What Should You Do If You Receive a Credit Inquiry While All Three Reports Are Supposed to Be Frozen?

If you received a credit inquiry even though your credit reports are frozen at Experian, Equifax, and TransUnion, take a breath and act methodically. A true security freeze should prevent new-credit hard inquiries used to open accounts, but it does not block every type of pull. This guide explains how to confirm what happened, differentiate soft from hard inquiries, fix any errors, and strengthen your protections to prevent identity misuse.

First, Determine What Type of Inquiry It Is

Not all inquiries are the same—and a freeze does not block them all. Understanding the type tells you whether to treat it as routine or urgent.

• Soft inquiry: Does not affect your score and does not require your permission. Common sources: preapproved offers, account reviews by existing creditors, insurance quotes, employment screening (with consent), and identity checks by data analytics firms. A freeze typically does not block these.
• Hard inquiry: Can affect your score and is used for new credit applications (credit cards, loans, utilities, phones). A proper freeze should block these unless you temporarily lifted (thawed) your freeze or used a PIN/PASSCODE to allow access.

Action: Read the entry exactly as it appears on your credit monitoring dashboard or report. Look for the label “soft” or “hard,” the date, the name of the inquirer, and the bureau that recorded it.

Confirm That Your Freezes Are Active at All Three Bureaus

It’s possible for a freeze to lapse, fail to save, or be active at some bureaus but not others. Confirm status directly:

• Experian: Sign in or create an account and verify that “Security Freeze” is ON.
• Equifax: Sign in and check that the freeze shows as ACTIVE.
• TransUnion: Sign in and confirm the freeze status and any temporary lifts.

Also review your account settings for past temporary lifts or date-based thaws that might still be in effect. If you used a developer or lender portal that requested a one-time thaw, make sure it didn’t remain open longer than intended.

If It’s a Soft Inquiry: Likely Normal

Soft pulls are usually routine and allowed under a freeze. Use this checklist:

• Existing relationships: Your bank, credit card issuer, or auto lender can review your credit periodically.
• Pre-screened offers: Lenders use soft pulls to make you preapproved credit offers. You can opt out of these marketing pulls at OptOutPrescreen.
• Insurance rate checks: Some insurers use soft inquiries for quotes.
• Employment background checks: These require your signed consent and are soft in many cases.

What to do: Document the inquiry in a personal log with the date and bureau. If the name is unfamiliar, search it—many lenders appear under parent-company or service-bureau names. Contact the company’s fraud or compliance team only if it truly looks out of context or you never consented (e.g., an employer screen you did not authorize).

If It’s a Hard Inquiry: Treat as Potential Fraud

A hard inquiry under an active freeze is a red flag. Move quickly:

1. Capture evidence: Take screenshots of the inquiry, your active-freeze status at the bureau, and any alerts you received.
2. Call the inquirer’s fraud department: Use a phone number from the company’s official website—not the credit report entry alone. Say you did not authorize an application and your credit file was frozen on the inquiry date. Request:
   • The application details (date, channel, device/IP if available, address, phone, email used).
   • A copy of the application or a written confirmation it will be closed/voided for suspected fraud.
   • Removal of the hard inquiry as unauthorized.
3. File disputes with the bureaus where the inquiry appears. Clearly state:
   • Your credit report was under an active security freeze on the date.
   • You did not authorize the application or inquiry.
   • Request deletion of the hard inquiry as it was not permissible under a freeze.

   Include copies of your ID, proof of address, screenshots of the active freeze, and any communication from the inquirer acknowledging fraud.

4. Place or upgrade fraud alerts: Add a 1-year fraud alert at one bureau (they’ll share with the others) or, if you have proof of identity theft such as a police report or FTC IdentityTheft.gov report, place a 7-year extended fraud alert.
5. Consider filing an identity theft report: Use IdentityTheft.gov to create a recovery plan and generate an affidavit. This strengthens your disputes and compels furnishers to block fraudulent information.

Common Reasons a Hard Inquiry May Slip Through

Most freezes work as intended. When they don’t, it’s usually due to one of these scenarios:

• Temporary lift still active: You thawed your report for a lender, but the window remained open, or the dates were broader than you realized.
• Freeze only on some bureaus: The applicant (legitimate or fraudster) pulled the bureau that wasn’t frozen.
• Mixed or split file: Your data is mis-merged with another consumer’s file. This can allow activity that doesn’t belong to you to appear.
• Third-party/affiliate under a different name: An auto dealer or cellular retailer used a finance company name you don’t recognize.
• Credit lock instead of freeze: A “credit lock” is a commercial feature and not the same legal protection as a freeze. Some locks don’t behave identically to a statutory freeze.
• Legacy or specialty bureaus: Some lenders check specialty or secondary bureaus not covered by your three main freezes.

How to Dispute an Unauthorized Hard Inquiry

Each bureau provides online, mail, and phone dispute options. Mail can be most thorough. When disputing, be precise and supply evidence.

• Your letter should include:
  • Full name, current and previous addresses, date of birth, last four of SSN.
  • Statement that your report was frozen on the date of the inquiry.
  • The specific inquiry to remove (company name, date, bureau file number).
  • Copies of government ID, proof of address, and screenshots of the active freeze.
  • FTC Identity Theft Report number or police report (if available).
• Ask for:
  • Deletion of the unauthorized hard inquiry.
  • Written confirmation of the results and the legal basis for any refusal.

Keep copies of everything and send mail disputes via certified mail with return receipt. Bureaus typically have 30 days to investigate and respond.

Lock Down the Rest of Your Identity Data

Even a single problematic inquiry suggests your information may be circulating. Strengthen your defenses beyond freezes:

• Review all three full credit reports: Look for unfamiliar addresses, phone numbers, employers, and accounts. Dispute anything you didn’t authorize.
• Add account-level security: Set high-friction verifications at your banks, card issuers, mobile carrier, and utilities (account notes, extra passphrases, SIM-swap PINs).
• Secure your credentials: Turn on a password manager, enable unique passwords everywhere, and add phishing-resistant MFA where possible. Change any reused passwords immediately.
• Freeze specialty bureaus: Consider freezes or security processes at ChexSystems (banking), Innovis, SageStream, NCTUE (telecom/utilities), LexisNexis, and CoreLogic if you’re facing persistent fraud in those categories.
• Opt out of data brokers: Remove your information from people-search and marketing databases that fuel impersonation and pretexting. Less exposed data means fewer vectors for social engineering.
• Monitor high-risk channels: Keep an eye on new inquiries, new accounts, public records changes, and dark web breach alerts. Quick detection limits damage.

Freeze vs. Lock: Know the Difference

Some apps offer a “credit lock,” which is convenient but not the same as a legal freeze. Key points:

• Security freeze (state/federal right): Free, created by law. Lenders must respect it. You manage it separately at each bureau with PINs/passcodes and can lift it temporarily.
• Credit lock (commercial feature): Contract-based and may have different rules or coverage. It may not be recognized by all lenders in the same way as a freeze.

If you relied on a lock, consider placing a statutory freeze at all three bureaus for maximum protection.

When to Involve Law Enforcement

If a fraudster attempted to open credit in your name or you see multiple suspicious inquiries, file reports to establish a paper trail:

• FTC IdentityTheft.gov: Generates an Identity Theft Report and customized recovery plan.
• Local police report: Helps with creditors who request a case number before removing fraudulent activity.

Provide these documents to lenders and bureaus to expedite deletions and blocks.

Communicating With the Creditor That Pulled Your File

Be concise and factual when speaking with the creditor or their fraud unit:

• State your report was frozen on the inquiry date and you did not authorize an application.
• Request closure of any pending application and removal of the inquiry.
• Ask for written confirmation and the application details used (address, phone, email) so you can secure those channels.
• Follow up in writing and keep a log of names, dates, and call summaries.

Prevent Repeat Attempts

Fraud attempts often cluster. Reduce repeat risk with layered controls:

• Do not lift freezes broadly: When you need to apply for credit, thaw only the required bureau, limit by date, and re-engage it immediately after approval.
• Create alerts at your financial institutions: Turn on transaction and login alerts. Add verbal passcodes to call-center profiles.
• Watch your mail: Unexpected cards, denial letters, or PIN mailers may signal renewed attempts.
• Harden telecom accounts: Add a port-out lock and account PIN to prevent SIM swaps that can defeat 2FA.

How Long to Monitor After an Incident

Plan for at least 12 months of heightened vigilance. Many identity thieves test different lenders over time. Maintain freezes, monitor inquiries, and keep records in one folder or password manager secure note.

Frequently Asked Questions

Will a soft inquiry hurt my credit score?

No. Soft inquiries are informational and do not impact your score.

Can a freeze block employment or insurance checks?

Often those checks are soft pulls and may proceed even with a freeze. If a prospective employer needs a hard pull (uncommon), you would need to temporarily lift the freeze.

I forgot my freeze PIN or passphrase. What now?

Each bureau provides an account recovery process with identity verification. Complete recovery and re-check that all freezes are active.

What if the bureau refuses to remove an unauthorized hard inquiry?

Ask for the written basis of their decision, escalate with additional evidence (FTC report, police report), and file a complaint with the CFPB if needed. Also continue working with the creditor that initiated the pull to have it retracted.

Optional Next Step: Credit and Identity Monitoring

After you resolve the inquiry, consider ongoing monitoring that centralizes alerts for new inquiries, score changes, and identity-related activity. Monitoring does not replace freezes, but it can help you catch misuse early so you can act faster. If you want to evaluate a consolidated tool, you can review our overview here: SmartCredit for privacy, credit monitoring, and identity protection.

Conclusion

A legitimate security freeze should stop new-credit hard inquiries. If you see one anyway, verify the inquiry type, confirm all three freezes are active, contact the inquirer’s fraud team, and dispute with the bureaus using clear documentation. If the inquiry is soft, it’s usually routine and not a sign of account-opening fraud. Either way, use the moment to harden your defenses: maintain freezes, strengthen account security, reduce data broker exposure, and monitor for new activity. Quick, organized action is the best way to prevent one suspicious inquiry from turning into real damage.