Consumers suffer from “optimism bias,” the researchers found. They realized that the breach created risk, but did not think anything would happen to them personally. “People tend to underestimate their own risk,” said Florian Schaub, an assistant professor at the school and one of the study’s authors.

Others incorrectly assumed that because they had poor credit or little wealth, they would be unattractive targets for identity thieves. “They think: ‘I don’t have much money. I have nothing to lose,’” Mr. Schaub said. “But that’s not how identity thieves operate.”

People interviewed also cited the cost of freezes as a barrier. It can cost as much as $10 per bureau to place a freeze, and a similar fee is charged to thaw it temporarily when you want to apply for credit.

Consumer advocates hope that making freezes free will spur more consumers to use them. (The new law requires that a thaw must also be free.)

But the freeze process is not as easy as it could be, said Mike Litt, consumer campaign director for U.S. PIRG, the consumer advocacy group. He would prefer credit files to be “frozen” by default, and thawed on request. As it stands, consumers must place freezes separately at all three bureaus, and keep track of three PINs.

And because it’s not always possible to know in advance what credit bureau a lender will use, consumers typically must lift the freezes at all three bureaus when they want to apply for new credit.

Brett Merfish, a lawyer in Austin, Tex., said she froze her credit at all three bureaus several years ago, after her personal information was used to open “a steady flow” of fraudulent credit card accounts. The freeze process was “tedious,” she recalled, but ultimately effective because she no longer has problems with fake accounts. “It’s worth it to do it,” she said.