CFPB Fines TransUnion Over Credit Freeze Failures

Case: In the Matter of TransUnion; Trans Union LLC; and TransUnion Interactive, Inc.
Source: Consumer Financial Protection Bureau
Citation: File No. 2023-CFPB-0011
Decided: October 12, 2023
Bottom line: A credit freeze must be placed or lifted within the legal deadlines; if a freeze request is ignored, keep proof and dispute any account opened in the meantime.

Background

A security freeze blocks most new creditors from seeing your credit report, which makes it much harder for an identity thief to open accounts in your name. Since a 2018 amendment to the FCRA (the Economic Growth, Regulatory Relief, and Consumer Protection Act), freezes at the nationwide bureaus have been free, and bureaus must act quickly. A freeze requested by phone or secure electronic means must be placed within one business day and lifted within one hour of a request; mail requests must be handled within three business days. 15 U.S.C. § 1681c-1(i). These deadlines took effect September 21, 2018. A “lock” is a similar product that bureaus offer under their own terms. Bureaus must also keep consumers with active-duty military alerts or extended fraud alerts off the lists used for prescreened credit offers.

What the order requires

On October 12, 2023, the CFPB issued a consent order against TransUnion and two subsidiaries, Trans Union LLC and TransUnion Interactive, Inc. The CFPB found:

Freezes and locks not honored. “Since at least 2003,” the order states, the companies “failed to place or remove Security Freezes and Locks on the credit reports of tens of thousands of consumers in a timely manner. These consumers did not know about this failure, and some were told that their requests had been honored when they had not.” The cause was an “Out of Sync” problem in which two TransUnion databases showed different freeze status for the same person. Instead of fixing the root cause, the companies tried manual fixes that did not keep up, especially after the 2017 Equifax data breach drove a surge in requests.
A growing backlog. The backlog of out-of-sync freeze requests reached 29,992 by December 2019. The CFPB found the companies took no significant steps until they learned in February 2020 that the Bureau would examine their compliance. On July 15, 2020, they placed 19,675 freezes and removed 19,068 in a one-time fix; most of those requests had been pending for months or years.
Mail requests delayed. A mail-handling vendor was allowed to take five business days rather than the three required by law.
Marketing lists. Between September 2018 and February 2020, the companies failed to keep excluding certain consumers with extended fraud alerts or active-duty alerts from prescreened solicitation lists.

The CFPB found violations of the FCRA’s freeze and alert provisions and of the Consumer Financial Protection Act’s bans on unfair and deceptive practices. The order required $3 million in consumer redress, a $5 million civil penalty, and changes to prevent future violations. It was issued with TransUnion’s consent.

Later development. On November 3, 2025, the CFPB filed an order terminating the consent order early. It stated that TransUnion had paid the penalty, made the required redress payments, and taken steps to implement the conduct provisions, and it waived “any alleged noncompliance.” The findings remain on the public record, but the order’s ongoing requirements no longer apply. The FCRA’s freeze deadlines are statutory and still apply.

Our take

People freeze their credit because they are worried about fraud, often after a data breach. A bureau that tells consumers a freeze is in place when it is not leaves them exposed while believing they are protected. On the CFPB’s findings, that happened for years at TransUnion, and the companies knew about the database problem.

TransUnion fixed the backlog in 2020 and paid what the order required, and the CFPB’s current leadership chose to end the order early. Reasonable people can disagree about ending supervision early. Either way, early termination does not change the statute: consumers can still hold a bureau responsible in court for freeze failures that violate the FCRA.

What it means if your report is wrong

When you place or lift a freeze, save the confirmation and check that it took effect, for example by confirming the freeze status in your account with each bureau. If an account was opened in your name after you froze your credit, report the identity theft at IdentityTheft.gov, dispute the account with each bureau, and keep your freeze confirmation as evidence. A bureau that missed a freeze deadline may have contributed to the fraud.

A free case review can assess how this order affects a claim, and there is no fee unless we win.

Sources

Primary

Commentary we reviewed

Commentary: CFPB and FTC announce settlements with TransUnion (Consumer Finance Monitor, Ballard Spahr)

Updated November 1, 2026. "Our take" is the firm's opinion. This page is general information, not legal advice, and later decisions may change the law.