Credit Report Security Freezes in Texas

Chapter 20 of the Texas Business and Commerce Code, read alone, describes a slow and priced procedure. Locking a credit file starts with a certified letter, the bureau has until the fifth business day to act, and the statute expressly permits a charge. Anyone who instead opens the freeze page at a nationwide credit bureau meets nothing of the sort. A second statute explains the gap: Congress wrote freeze rules into the Fair Credit Reporting Act in 2018, describing the same product in different terms. Both are current law, and this guide sets them side by side rather than choosing between them.

The two definitions block different things

Texas draws the device narrowly. Under section 20.01(8) a security freeze is a notice on a consumer file that stops the agency from releasing a consumer report relating to the extension of credit involving that file, absent the consumer's express authorization. New credit is the target, and a pull for another purpose sits outside that definition. The federal definition at 15 U.S.C. 1681c-1(i)(1)(C) is cut wider, barring disclosure of a report's contents to any person requesting it, with no credit-related qualifier.

Requesting one, under each statute

The mechanics separate at the first step and never rejoin.

1. Texas adult freeze: a certified letter, and only that

   Section 20.034(a) operates on written request sent by certified mail that includes proper identification. Subchapter B offers no telephone or online route for placing an adult freeze, a pointed contrast with the security alert in section 20.031. Subchapter E, covered further down, is drafted differently.

2. Federal: a direct request, by mail, telephone, or secure electronic means

   15 U.S.C. 1681c-1(i)(2)(A) operates on a direct request from the consumer with proper identification, and its deadlines distinguish toll-free telephone and secure electronic requests from mailed ones. Subsection (i)(6)(A) requires a webpage taking freeze requests, and (i)(6)(A)(vi) forbids it from being the only mechanism. Subparagraph (i)(6)(B) directs the Federal Trade Commission to establish a single webpage linking each of those agency webpages, within its identitytheft.gov website or a successor.

3. Texas: five business days to place it, ten for the credential

   Section 20.034(a) sets placement no later than the fifth business day after the agency receives the request. Section 20.034(c) allows until the 10th business day for written confirmation and for a unique personal identification number or password, the credential used later to authorize a lift or a removal. Section 20.034(d) allows three business days for a replacement.

4. Federal: one business day electronic, three by mail

   Subparagraph (i)(2)(A)(i) puts a toll-free telephone or secure electronic request at 1 business day and (i)(2)(A)(ii) puts a mailed request at 3 business days. Confirmation follows within 5 business days under (i)(2)(B).

Once the freeze is on, section 20.035 requires written notice within 30 calendar days of a change to the name, date of birth, social security number, or address on the file.

The fee provisions, where the texts part company

The federal subsection uses the same three words four separate times, and it uses them of a consumer reporting agency described in 15 U.S.C. 1681a(p), which is how subparagraph (i)(1)(A) defines the term for this subsection. Section 1681c-1(i)(2)(A) says the agency "shall, free of charge, place the security freeze," and (i)(3)(C) says it "shall, free of charge, remove" one. The protected consumer provisions at (j)(2)(A) and (j)(4)(C) repeat the phrase, and a temporary lift runs through the same removal subparagraph by way of (i)(3)(E). Nothing there attaches an exception, a cap, a dollar figure, or any fee-eligible circumstance, and nothing conditions the price on a police report or on any showing of victimhood.

Texas reads the other way. Section 20.04(a) permits a consumer reporting agency to impose a reasonable charge for placing, temporarily lifting, or removing a freeze, then caps it. The Texas provision sets $10 per request as the ceiling for placement, for removal, and for a lift covering a designated period, and $12 per request for a lift granted to an identified requester. Those ceilings are indexed rather than fixed, since the subsection lets an agency raise them each January 1 in proportion to changes in the Consumer Price Index for All Urban Consumers, rounded to the nearest 50 cents. Section 20.04(b)(6) adds a conditional fee-free route, waiving the charge where the consumer has given the agency a valid police report, investigative report, or complaint alleging an offense under Penal Code section 32.51. That offense is a criminal provision, one that the Identity Theft Enforcement and Protection Act cross-references rather than contains.

So the two statutes say different things about the same request, and this guide does not decide which of them governs any particular consumer reporting agency.

What the texts do settle is narrower than a verdict. The federal subsection defines the agencies it binds: under (i)(1)(A) they are the agencies described in 15 U.S.C. 1681a(p), which reaches an agency maintaining both public record information and regularly furnished credit account information on consumers residing nationwide. That is the nationwide bureau definition, and the nationwide bureaus are the companies a person actually contacts to lock a credit file. As to them, the federal free-of-charge command speaks by its own terms. As to an agency outside 1681a(p) it says nothing whatever, and this guide does not stretch it there. Chapter 20 carries no comparable limit, so the two provisions reach overlapping but non-identical sets of companies.

Whether one displaces the other is a separate question, unanswered here. Section 1681t(b)(1)(J) does place subsections (i) and (j) of 1681c-1 on the list of subjects a state may not impose requirements about, without the grandfather clause several neighboring subparagraphs carry. Section 1681c-1 is listed a second time at 1681t(b)(5)(B), under a different lead-in reaching the conduct required by the specific provisions of the sections it lists. Neither entry names Texas, names chapter 20, or addresses a state fee provision, and neither marks the boundary of the phrase "subject matter regulated under" that governs the first list.

Lifting it again, and the one-hour rule

Texas drops its formality for the reverse direction. Section 20.037(a) accepts a request in writing or by telephone with proper identification including the personal identification number or password, and requires removal not later than the third business day. Section 20.037(b) applies the same deadline to a temporary lift and offers two shapes for it: lifted for a designated period, or lifted for one properly identified requester. Subsection (b) carries the same lead-in as (a), so both duties run on a request made in writing or by telephone. What section 20.037(c) leaves to the agency is the electronic side, since it permits but does not require procedures using a facsimile machine, the Internet, or another electronic medium to receive and process a request under that section.

Subparagraph (i)(3)(C)(i) carries the number that matters most in practice. A removal or temporary lift asked for by toll-free telephone or secure electronic means is due 1 hour after the agency receives it, against 3 business days for a mailed request. A federal freeze has no expiry built in and stays until the consumer directly asks for removal. Both statutes also reach a freeze placed because of the consumer's material misrepresentation of fact, in different registers. Section 20.037(d) says the agency shall remove such a freeze and shall notify the consumer in writing before doing so. Federal (i)(3)(A) allows removal in only two cases, one of them that misrepresentation at (i)(3)(A)(ii), and (i)(3)(B) requires written notice to the consumer first.

Children and other protected consumers

Subchapter E of chapter 20 and federal subsection (j) both build a freeze for someone with no credit history, and both order the agency to create a record where none exists. Past that they diverge. Section 20.21(1) defines a protected consumer as a Texas resident younger than 16 when the request is made, and section 20.25(a)(2) puts four things on the representative: submitting the request at the address or other point of contact of and in the manner the agency specifies, proving the identity of both the child and the representative, proving authority to act, and paying a fee as provided by section 20.29. Section 20.25(c) sets placement not later than the 30th day, far longer than the adult window, and section 20.28(b) sets the same 30 days for removal. Section 20.26 bars release of any report relating to the child, anything derived from it, and any record created for the child. Section 20.29(b) caps the Texas fee at $10 for each placement or removal, and section 20.29(c) forbids a fee for placement on either of two showings: a copy of a valid police report, investigative report, or complaint involving an offense under Penal Code section 32.51, or a child who is under 16 at the time of the request and for whom the agency has created a consumer report. Section 20.31 makes an attorney general suit the exclusive remedy for a subchapter E violation.

Two federal differences stand out. The protected consumer at (j)(1)(B) is an individual under 16 or an incapacitated or protected person with a guardian or conservator, so the category is not confined to children. And (j)(4)(D) provides a temporary lift for the period the protected consumer or representative specifies. Subchapter E provides no temporary lift at all.

Thirteen recipients a Texas freeze does not reach

Section 20.038 lists thirteen categories the freeze does not apply to, which is why it is not a general seal on the file: a state or local governmental entity, including a law enforcement agency or court or private collection agency, acting under a court order, warrant, subpoena, or administrative subpoena; a child support agency acting to investigate or collect child support payments or acting under Title IV-D of the Social Security Act; the Health and Human Services Commission under specified Government Code provisions; the comptroller pursuing delinquent sales or franchise taxes; a tax assessor-collector pursuing delinquent ad valorem taxes; a person prescreening under the federal Fair Credit Reporting Act; a person with whom the consumer already holds an account, contract, or negotiable instrument, plus that person's subsidiary, affiliate, agent, assignee, prospective assignee, or private collection agency, for purposes related to that account, contract, or instrument; anyone in that chain granted access on a temporary lift; a credit monitoring service the consumer subscribes to; a person handing the consumer a copy of their own report; a check service or fraud prevention company; a deposit account information service company; and a reseller keeping no permanent credit database.

The seventh entry surprises people, because a creditor the consumer already owes, and that creditor's collection agency, keeps its access while the freeze is on. Federal 1681c-1(i)(4) is its own list of ten lettered categories, two of which deserve naming: (i)(4)(H) exempts underwriting of insurance, and (i)(4)(I) exempts employment, tenant, or background screening.

One remedy the freeze duties do not carry

Section 20.12 makes a violation of chapter 20 a false, misleading, or deceptive act or practice under the Deceptive Trade Practices Act. Section 20.0385(c) takes the freeze back out. Notwithstanding section 20.12, a violation of a requirement to place, temporarily lift, or remove a security freeze is not a deceptive act or practice under that subchapter. For an adult freeze that leaves chapter 20's own machinery: civil liability under section 20.09, the dispute procedure in section 20.06, the court action or agreed arbitration in section 20.08, and enforcement by the attorney general under section 20.11. A subchapter E violation does not reach that machinery, because section 20.31 makes the attorney general suit the exclusive remedy notwithstanding subchapter D or any other law.

Reading both texts

The conflict is unresolved above because the statutes leave it unresolved, so checking each at the source is the thing worth doing. Chapter 20 is published section by section at statutes.capitol.texas.gov. The Government Publishing Office publishes section 1681c-1 at govinfo.gov, where the freeze rules sit in subsections (i) and (j) under the heading "National security freeze." That section is captioned for fraud alerts, so searching its title for the word freeze turns up nothing. The neighboring Texas consumer statutes are indexed across the Texas consumer law guides, one silo of Texas Legal Answers.