Credit freeze may not prevent identity theft