What Should You Do If a Credit Bureau Says Your Freeze Is Active but a Lender Still Accesses Your Report?

If a credit bureau confirms your security freeze is active but a lender still accessed your credit report, you’re right to be concerned. A proper freeze should block new-credit hard inquiries. Sometimes the access was allowed under a permitted exception, sometimes the lender used a different bureau or an old report, and sometimes it was an error that needs correction. This step-by-step guide explains what to do immediately, how to find out what happened, and how to prevent it in the future—while keeping your personal information and financial identity safer.

First, Confirm What Actually Happened

Before taking action, verify whether the pull was truly a new-credit hard inquiry or a permissible soft inquiry. A freeze blocks most new-credit hard inquiries but not all kinds of access. Here’s how to confirm:

• Check all three bureaus: Review your credit reports from Equifax, Experian, and TransUnion. Make sure your freeze is showing as active at each bureau. Also note the inquiry type (hard vs. soft), date, and the company name.
• Identify the exact inquiry: On each report, locate the lender’s name and whether it’s listed under “hard inquiries” or “soft inquiries.” A soft inquiry does not affect your scores and can occur even with a freeze in place.
• Check all accounts: Make sure no new account was opened without your knowledge. If you see an unfamiliar account, treat it as suspected identity theft.

Understand What a Freeze Does—and Doesn’t—Block

A security freeze restricts new-credit pulls that require full authentication, but it doesn’t stop every kind of access:

• Hard inquiries for new credit: Should be blocked unless you temporarily lift (thaw) your freeze or use a lender-specific PIN/one-time lift.
• Existing creditors: Companies you already do business with can continue to review your account for account management or collection purposes.
• Debt collectors and servicers: May obtain limited access related to collecting a debt.
• Prescreened offers (firm offers of credit): Can still occur unless you opt out at OptOutPrescreen.
• Identity verification or employment screenings: Some verification checks may still occur, depending on the data source and purpose.
• Soft inquiries: Do not affect your credit scores and can appear even with a freeze.

If the lender’s access appears under hard inquiries for a new application you didn’t make, that’s a red flag. If it appears as a soft inquiry or under a permitted purpose (existing account review), it may be allowed under law and not a freeze failure.

Immediate Steps if You See an Unauthorized Hard Inquiry

If it’s a hard inquiry for a new credit application you did not authorize—even though your freeze is active—take these steps quickly:

1. Contact the lender’s fraud department
   • Ask for the application details (date, channel, location, the SSN used, and any contact info on the application).
   • State that your credit file was frozen at the time and you did not authorize the application.
   • Request that they cancel the application, mark it as fraud, and send written confirmation.
2. File disputes with the credit bureau(s)
   • Dispute the hard inquiry as unauthorized with each bureau where it appears.
   • Provide evidence: note your freeze status and date/time, lender correspondence, and any identity theft report if available.
   • Request removal of the unauthorized inquiry and a statement added to your file if necessary.
3. Consider filing an FTC Identity Theft Report
   • If you suspect identity theft, create a report and recovery plan at the FTC and use the report to support your disputes.
4. Place or confirm a fraud alert
   • If you already have a freeze, you can still add a fraud alert to signal lenders to take extra verification steps. An extended fraud alert (with an identity theft report) lasts longer and gives you more protections.
5. Document everything
   • Keep copies of your freeze confirmations, disputes, letters, call logs (dates, names, and reference numbers), and any notices from lenders or bureaus.

When the Access May Be Allowed Even With a Freeze

Not every access is a breach of your freeze. These are common scenarios where a pull might still appear:

• Existing creditor account review: Your credit card issuer or lender may perform periodic reviews to manage your account or adjust terms.
• Debt collection: Collectors may obtain certain information related to an existing debt.
• Soft inquiries: Pre-qualification checks, account monitoring, and some identity checks show up as soft inquiries and don’t require a thaw.
• Prescreened offers: Unless you opt out, your file may be used to generate credit or insurance offers without a hard inquiry.

If the inquiry falls into a permitted category, it likely doesn’t mean your freeze failed. Still, verify it’s tied to an account you recognize and consider tightening your preferences (for example, opting out of prescreened offers).

Could the Lender Have Used Another Bureau or an Old Report?

It’s possible a lender accessed a different bureau that wasn’t frozen, or relied on a previously obtained report within a short time window. Check:

• All three bureaus are frozen: Log in or call Equifax, Experian, and TransUnion to confirm each freeze is active. A freeze at one bureau doesn’t automatically freeze the others.
• Timing: Some lenders reuse a recent report if you applied earlier and the report remains valid in their underwriting window.
• Identity-only data sources: Some services verify identity using non-credit databases that aren’t blocked by a freeze.

How to Dispute an Unauthorized Inquiry Effectively

For a suspected freeze failure leading to an unauthorized hard inquiry, make your dispute clear, documented, and traceable:

• Dispute with the bureau online or by mail: Provide your identifying information, the specific inquiry to be removed, the date it posted, and that your security freeze was active at the time.
• Attach evidence: Screenshots or letters proving your freeze status, lender’s written confirmation (if obtained), and any FTC Identity Theft Report.
• Request correction and suppression: Ask for removal of the unauthorized inquiry and any accounts linked to it.
• Ask for an investigation summary: Request the bureau’s written findings and the basis if they decline to remove the inquiry.

Monitor your credit reports for resolution updates. If the bureau does not correct clear errors, you may consider escalating a complaint to your state attorney general or the Consumer Financial Protection Bureau.

Strengthen Your Protections Going Forward

Once you’ve dealt with the immediate issue, reinforce your defenses:

• Verify and maintain freezes at all three bureaus: Equifax, Experian, and TransUnion. Keep your PINs or passwords secure.
• Use temporary, lender-specific thaws: When you do apply for credit, lift the freeze only for the specific bureau and limited time window your lender uses.
• Enable a fraud alert: Especially if you’ve experienced suspicious activity, a fraud alert encourages lenders to verify identity more carefully.
• Opt out of prescreened offers: Reduces soft inquiries and exposure to unsolicited offers.
• Monitor for new-account attempts: Watch for unfamiliar mail, emails, or texts about applications or verification codes you didn’t request.
• Review your reports regularly: Check all three bureaus for new inquiries and accounts you don’t recognize.

If a Lender Says They Had Permission—But You Didn’t Apply

Push for documentation. Ask the lender to provide the application record and how they authenticated the applicant. If they cite online or in-store verification, request the device, IP, location, or store identifier used. Explain that your security freeze was active and you did not authorize the application. Ask that they code it as fraud, close any resulting account, and remove related inquiries. Use the lender’s written confirmation as evidence in your bureau dispute.

Protect Your Personal Information Beyond the Credit File

A freeze is powerful, but your personal information still circulates widely. Reducing exposure lowers the chance of successful impersonation:

• Harden your primary email and phone: Enable strong, unique passwords and multi-factor authentication on your email, mobile account, and financial logins.
• Limit data-sharing: Review privacy settings on major accounts, remove public listings where possible, and be careful with online forms that request SSN or date of birth.
• Watch for data breaches: If companies you use announce a breach involving your data, take recommended steps quickly—change passwords, enable MFA, and watch your reports closely.
• Remove exposure on people-search sites: Minimizing publicly available addresses, phone numbers, and birthdates can reduce targeted attempts and social engineering.

Frequently Asked Questions

Does a freeze block all inquiries?

No. A freeze blocks most new-credit hard inquiries, but soft inquiries, existing-account reviews, collections activity, and prescreened offers can still occur.

What if the inquiry is soft—should I worry?

Soft inquiries don’t affect your credit score and may be permitted. Confirm the source is legitimate and tied to an existing relationship or a standard prescreen. If not, contact the bureau to ask about the permissible purpose.

Can a lender bypass my freeze?

They shouldn’t be able to open new credit using your frozen file without your thaw. If a hard inquiry appeared despite an active freeze, dispute it and contact the lender’s fraud team.

I froze only one bureau. Is that enough?

No. Many lenders pull from different bureaus. Freeze Equifax, Experian, and TransUnion to maximize protection.

What if the bureau refuses to remove the inquiry?

Ask for the investigation results in writing, provide additional documentation, and escalate if needed. Consider filing complaints with regulators if clear evidence supports your claim.

A Practical Monitoring Layer

While a freeze prevents most new-credit openings, ongoing monitoring helps you spot changes quickly—such as new inquiries, account openings, or address changes—so you can act fast if something slips through. If you want a simple way to keep an eye on your credit and identity-related activity after you’ve resolved this issue, consider evaluating a tool that consolidates alerts and monitoring across your financial identity. As an optional next step, you can review our overview of SmartCredit’s privacy, credit, and identity monitoring capabilities here: SmartCredit for Privacy, Credit Monitoring, and Identity Protection.

Checklist: If Your Freeze Is Active but a Lender Accessed Your Report

• Verify inquiry type (hard vs. soft) at all three bureaus and confirm all freezes are active.
• If it’s an unauthorized hard inquiry, contact the lender’s fraud department and request cancellation and written confirmation.
• Dispute the inquiry with each bureau, attach proof of your active freeze, and request removal.
• File an identity theft report if you suspect fraud and add a fraud alert to your file.
• Opt out of prescreened offers and tighten account security (email, phone, financial logins, MFA).
• Monitor reports and mail for any additional unauthorized activity.

Conclusion

A properly placed freeze should stop new-credit hard pulls. If a lender accessed your report anyway, verify the inquiry type, determine whether it was permitted, and move quickly if it wasn’t—contact the lender’s fraud team, dispute the inquiry with the bureaus, and enhance your protective layers. Pairing a comprehensive freeze strategy with ongoing monitoring and careful data exposure habits gives you the best chance to prevent unauthorized credit activity and protect your identity over time.