Massachusetts’s comprehensive identity theft law requires businesses and others that own or license personal information of residents of Massachusetts to notify the Office of Consumer Affairs and Business Regulation and the Office of Attorney General when they know or have reason to know of a breach of security. The law also requires that the breached entity notify consumers of any breach of their personal information that creates a substantial risk of identity theft or fraud as soon as practicable and without unreasonable delay after a breach occurs, except when a law enforcement agency determines that notice may impede a criminal investigation.

The notification to consumers must include:

  • the date or approximate date of the breach;
  • steps that have been taken or are planned to deal with the breach;
  • consumers' right to obtain a police report; and
  • instructions for requesting a credit report security freeze.

The law allows Massachusetts consumers to place a security freeze on their credit reports. A security freeze prohibits a credit reporting agency from releasing any information from a consumers' credit report without written authorization. Note: placing a security freeze on your credit report may delay, interfere with, or prevent the timely approval of any requests you make for new loans, credit, mortgages, employment, housing or other services.

If you have been a victim of identity theft, and you provide the credit reporting agency with a valid police report, it cannot charge you to place, lift or remove a security freeze. In all other cases, a credit reporting agency may charge up to $5 each to place, lift or remove a security freeze.

To place a security freeze, you must send a written request by mail to all three credit reporting agencies.

The letter must contain the following information:

  • Your full name, address, Social Security number, and date of birth;
  • Addresses where you lived over the previous five years;
  • Proof of current address such as a utility or phone bill;
  • A photocopy of a government issued identification card;
  • If you are an identity theft victim, include a copy of the police report, investigative report, or complaint;
  • If you are not a victim of identity theft, include a payment by check, money order, or credit card.

How long does it take for a security freeze to be in effect?

After three business days from receiving your letter, the credit reporting agencies will place a freeze providing credit reports to potential creditors.

After five business days from receiving your letter to place a freeze on your account, the credit reporting agencies will send you a confirmation letter containing a unique PIN or password that can be used to authorize the removal or lifting of a security freeze.

Who can see my credit file if it is frozen?

When you have a security freeze on your credit file, certain entities still have access to it. Your report can still be released to your existing creditors or to collection agencies acting on their behalf, as well as new creditors who may make offers of credit. Government agencies may also access your credit file in response to court or administrative orders, a subpoena, or a search warrant.

To lift the security freeze: to allow a specific entity or individual access to your credit report:

  • Call or send a written request to the credit bureaus by mail (see telephone numbers and addresses below), include proper identification (name, address, social security number) and the PIN number or password provided to you when you placed the security freeze as well as the identity of those entities or individuals you would like to receive your credit report or the specific period of time you want the credit report available.
  • The credit bureaus have 3 business days after receiving your request to lift the security freeze for those identified or individuals

To remove the security freeze:

  • Send a written request to the credit bureaus by mail (see addresses below), include proper identification (name, address, social security number) and the PIN number or password provided to you when you placed the security freeze. NOTE: Experian is the only credit bureau that allows a telephone request to remove a security freeze at 1-888-397-3742 but requires certified or overnight mail for all removal requests by mail.
  • The credit bureaus have 3 business days after receiving your request to remove the security freeze

For more information on placing or lifting a security freeze, review the following links to the three credit bureaus for their specific requirements:

Equifax Security Freeze
P.O. Box 105788
Atlanta, GA 30348


Experian Security Freeze
P.O. Box 9554
Allen, TX 75013


TransUnion Security Freeze
P.O. Box 6790
Fullerton, CA 92834