To combat the identity-theft epidemic, a number of states are enacting credit-freeze laws that allow consumers to block businesses from reviewing their credit reports.

The laws permit consumers, often for a small fee, to stop a credit-reporting agency from releasing their file to almost anyone without explicit authorization. A freeze affects everything from opening a credit card to setting up cell-phone service.

Consumer groups support the laws, saying they are among the most effective deterrents of financial-identity theft. But credit agencies, retailers and financial-services companies say there are less cumbersome means of preventing fraud.

At least 25 states, including Rhode Island, recently have passed or are considering security-freeze laws. New York ’s law took effect last week. Laws in Rhode Island, Kansas, Oklahoma and Wisconsin take effect on Jan. 1. Utah ’s law becomes effective in September. In most states, the freeze is free for victims of identity theft.

Five of the 25 states allow only identity-theft victims to obtain a security freeze; the rest allow anyone to do it.

States are jumping on the security-freeze bandwagon as the toll from identity theft continues to rise. An estimated 95 million Americans have been exposed to some risk of identity theft in the last two years because of breaches at companies, institutions and governments.

In one six-month period in 2004, an estimated 3.6 million households — about 3 percent of all U.S. households — said they had been victimized by at least one type of identity theft, according to a survey released by the Justice Department’s Bureau of Justice Statistics earlier this year. Identity theft was defined as misuse of existing credit or banking accounts, or the fraudulent opening of new ones, as well as obtaining work or services illegally using the name of another person.

Because many businesses will not open new accounts without first checking on the creditworthiness of an applicant, blocking access to the credit file essentially shuts down a transaction, reducing the opportunity for criminals to commit fraud using stolen data.

But by putting an end to instant credit approval, it creates a nuisance for retailers and lenders.

Many states allow the three major credit-reporting agencies — TransUnion LLC ( www.transunion.com), Equifax Inc. ( www.equifax.com) and Experian Group Ltd. ( www.experian.com) — to charge from $5 to $20 for a security freeze, and a similar fee to release, or “thaw,” the account again, unless the individual has been a victim of a crime. To be effective, consumers should request the freeze in writing from all three agencies, often by certified mail.

California passed the first security-freeze law in 2003, but a part of it was struck down by a state appeals court.

“The impact remains to be seen but it is unfortunate that there is a cloud of uncertainty over the ability of consumers to use this tool,” said Tom Dresslar, a spokesman for Attorney General Bill Lockyer. The state is reviewing the decision and hasn’t decided whether to appeal, he said. The ruling doesn’t affect states other than California.

Consumer groups such as Consumers Union and U.S. PIRG say security-freeze laws prevent financial identity theft. Requiring an individual to be an identity-theft victim before getting a freeze “is like saying you can’t have a seat belt until after you’ve been in a car crash,” says Ed Mierzwinski, consumer program director of U.S. PIRG.

Financial-services firms argue there are less extreme solutions.

“Freezes sound very appealing, but they have all kinds of unintended consequences,” says Nassa Feddis, senior general counsel for the American Bankers Association. “It can cause delay or even worse, prevent people from getting all kinds of services.”

Many state laws stipulate that a credit issuer can turn down an application if the consumer doesn’t allow access to his file in a specified period of time. It can take three business days for a frozen credit report to thaw in California and other states. Some states, such as New Jersey and Utah, have proposed that a frozen report should thaw in 15 minutes, but Feddis contends that defeats the purpose of the law.

Financial and retail industry trade groups argue that consumers already can obtain less burdensome protection by placing free 90-day fraud alerts against their credit files. Fraud alerts require lenders and merchants to verify an applicant’s identity before opening a new account.

But some identity-theft victims and consumer groups say businesses often ignore fraud alerts.

“If all of the companies were diligent about calling you, there would be no need for a freeze,” said Mari Frank, a California attorney and identity-theft victim advocate. “But unfortunately, that isn’t the case, so victims have to have some way of putting up a strong barrier and locking the door.”