OLR Research Report

March 1, 2006




By: Daniel Duffy, Principal Analyst

You asked for a summary of the credit freeze law and for contact information for the three primary credit reporting agencies.


Credit freeze laws generally prohibit a credit rating agency from releasing any information in a consumer's credit report without the consumer's express authorization. Connecticut's law requires an agency to “freeze” a consumer's credit report within five business days after a consumer requests. It creates ways by which a consumer can release his report permanently, temporarily, or to a specific third party. It allows agencies to charge a consumer up to $10 for each freeze or removal and up to $12 for a temporary removal for a specific third party.

It allows an agency to deny a request to implement a freeze, or to remove one, if in good faith it believes the request involves fraud or misrepresentation.

The law authorizes most types of businesses to deem a credit application incomplete, and insurers to deny an application, if they find that a consumer's credit report is frozen.


The law allows a consumer to ask a credit rating agency to place a security freeze on his credit report. The law took effect on January 1, 2006 (CGS 2006 Supp. 36a-701 & 36a-701a). A consumer request to freeze a report must be made in writing by certified mail or by another secure method authorized by the agency. The law requires an agency to freeze the report within five business days after a consumer requests and send the consumer written confirmation with a unique personal identifier or password within 10 business days thereafter, unless it has a good faith reason not to do so. It requires an agency to keep the freeze in effect unless temporarily or permanently removed at the consumer's request. A “credit report” is a credit rating agency's written or oral report, recommendation, or representation about a consumer's credit worthiness, credit standing, or credit capacity, including information sought to determine credit eligibility. A “consumer” is a person using or seeking credit for personal, family, or household purposes.

The law defines “security freeze” as a notice placed in a consumer's credit report, at his request, that prohibits an agency from releasing the report, or any information in it, without the consumer's express authorization.

Removing or Suspending a Freeze

The law allows a consumer to use the unique identifier or password sent by a credit rating agency to authorize the agency to permanently or temporarily remove a freeze or release a credit report to a specific third party. If a consumer wants to remove the freeze, he must provide proper identification and his unique identification number or password. If he wants to disclose his information for a period of time or to a third party, he must also provide proper information about the time period for which the credit report will be available or the third party to receive the credit report.

The law requires an agency that has received a request to remove a freeze, either temporarily or permanently, to do so by the third business day after receiving the request. It authorizes agencies to develop procedures to receive and process the requests. These must allow a consumer to send requests by e-mail, letter, or facsimile.

Denying a Request to Implement or Remove a Credit Freeze

The law authorizes a credit agency to remove a credit freeze or to refuse to implement one if it believes in good faith that (1) the request was part of a fraud that the consumer participated in or knew about or can be demonstrated by circumstantial evidence or (2) the report was frozen due to a material misrepresentation of fact by the consumer.

The law requires an agency to notify the consumer in writing by the fifth day after refusing to implement a freeze or by the fifth day before removing a freeze.

Requests for Information from Frozen Credit Reports

The law authorizes an insurer to deny an application if an applicant has placed a freeze on his report and has not authorized its disclosure to the insurer. It authorizes other third parties to deem a credit application incomplete if it requests access to a consumer's frozen credit report in conjunction with a credit application, or for another purpose, and the consumer has not authorized disclosure to the third party.

Exempted Disclosures

The law allows agencies to disclose frozen credit reports to:

1. a person, or the person's subsidiary, affiliate, agent, or assignee with which the consumer has or, prior to assignment, had an account, contract, or debtor-creditor relationship to review the account or collect a debt;

2. a subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted to facilitate the extension of credit or another permissible use;

3. anyone acting according to a court order, warrant, or subpoena;

4. anyone for “prescreening” as provided by the federal Fair Credit Reporting Act;

5. anyone solely to provide credit file monitoring subscription services to which a consumer subscribes;

6. a credit rating agency solely to provide a consumer with a copy of his or her own credit report on request; or

7. a federal, state, or local government, including a law enforcement agency or court or their agents or assignees pursuant to their statutory or regulatory duties.

The law defines "reviewing the account" as including activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements. Federal law on credit rating agencies (15 USC 1681, et seq.) does not define “prescreening,” but it does prohibit states from adopting any requirements or prohibitions concerning prescreening reports for credit or insurance transactions not initiated by a consumer (15 USC 1681t, 1681b(c), and 1681(e)).

Business Exempt from Placing a Freeze

The law states that the following businesses are not required to place a freeze on a consumer's report, but they are subject to a freeze placed on a credit report by a credit rating agency:

1. a check services or fraud prevention services company that reports on incidents of fraud or issues authorizations to approve or process negotiable instruments, electronic fund transfers, or similar methods of payment;

2. a deposit account information service company that issues reports on account closures due to fraud, substantial overdrafts, automated teller machine abuse, or similar information to inquiring banks or other financial institutions to use only to review a consumer's request to open a deposit account; or

3. a credit rating agency that (a) only resells credit information by assembling and merging it in a database of one or more credit reporting agencies and (b) does not keep a permanent database of credit information from which new credit reports are produced.


The contact points for the three primary credit reporting agencies are:

P.O. Box 740241
Atlanta, GA 30374-0241

P.O. Box 9532
Allen, TX 75013

TransUnion - Fraud Victim Assistance Division
P.O. Box 6790
Fullerton, CA 92864-6790