A bill pending in the House of Representatives would limit who can put a security freeze on credit files. If passed, this federal bill, the Financial Data Protection Act of 2006, would limit credit freezes to identity theft victims. Once you've been hit by ID theft you may request a credit freeze, not before.

A credit freeze gives consumers control over their personal financial information by allowing them to block new creditors from accessing their credit reports and scores without permission. Since most credit issuers require a credit check before granting credit, the credit freeze should block most unauthorized attempts to obtain new credit.

Currently, 21 states have passed legislation allowing any consumer to place a credit freeze on his or her credit files -- whether a victim of identity theft or not.

The idea of allowing anyone, anytime, to place a freeze on his or her credit sparks controversy between consumer advocates and financial industry proponents. Some see credit freezes as too extreme, while others see them as "the biggest tool in the toolbox."

The logic behind this bill, says Ed Mierzwinski, U.S. Public Interest Research Group, or PIRG, consumer program director, is "like saying you can't get a seat belt until you've been in an accident."

J. Craig Shearman, vice president of government affairs for the National Retail Federation, doesn't think a security freeze is necessary for most consumers.

"Our concern is that the credit freeze issue has become overkill, because most consumers are never going to be the victims of ID theft. If millions of consumers place a credit freeze on their files, it can cause difficulties when trying to purchase homes, cars or even opening simple lines of credit at a department store," he says.

If not a credit freeze, then what?

While a credit freeze offers good protection, it means a consumer may not be able to access his or her own credit during that time period, says Steven Katz, spokesman for TransUnion's Truecredit.com. Fraud alerts allow you to go about your credit activities without paying or waiting to lift a freeze. An alert, unless removed or renewed by the consumer, falls off after 90 days. A credit freeze stays put until the consumer pays to remove it.

Consumer advocates warn that fraud alerts don't live up to their labels. Calling fraud alerts a "fig leaf of protection," Mierzwinski says that they merely place a flag on credit reports. They don't stop credit from being issued.

The need to protect customers should not be underestimated, especially since most consumers don't have the option of giving their consent about where their personal information is being sent.

"Credit bureaus and data brokers buy and sell your name, address, Social Security number and credit file to anyone who will pay for it," says Evan Hendricks, editor of Privacy Times.

Chris Hoofnagle, the west coast director of the Electronic Privacy Information Center, says consumer reporting agencies' interests are not in tune with consumers' interests. "The credit bureaus are creatures that serve the creditors and don't want any slowdown of instant credit."