Identity theft is not one crime. It is a category that covers someone opening a credit card in your name, filing a tax return to grab your refund, using your health insurance, taking over an account you already have, or simply draining a debit card. Each variety has a different defense, which is why generic advice to "be careful online" does so little.
This guide puts the defenses in order, from the free steps that block the most damage to the paid ones worth considering only after the free ones are done.
Start with a credit freeze
A security freeze restricts access to your credit report. When a lender cannot pull your file, it will not approve a new account, which is exactly what stops someone using your details to open one. Under federal law, freezing and unfreezing your file is free at each of the three nationwide credit bureaus, and there is no limit on how often you do it.
You freeze each bureau separately: Equifax, Experian and TransUnion. Set up an online account with each one, or call, and store the PIN or login somewhere you will still have it in five years. When you genuinely need credit, you lift the freeze for a set window or for a specific lender, usually within minutes online.
A freeze has two limits worth understanding. It does not affect accounts you already have, and it does not stop a thief who has your card number from using that card. It also does not block fraud that involves no credit check, such as tax or benefits fraud.
If you want notification rather than blocking, a fraud alert is the lighter alternative: it tells lenders to take extra steps to verify identity, lasts one year, and you only need to request it at one bureau, which then tells the others.
Close the account-takeover route
Most people who get "hacked" were not targeted. Their password appeared in somebody else's data breach, and an automated system tried it everywhere else — see what to do after a data breach if you know which one exposed you. See how to secure your online accounts for the full, step-by-step version of what follows.
Three changes remove most of that exposure:
- Use a password manager and give every financial account and email account its own long, unique password. The one password you memorize is the manager's.
- Turn on two-factor authentication, preferring an authenticator app or a hardware key over text messages. SMS codes are better than nothing, but they can be intercepted through SIM-swap fraud.
- Protect the email account that resets everything else. Your primary inbox is the master key to your financial life. It deserves your strongest password, app-based two-factor, and a check of its forwarding rules and recovery addresses.
While you are in account settings, add a PIN or port-out protection with your mobile carrier. That is the specific control that makes SIM-swapping harder.
Shut down the tax and benefits angles
Tax identity theft happens when someone files a return using your Social Security number before you file. The IRS offers an Identity Protection PIN, a number that must appear on your return for it to be accepted, and it is open to any taxpayer who can verify their identity, not only past victims. It is issued for one calendar year and renewed annually.
Create your my Social Security account at SSA.gov before someone else does, and check the earnings record it shows you. Wages you do not recognize can be the first sign that your number is being used for employment.
Handle the physical channel
Paper is still a live attack surface. Mail theft gives a thief a preapproved credit offer, a new debit card, or a statement with an account number on it.
- Opt out of prescreened credit offers at OptOutPrescreen.com, the site run by the consumer reporting industry, either for five years or permanently.
- Collect mail promptly, or use a locking mailbox. Put a hold on delivery when you travel.
- Shred anything showing an account number, a date of birth, or a Social Security number.
- Carry your Social Security card only when you have a specific reason to present it.
Review reports and statements on a schedule
You are entitled to free credit reports from the three nationwide bureaus through AnnualCreditReport.com, the only federally authorized source. Pulling one bureau every few months gives you a rolling view at no cost. Our walkthrough on how to check your credit report covers what to look for line by line.
Set your bank and card accounts to alert on every transaction, or at least every transaction above a small threshold. Alerts catch the small test charge that usually precedes a large one.
Where paid services fit
Identity theft protection services typically bundle credit monitoring, dark-web scanning, alerts and, in the part people undervalue, restoration help and insurance that reimburses certain out-of-pocket recovery costs.
What they cannot do is prevent theft. Monitoring is detection: it tells you something has already happened, faster than you would have noticed alone. Treat any marketing that promises complete or guaranteed protection as a reason for skepticism.
The honest way to decide is to compare what a service adds over the free steps above. We break that down in Identity Theft Protection vs. Credit Monitoring and in Is Identity Theft Protection Worth Paying For?.
If it has already happened
Go to IdentityTheft.gov, the FTC's official recovery site. Reporting there produces an Identity Theft Report and a personalized checklist, including prewritten letters to creditors and bureaus. You can also place an extended fraud alert, which lasts seven years for confirmed victims.
Then work the list: contact the fraud department at each affected company in writing, dispute fraudulent entries with the bureaus, and keep a log of every call with dates and names. Recovery is paperwork, and the log is what makes the paperwork work.
If you are not sure whether something has happened, our guide on how to know if your identity has been stolen lists the specific warning signs.
Frequently asked questions
Is a credit freeze free?
Yes. Under federal law, placing and lifting a credit freeze is free at each of the three nationwide credit bureaus, with no limit on how often you do it.
Does a credit freeze hurt my credit score?
No. Freezing your credit report does not affect your credit score. It only restricts who can view your file, which is why it does not interfere with your own ability to check your reports.
What is the difference between a credit freeze and a fraud alert?
A freeze blocks lenders from accessing your report at all, which prevents new accounts from being opened. A fraud alert does not block access but tells lenders to take extra verification steps, and it needs renewal after one year unless you qualify for an extended alert.
Can identity theft protection services actually prevent identity theft?
No service can prevent identity theft. These services monitor for signs of misuse and help with recovery after the fact; a credit freeze is the step that actually blocks new-account fraud, and it is free.
How long does an IRS Identity Protection PIN last?
It is issued for one calendar year and must be renewed annually, either automatically through your online IRS account or by request.
