezes are a good thing. The problem is it would replace stronger state laws already on the books and preempt states from taking stronger action in the future,” said US PIRG consumer program director Mike Litt.
The group supports a different bill from Senator Jack Reed that would make credit freezes automatic. It also wants credit freezes to block access to credit reports for employment and insurance purposes — which the Senate banking bill does not.
“Congress should really deal with credit freezes separately and keep it out of a bill that exposes consumers to bad mortgages and racial discrimination,” Litt said.
The bill would raise the threshold at which banks are considered “too big to fail,” exempting about two dozen midsize US banks from some oversight.
After facing public outcry over the massive breach, Equifax said it would waive the fee for credit freezes through January 2018 and later extended to the benefit through June 2018. It’s free for all consumers, but only applies to your Equifax credit report. Without freezing your reports at the other two big credit rating agencies — Experian and TransUnion — you could still be vulnerable to identity theft.
The credit rating industry is not fighting the bill.
“We do think that it’s OK for us to charge a modest, regulated fee to help us recoup some of the costs of credit freezes. But given everything that’s happened in the past six months, we support the bill and creating a national standard,” said Francis Creighton, the president of the Consumer Data Industry Association.
An Experian spokesperson told CNNMoney that the company supports the federal freeze provision in the Senate bill because it will simplify the process for consumers. TransUnion did not respond to a request for comment.
An Equifax spokesperson said the company “supports a federal security freeze statute that simplifies the process for consumers.”
But freezes are “one of many tools” consumers can use to protect themselves from identity theft, she said.
In addition to credit freezes, Equifax, Experian and TransUnion also offer credit “lock” products, that essentially work like a freeze by blocking access to your credit report. Equifax recently launched a new app consumers can use to lock their Equifax credit report. The service is free for life. TransUnion has a similar service for free, and Experian charges $9.99 monthly for the lock as part of a credit monitoring package.
But consumer advocates are leery of the lock products, which are not regulated by federal law. The companies could use the information they gather when you sign up for the product, like your email address, for marketing purposes, Litt said.