What Still Reaches Your File Under a Freeze: Parsing ‘Permissible Purpose’ Notices

A security freeze is one of the most effective steps you can take to prevent criminals from opening new credit in your name. But a freeze does not hide your file from everyone. If you have ever received a notice saying an organization accessed your credit report for a “permissible purpose,” you may wonder who can still see what—and why. This guide explains what still reaches your file under a freeze, how permissible purpose works under the Fair Credit Reporting Act (FCRA), what shows up as “soft” versus “hard,” and how to read and respond to those notices with confidence.

What a Security Freeze Actually Does—and Doesn’t Do

A security freeze restricts credit bureaus from releasing your credit file for new-credit decisions unless you lift or thaw the freeze with your PIN or password. That means unauthorized lenders cannot easily open credit cards, loans, or lines of credit in your name without your active participation.

However, a freeze does not delete your file, stop all reporting, or prevent every type of access. The FCRA allows credit bureaus to share information with certain parties who have a legally recognized reason—called a “permissible purpose”—to access your data. Under a freeze, these accesses are typically limited to maintenance of existing relationships, certain risk and fraud controls, collections, court orders, employment screening with your written consent, insurance underwriting (varies by state and bureau), and similar exceptions.

Understanding “Permissible Purpose” Under the FCRA

Permissible purpose is the FCRA’s way of defining who can lawfully access your consumer report and for what reasons. Some common permissible purposes include:

• New credit decisions (requires a thaw/unfreeze and results in a hard inquiry)
• Account review for an existing credit account (soft inquiry)
• Collection of a debt (soft inquiry)
• Insurance underwriting (often soft, but check bureau and state rules)
• Employment screening with your written consent (separate employment report; not a traditional credit score pull, and typically soft)
• Tenant screening with your consent (often a separate consumer report; can be impacted by freeze depending on the screening company and bureau used)
• Court orders, subpoenas, or law enforcement requests (legal compulsion)
• Preapproved marketing offers (prescreened lists; you can opt out separately)

When you receive a “permissible purpose” notice, it usually refers to one of these allowed categories. The notice does not necessarily mean your freeze failed—it usually reflects one of the exceptions that still operate while the freeze is in place.

Soft vs. Hard Inquiries Under a Freeze

The type of inquiry matters for your credit and privacy:

• Hard inquiries generally happen when you or someone posing as you applies for new credit. A hard inquiry should be blocked by a freeze unless you thaw it for a specific lender and timeframe. Hard pulls can affect your credit score slightly and are visible to other lenders.
• Soft inquiries occur when a company checks your file for account review, preapproved offers, identity checks, or certain other permissible purposes. Soft inquiries do not affect your credit score and are not visible to lenders who might check your file. A freeze usually does not block soft inquiries tied to permitted exceptions.

If you see a hard inquiry you didn’t authorize during an active freeze, that’s a red flag—take action immediately. If you see a soft inquiry from a company with whom you already have a relationship, it may simply be normal account maintenance.

Who Can Still Reach Your File While Frozen

Here are the common categories that may show up in permissible-purpose notices, even when your file is frozen:

• Your existing lenders and card issuers: Banks and issuers routinely perform account reviews, credit limit management, fraud checks, or risk modeling. These are usually soft pulls.
• Debt collectors or agencies acting for your creditor: If you owe a debt, collectors may access your file to locate you, assess collectability, or verify information. Typically soft.
• Insurance companies: Property, auto, and sometimes life insurers may use credit-based insurance scores (where permitted) during underwriting or renewal. This can be soft and is often allowed under a freeze.
• Employment background screeners: Only with your written consent and usually limited to a specialized employment report. This is separate from applying for a credit card; a freeze doesn’t necessarily block it.
• Tenant screening services: Landlords and screening firms may access consumer reports with your permission. Some pulls rely on credit bureau data; policies vary by service and bureau. You may need to temporarily lift a freeze for certain tenant checks if specifically required by the screener.
• Government or law enforcement: Subpoenas, court orders, or other legal processes can compel access even under a freeze.
• Prescreened marketing lists: Lenders assemble preapproved offer lists using limited data. A freeze might not stop this unless you opt out separately via OptOutPrescreen or the credit bureaus.
• Identity and fraud risk tools used by companies you already do business with: These checks help verify your identity, detect unusual activity, or satisfy compliance obligations, and they often remain allowed under a freeze.

Why You’re Seeing a “Permissible Purpose” Notice

Notices typically arrive by mail or appear in your credit monitoring alerts when a company taps your file under one of the FCRA’s allowable reasons. Reasons include:

• Routine account review by a card issuer or auto lender you already use
• Insurance renewal or rating if your state allows credit-based insurance scoring
• Employment or tenant screening you authorized as part of an application
• Collections activity related to an overdue account
• Fraud screening or identity verification for a product or service you maintain
• Legal process such as a subpoena or court order

Most of these are soft pulls and do not indicate new credit was opened.

How to Read the Notice and Verify Legitimacy

When you receive a permissible-purpose notice, work through a simple checklist:

1. Identify the company name: Match it to an existing relationship (credit card issuer, auto lender, insurer). If the name looks unfamiliar, search for known affiliates or servicing companies linked to your accounts.
2. Check the inquiry type: Verify whether it was soft or hard. Soft generally equals maintenance or compliance; hard equals new credit. A hard pull under a freeze should be rare and investigated immediately.
3. Confirm timing: Did you recently authorize a background check, tenant screening, insurance quote, or service upgrade that might trigger a pull?
4. Inspect your statements and portals: Sign in to your bank, lender, and insurer accounts to look for notices about account reviews or credit-based pricing updates.
5. Contact the company: If you can’t tie the inquiry to a known relationship, call the listed organization using a verified phone number (not the notice alone) to ask which permissible purpose they used and why.
6. Cross-check your credit reports: Pull your reports to see how the inquiry is labeled at each bureau and to ensure no new accounts were opened. You can obtain reports from the major bureaus or through a reputable monitoring service.

Common Situations—and What to Do

You see a soft inquiry from your credit card issuer

Likely an account review. No action needed unless something else looks off. Continue monitoring.

You see a hard inquiry you didn’t authorize

Act quickly: contact the lender’s fraud department, dispute the inquiry with the bureau, confirm your freeze is active at all major bureaus, and watch for new accounts or changes. Consider placing or renewing a fraud alert if you suspect identity theft and file an identity theft report if needed.

You applied for insurance and received multiple soft pulls

Insurers may shop your profile across affiliates or re-rate underwriters. Verify that each entity ties back to your quote or policy and that pulls are soft.

You’re job hunting and get a notice from a screening firm

Employment screeners access specialized consumer reports with your signed consent. Keep copies of any forms you signed and confirm the scope with the employer if unsure.

Collection agency you don’t recognize appears

Contact your current and past creditors to confirm account status. If this is an error or a sign of identity theft, dispute the access and investigate related accounts immediately.

The Difference Between a Freeze, Fraud Alert, and Lock

Security freeze: Most robust control for new-credit blocking. Requires thaw to approve new accounts. Does not stop permitted soft access like account reviews.

Fraud alert: Instructs lenders to take extra steps to verify identity before granting credit. Does not block pulls but adds a verification layer.

Credit lock: A bureau-provided, app-controlled feature similar to a freeze but governed by service terms. Locks are convenient but may have different rules. A legal freeze is free and backed by law.

What Information Can Still Be Shared

Under permissible purpose, bureaus may share portions of your consumer report relevant to the request. For account reviews and soft inquiries, that often includes tradeline status, balances, payment history, and risk markers. For prescreened offers, lists are limited and typically do not reveal full reports to marketers. Employment and tenant screening rely on purpose-built reports, often excluding credit scores unless allowed and consented. Legal demands can compel broader disclosure.

Importantly, a freeze does not erase your data trails elsewhere—banking data, public records, and identity attributes can still be used by organizations you already do business with for risk and compliance purposes.

How to Reduce Unwanted Access and Confusion

• Keep your freeze active at all major bureaus and thaw only for specific windows and lenders.
• Opt out of prescreened offers to reduce marketing-based soft pulls.
• Use strong identity verification on your bureau accounts and financial institutions: unique passwords, password managers, and multifactor authentication.
• Minimize data exposure by removing unnecessary personal information from people-search sites and marketing databases to reduce targeting and social engineering risk.
• Document authorizations (tenant or employment consent forms) so you can match future notices to approvals you actually gave.
• Monitor continuously so you can spot unexpected permissible-purpose notices early and respond quickly.

How to Respond If Something Looks Wrong

1. Verify with the source: Call the company that accessed your file using a verified number and ask for the reason code and type of pull.
2. Dispute inaccuracies: If the inquiry is improper, file disputes with the credit bureau(s) and request investigation and removal where appropriate.
3. Check for new accounts: Review your credit reports for any accounts or addresses you don’t recognize.
4. Tighten security: Change passwords, enable MFA, and consider placing or renewing a fraud alert.
5. Escalate if needed: If a bureau or data furnisher does not correct clear errors, consider filing complaints with the CFPB or your state attorney general.

Monitoring That Complements a Freeze

A freeze blocks most new-credit fraud, but it doesn’t alert you to every change. Monitoring helps you see soft and hard inquiries, new tradelines, and risky signals quickly so you can react. For many consumers, combining a freeze with ongoing credit and identity activity alerts offers practical coverage: the freeze stops unauthorized new accounts, while monitoring shows you who’s accessing your file and why.

If you want consolidated alerts, score tracking, and tools to review inquiry activity in one place, consider using a reputable credit and identity monitoring service that fits your needs. A good service can make it easier to interpret permissible-purpose notices, spot unexpected access, and verify that your freezes remain effective across bureaus. For a streamlined option that focuses on privacy, credit monitoring, and identity protection, see our overview of SmartCredit.

FAQ: Quick Answers About Freezes and Permissible Purpose

• Does a freeze stop all access to my credit report? No. It blocks new-credit approvals but allows certain soft pulls for existing accounts, insurance, collections, employment/tenant screening with consent, and legal orders.
• Is a hard inquiry possible under a freeze? It should not occur without your thaw/unfreeze. If it does, contact the lender and bureaus immediately.
• Do prescreened offers mean my report was shared? Your full report was not shared; your name may have been selected from a prescreen list. You can opt out to reduce this.
• Can my employer check my credit without consent? No. Employment screening requires your written authorization and uses a specialized consumer report.
• Will a soft inquiry affect my credit score? No. Soft inquiries don’t impact your score and are not visible to other lenders.

Practical Workflow for Handling Notices

1. Log the notice: Record date, company, and bureau.
2. Classify: Soft vs. hard; map to a known purpose (review, insurance, screening, collections, legal).
3. Reconcile: Match to recent actions (applications, renewals, authorizations).
4. Verify: If mismatched, contact the company and ask for their stated permissible purpose and your associated account number.
5. Escalate: Dispute improper hard pulls and monitor for new accounts.
6. Harden: Reconfirm freezes at all bureaus and tighten authentication on your financial accounts.

Conclusion

A security freeze is a powerful shield against new-account fraud, but it doesn’t make your credit file invisible. Under the FCRA, organizations can still access your information for specific “permissible purposes,” most commonly as soft inquiries tied to existing relationships, insurance, screening with consent, collections, or legal processes. When you receive a permissible-purpose notice, use the steps in this guide to verify who accessed your file, determine whether the pull was appropriate, and take action if anything looks wrong. Pairing a well-managed freeze with ongoing monitoring and careful control of your personal information gives you a clear, practical path to protect your identity without guesswork.