To stay safe, freeze your credit reports

So far this year, 100-plus data breaches have resulted in an estimated 153 million financial records being stolen from such big names as Experian, T-Mobile and Anthem, as well as U.S. government personnel records.

Most of the victims were offered free credit-monitoring services as a check against identity theft.

But a new report by Washington-based consumer group U.S. PIRG says credit monitoring isn't nearly enough. The group urges all consumers to consider freezing their credit reports as the only way to stop ID thieves from taking out loans, credit cards, and other credit accounts in victims' names.

"Whether your personal information has been stolen or not, your best protection against someone opening new credit accounts in your name is the security freeze," said Mike Litt, consumer program advocate at U.S. PIRG. "Credit-monitoring services may tell you [about a fraudulent account], but only after you've been victimized."

When a freeze is in place, credit bureaus are prevented from releasing a file to potential creditors without the consumer's permission. Because most businesses won't open credit accounts without checking a consumer's credit history, ID thieves are locked out.

There are drawbacks to consider, including fees, which vary by state; some limitations; and the potential for delays when consumers legitimately want to apply for credit. People must lift freezes if they want to apply for mortgages, car loans, credit cards, or other type of credit.

A thaw can be activated online or by phone using a personal identification number and choosing the number of days that the thaw applies. It can be a general thaw or apply only to a specific creditor.

There is no fee to permanently lift a freeze, which automatically expires in seven years.

Victims of ID theft who provide a police report can freeze and thaw their files at no charge, while people 65 and older can initiate a freeze for free but must pay $10 for a thaw.

For the broadest protection, experts recommend that consumers freeze their credit reports with all three main credit bureaus - Equifax, Experian and TransUnion - because a freeze request with one doesn't extend to the others. Experian said it froze 433,558 files through October, up from 160,639 in all of 2014.

A consumer applying for credit who wants to temporarily lift a freeze should find out which credit bureau the lender is using to assess creditworthiness and request a thaw from that particular bureau.

In most cases, a report can be thawed within 15 minutes. But because the law allows credit bureaus up to three days to lift a freeze, shoppers could be blocked from getting instant store credit - the kind that promises a discount of 10 percent or more for signing up for a credit card at the register.

Freezes also could interfere with other products and services that may require a credit check, such as getting insurance, renting an apartment, hooking up to a utility, or opening a cellphone account.

The U.S. PIRG report (available at http://goo.gl/W1g5m4) noted that neither credit monitoring nor a security freeze can detect or prevent unauthorized use of existing credit accounts or other types of fraud or identity theft such as theft of tax refunds or medical services. Many banks and credit-card companies have mechanisms in place to detect existing-account fraud and remove unauthorized purchases.

The report contended that paid credit-monitoring services, which typically cost about $10 to $20 a month, are not worth the expense because consumers can monitor their own reports free. Federal law requires each of the main credit bureaus to provide consumers with free credit reports once a year.

Litt acknowledged that a credit-monitoring service might detect theft faster than consumers could on their own, depending on when consumers happen to check their reports.

For victims of data breaches, an alternative to a credit freeze is to place fraud alerts on credit reports. The alerts are free but must be renewed every 90 days. Victims of identity theft can sign up for extended fraud alerts that last seven years.