Identity Theft: How to Protect Yourself and What to Do If You're a Victim

How to Prevent Identity Theft

Freeze Your Credit

A credit freeze (also called a security freeze) restricts access to your credit report, making it impossible for identity thieves to open new accounts in your name. You must contact each of the three credit bureaus individually — Equifax, Experian, and TransUnion — and request a freeze. The process takes about 10 minutes per bureau online. You can temporarily lift the freeze when you need to apply for credit yourself. Credit freezes are free under federal law and have no impact on your credit score. This is the single most effective identity theft prevention measure available. Unlike credit monitoring, which only alerts you after fraud occurs, a freeze prevents fraud from happening in the first place.

Use Strong Passwords and a Password Manager

Every financial account should have a unique, complex password that you do not use anywhere else. A password manager like Bitwarden, 1Password, or LastPass generates and stores strong passwords for you, so you only need to remember one master password. Enable two-factor authentication on every financial account. Use an authenticator app (Google Authenticator, Authy, or Microsoft Authenticator) rather than SMS when possible — SIM swapping attacks can bypass SMS-based two-factor authentication. For your most important accounts (email, banking, brokerage, and credit cards), use a hardware security key like a YubiKey for the highest level of protection. Build a strong financial security foundation →

Monitor Your Accounts and Credit Report

Check your bank and credit card statements at least once per month for unauthorized transactions. Review your credit report from all three bureaus at least once per year — you can access them free at annualcreditreport.com. Consider staggering your requests: pull one bureau's report every four months for continuous monitoring. Sign up for free credit monitoring through services like Credit Karma or through your existing bank and credit card providers — many now offer free credit scores and monitoring as a perk. Monitor your medical statements and Explanation of Benefits forms for services you did not receive — medical identity theft is growing and harder to detect.

Secure Your Physical Information

Shred any documents containing personal information before throwing them away — bank statements, credit card offers, medical bills, and tax documents should all go through a cross-cut shredder. Use a locked mailbox or a PO box for receiving sensitive mail. Go paperless for bank and credit card statements to reduce the risk of mail theft. Sign up for USPS Informed Delivery, which emails you images of your incoming mail each day so you can spot if something goes missing. Never carry your Social Security card in your wallet. Store important documents in a fireproof safe rather than a file cabinet. Be cautious about sharing personal information over the phone — if someone calls claiming to be your bank, hang up and call back using the number on your card. Learn about common scams that lead to identity theft →

Warning Signs Your Identity Has Been Stolen

Identity theft often goes undetected for weeks or months. The earlier you catch it, the less damage you suffer. Watch for these red flags: unexpected credit card or bank statements in the mail, collection calls for accounts you never opened, an IRS notice about a tax return you did not file, medical bills for services you did not receive, being denied credit when you have good credit, unfamiliar accounts on your credit report, incorrect information on your credit report, and missing mail (bills or statements that stop arriving). If you notice any of these signs, act immediately — the faster you respond, the less liability you face.

What to Do If Your Identity Is Stolen

If you discover you are a victim of identity theft, follow these steps in order. First, file a police report with your local law enforcement. Bring any evidence you have — fraudulent statements, credit reports, and correspondence from creditors. Get a copy of the police report; you will need it later. Second, report the theft to the Federal Trade Commission at IdentityTheft.gov. The FTC will create a personal recovery plan and provide an Identity Theft Affidavit that you can use when disputing fraudulent accounts. Third, contact the fraud departments of each credit bureau — Equifax, Experian, and TransUnion — and place a fraud alert or credit freeze on your credit file. A fraud alert requires businesses to verify your identity before opening new accounts. A credit freeze is stronger — it blocks access to your credit report entirely. Fourth, contact each company where fraud occurred and close the fraudulent accounts. Provide them with the police report and FTC affidavit. Fifth, dispute fraudulent accounts with each credit bureau where they appear on your credit report. Use the FTC's sample dispute letters. Sixth, if the fraud is tax-related, file IRS Form 14039 (Identity Theft Affidavit) with the IRS. Continue monitoring your credit reports for at least 12-24 months after the incident. Learn how crypto scams can expose your identity →

Is identity theft protection worth paying for?

Identity theft protection services monitor your credit reports, financial accounts, and personal information for signs of fraud. They typically cost $10-30/month and alert you to suspicious activity. Whether they are worth it depends on your risk profile. If you have already been a victim, have had a data breach that exposed your SSN, or simply want peace of mind, a service like LifeLock, IdentityForce, or IdentityGuard can provide valuable monitoring and recovery assistance. However, the most important protection — a credit freeze — is free and more effective than any paid service. Credit monitoring only alerts you after fraud occurs; a freeze prevents it. If you freeze your credit, use strong passwords, enable two-factor authentication, and monitor your accounts yourself, paid identity theft protection adds minimal additional value for most people.

How often should I check my credit report?

You should check your credit report at least once per year from each of the three bureaus — Equifax, Experian, and TransUnion. The most effective strategy is to stagger your requests: pull one report every four months so you have continuous monitoring throughout the year. All three reports are available free at annualcreditreport.com. In addition to annual checks, review your credit report any time you are denied credit, lose a wallet or purse, suspect fraud, or learn about a data breach involving companies you do business with. Free services like Credit Karma provide ongoing access to your TransUnion and Equifax reports, making continuous monitoring easier. Check your bank and credit card statements monthly — this catches the majority of unauthorized transactions early.

What's the difference between credit freeze and fraud alert?

A credit freeze (security freeze) blocks access to your credit report entirely. Lenders cannot see your credit history, which means they cannot approve new accounts in your name. A freeze stays in place until you lift it, is free under federal law, and has no impact on your credit score. A fraud alert is a notice on your credit report that tells lenders to verify your identity before opening new accounts. It is less restrictive than a freeze — lenders can still access your credit report. Fraud alerts last 1 year (or 7 years if you have a police report) and are free. For maximum protection, use a credit freeze. Use a fraud alert if you have been a victim but are unsure whether you want a full freeze. You can also use both simultaneously.

Can identity theft affect my taxes?

Yes, tax-related identity theft is one of the most common and damaging forms. A thief uses your Social Security number to file a fraudulent tax return and steal your refund. You discover the fraud when you file your legitimate return and the IRS rejects it because a return has already been filed under your SSN. If this happens, file IRS Form 14039 (Identity Theft Affidavit) immediately, either by mail or through the IRS Identity Protection Specialized Unit. The IRS will review your case, issue a unique Identity Protection PIN (IP PIN) for future filings, and process your legitimate return once the investigation is complete. To prevent tax identity theft, file your taxes as early as possible — before the thief has a chance to file a fraudulent return. If you are a confirmed victim, the IRS will mail you an IP PIN each year that you must include on your tax return to verify your identity.

Related Resources