An illustration depicting a credit report and a credit freeze

Credit reporting companies such as Equifax, Experian, and TransUnion will soon be required to let consumers freeze and unfreeze their credit files free of charge.

The provision is part of a bipartisan bill signed Thursday by President Donald Trump that rolls back certain Dodd-Frank financial rules that Congress approved after the 2008 financial crisis.

Currently, consumers could pay up to $10 to freeze their credit reports, depending on where they live. The new rules take effect in 120 days.

Along with the free credit freezes are some other benefits. Consumers now have the right to place a fraud alert on their credit file at no cost for one year—up from 90 days currently.

If you do that, businesses will be required to take steps to verify your identity before extending new credit, providing you with extra protection but possibly delaying the amount of time it takes for you to get a new credit card, say, or be approved for a mortgage. In addition, victims of identity theft are entitled to an extended fraud alert lasting seven years.

Each credit reporting agency will also be required to create a web page that allows consumers to request security freezes and fraud alerts, and opt out of the use of their information by companies marketing credit or insurance products.

“The new law has strengths and weaknesses regarding credit freezes,” says Anna Laitin, director of financial policy at Consumers Union, the advocacy division of Consumer Reports. “It would enable individuals across the country to freeze and unfreeze their credit at no cost, a right that consumers in only a few states now have. However, it also preempts the ability of states to provide greater protections to consumers. States have been the innovators on credit freezes, and this legislation would stop that innovation in its tracks.”

Laitin points to recent legislation in California that would make it so that if a consumer freezes his or her credit report at one of the main credit reporting agencies, it would be frozen at the others as well, creating a one-stop shop for consumers seeking to implement a credit freeze.

Additional Steps to Take

But freezing your credit won’t protect you against every identity fraud threat.

If criminals get other information, including access to your Social Security number, birth date, and driver’s license number, they can still make your life miserable.

Here are three important areas where you can protect yourself.

More on Credit Reporting

Your Driver’s License
Using your driver’s license number, identity thieves can create bogus driver’s licenses and hang their moving violations on you. With more work and information from phishing or further hacking, identity thieves can create bogus checks to pay a cashier, who “verifies” the shopper’s identity by writing your license number on the bad check.

If this happens to you, you may not discover how your license has been used until a police officer tells you or, perhaps, until a bank closes your account because of too many bounced checks.

How to protect yourself. Ask the motor vehicles department to give you a copy of your driving record; most states charge for this, usually about $10. To find out whether any bad checks are attributed to your accounts, request your free annual consumer report from major check-verification companies ChexSystemsCertegyEarly Warning Services, and TeleCheck.

If you find that your driver’s license is being used fraudulently, you can file a report at your local police department and alert your state’s motor vehicles department. Some will to flag your license number for the police if they stop someone using that number. You should also request a new driver’s license number.

If you’re arrested or find criminal charges on your record, go to the Identity Theft Resource Center for advice on clearing criminal identity theft; if you find fraudulent checks on your record, follow the ITRC for advice on resolving checking-account fraud. You can also call the center at 888-400-5530 for free assistance.

Tax Refunds
With your Social Security number, crooks can file false income tax returns in your name, take bogus deductions, and steal the resulting refund. More than 14,000 fraudulent 2016 tax returns, and $92 million in unwarranted refunds, were detected and stopped by the Internal Revenue Service as of March 2017.

Though you are generally not liable for such fraud, if a criminal manages to change your tax records and receive your refund, it can take months to straighten out the mess.

How to protect yourself. The best defense is to obtain an Identity Protection PIN from the IRS, which is a code that must be filed with your legitimate return for it to be accepted. An identity thief can’t file his fraudulent return without your PIN.

But you can get a PIN only if you receive a CP01A form (which is sent to identity theft victims), the IRS invites you to opt in, or you live in Georgia, Florida, or Washington, D.C., areas with the highest rates of tax-related identity theft. 

Andrew Mattson, a partner at Moss Adams, a tax firm in California’s Silicon Valley, recommends that taxpayers who are worried that their data may have been stolen but don’t officially qualify for a PIN should file a Form 14039, Identity Theft Affidavit (PDF). “Your account would be flagged for additional monitoring for suspicious activity,” he says.

Mattson also recommends that you periodically view your IRS account information, which shows when returns were filed and which refund payments were made. Activity there—if it’s not yours—can be a sign of fraud. The balance updates every 24 hours, usually overnight, but there is a one- to three-week lag in the time it takes for payments to show up.

If you suspect fraud, you can contact the IRS online or find an office near you using the Taxpayer Assistance Center Office Locator.

Health Insurance
Criminals can also steal your benefits from private health insurance, Medicare, or Medicaid when the identity thief uses your coverage to pay for his own medical treatment and prescriptions.

Many health insurers have internal special investigation units and anti‐fraud personnel to root out medical identity fraud, and if suspicious activity is detected, they’ll send email alerts to the policyholder, says Cathryn Donaldson, a spokeswoman for America’s Health Insurance Plans, the trade association of health insurers.

How to protect yourself. Get copies of your medical records from providers to establish the baseline of your health before your records are compromised. Increasingly, online patient portals make this easy to do. Check back regularly to see whether providers you didn’t use are listed and whether you’ve been charged for treatments you never received.

In addition, review your free annual MIB Consumer File, which contains medical and personal information about you reported by health, life, disability, and other member insurers. Do the same for your Milliman Intelliscript report, which may have information on your prescription drug history.

The Federal Trade Commission also says consumers should ask each of their health plans and medical providers for the “accounting of disclosures” related to their medical records. That tells who got copies of your records from the provider. The law allows you to order one free copy from each medical provider every year.

If available, sign up for your insurer’s secure online portal, and regularly review the explanation of benefits, which shows which treatments you received when and from which providers. Some insurers offer the option to sign up for fraud alerts.

Regularly review your credit report for medical collection accounts that don’t belong to you.