States consider "security freeze" laws.

State legislators around the country, are considering a "security freeze" on credit reports for consumers whose personal information has been exposed through security breaches. A freeze would lock down a consumer's credit report, preventing anyone--including the consumer--from instantly opening new credit cards or taking out loans.

Until recently, only Californians had the right to implement such a freeze, but the idea has spread quickly in recent months. (Texas allows only victims of identity theft to freeze their credit accounts.) About 20 states now have pending legislation that would force credit bureaus to give consumers the right to freeze their accounts.

Advocates say a credit freeze would be a valuable identity theft prevention tool for consumers. With a freeze in place, credit files cannot be accessed, and instant credit--such as retail credit cards or on-the-spot car loans--cannot be granted. Only after a consumer provides additional evidence of their identity--which can take up to three days--can credit be granted. Freezes also prevent identity thieves from making quick credit purchases and opening new accounts.

The retail industry and credit bureaus, however, contend that freezes would mean more hassles for consumers. They say freezes would eliminate any point-of-sale-type of credit transaction, and consumers who implement freezes will find it hard to apply for new credit.

Everyone agrees that the system for using a security" freeze is complicated. In the current system, files are unlocked by PIN numbers that consumers must remember and provide to credit bureaus before they apply for credit. But some consumers easily forget these rarely-used PINS, or they fail to realize that they need to unlock their files at all three credit bureaus before applying for a home mortgage, experts say.

Today, anyone concerned about identity theft can have a fraud alert placed on their files with the credit bureaus at no charge. With such an alert in place, retailers who pull a credit report are given a warning to take additional steps to verify the identity of the consumer.

This system, however, relies on the retailers to verify the consumer's identity, and privacy advocates criticize it as ineffective. Unlike freezes, retailers are still able to access credit reports, just with fraud alerts attached.

Fraud experts say this system is ineffective because, despite the alerts, credit can be issued anyway. In addition, alerts generally expire after 90 days, meaning con artists simply have to wait a few months before making a move.

Despite lobbying efforts by the credit bureaus and retail industry, momentum for security freezes continues to build. According to the Public Internet Research Group, consumer advocates have active lobbying efforts in more than 12 states.