How to Protect Yourself From Identity Theft: 12 Steps (2026)

The best way to protect yourself from identity theft is to make your personal data hard to use, even if it leaks: freeze your credit at all three bureaus, lock your tax return with an IRS Identity Protection PIN, and protect your accounts with unique passwords and two-factor sign-in. Then watch your reports and statements so you catch anything odd early. Data breaches mean most people’s name, birth date and even Social Security number are already out there, so these 12 steps focus on what stops a thief from turning that data into new accounts, loans or a fake tax refund.

Every step below follows guidance from the Federal Trade Commission (FTC), the Consumer Financial Protection Bureau (CFPB) and the IRS, and almost all of it is free.

Quick answer

• Do today: freeze your credit at Equifax, Experian and TransUnion; get an IRS IP PIN; turn on two-factor sign-in for email and banking.
• Do this week: move to a password manager, set bank and card alerts, check your free credit reports at AnnualCreditReport.com.
• Habits: never give your SSN or codes to someone who contacts you, shred paper with personal data, and review statements every month.
• If it happens: report it at IdentityTheft.gov to get a free recovery plan.

The 12 steps at a glance

1. Freeze your credit at all three bureaus

A credit freeze is the single strongest step. It stops lenders from pulling your credit report, so a thief can’t open a new credit card or loan in your name even with your SSN. The FTC is clear on the key points:

• It is free to place and to lift a freeze.
• It lasts until you lift it.
• It does not affect your credit score, and your existing cards and loans keep working.
• You must contact each of the three bureaus separately.

How to freeze your credit

1. Go to each bureau’s official site: Equifax (external site), Experian (external site) and TransUnion (external site). Type the address yourself rather than clicking a link in an email or ad.
2. Choose the credit freeze option and create an account. You’ll verify your identity with your name, address, date of birth and SSN.
3. Save the login (or PIN, if one is issued) in your password manager. You’ll need it to lift the freeze.
4. Repeat for the other two bureaus. A freeze at one bureau does not freeze the others.

Applying for credit later? Ask the lender which bureau it uses, then lift the freeze at just that bureau, for a set time if the site offers it. Freeze it again afterward if you lifted it for good.

2. Freeze your child’s credit too

Children are an easy target because nobody checks their credit for years. If your child is under 16, you can request a free freeze, and it stays until you ask the bureaus to remove it. The process is different from an adult freeze (you usually send proof that you’re the parent), so follow each bureau’s minor freeze instructions.

3. Place a fraud alert if you think you’re at risk

A fraud alert tells lenders to take extra steps to confirm it’s really you before opening an account. It’s free, and you only need to contact one bureau, which must tell the other two.

• Initial fraud alert: lasts one year and can be renewed. Anyone who suspects they may be affected can place one.
• Extended fraud alert: lasts seven years, for confirmed victims with an FTC identity theft report or a police report.
• Active duty alert: lasts one year for active duty service members and can be renewed for the length of a deployment.

A freeze is stronger than an alert, but an alert is a good quick step right after a breach or a lost wallet. You can have both.

4. Get an IRS Identity Protection PIN

Tax identity theft happens when someone files a return with your SSN to grab a refund. An IRS Identity Protection PIN (external site) (IP PIN) stops that: it’s a six-digit number that must be on any return filed with your SSN or ITIN, or the return is rejected.

• Anyone with an SSN or ITIN who can verify their identity can get one, and parents can request one for dependents.
• The fastest way is the IP PIN section of your IRS online account or the IRS app.
• A new PIN is issued every calendar year. If you got it online, sign in each year to get the new one.
• The IRS will never call, email or text to ask for your IP PIN. Anyone who does is a scammer.

5. Check your free credit reports

Equifax, Experian and TransUnion each let you get a free credit report every week at AnnualCreditReport.com (external site), the official site for free reports. Look for accounts, addresses or hard inquiries you don’t recognize. A frozen report still shows your existing accounts, so checking it is a good way to confirm nothing new slipped through.

6. Turn on two-factor sign-in everywhere it matters

The FTC recommends multi-factor authentication on every account that offers it. With it on, a stolen password alone isn’t enough to get in. Start with your email (it can reset every other account), then banking, payment apps, your mobile carrier, cloud storage and social media.

An authenticator app or a passkey is safer than a text-message code, because text codes can be stolen through a SIM swap (see step 11).

7. Use a password manager and unique passwords

Most account takeovers start with a password leaked in one breach and reused on another site. A password manager creates and remembers a long, unique password for every account, so one leak can’t unlock the rest. Several good ones are free; our comparison of the best free password managers shows the limits of each. Protect the manager itself with a strong master password and two-factor sign-in.

8. Learn the signs of phishing

Many identity thieves don’t hack anything: they simply ask. Phishing emails, texts and calls pretend to be your bank, the IRS, a delivery company or a well-known store. Warning signs:

• Urgency or threats: your account will be closed, you owe money, a package is stuck.
• A request for your SSN, a one-time code, a password, or payment by gift card, wire or crypto.
• A link or attachment you didn’t expect, or a sender address that is slightly off.
• A caller who asks you to “verify” details they should already have.

When in doubt, hang up or close the message, then contact the company using the number on your card or its official app. Gift cards are a favourite payment method for these scams; our guide to gift card scams shows the common scripts.

9. Guard your Social Security number

• Never give your SSN to anyone who calls, texts or emails you, even if they claim to be from the government, your bank or a company you know. The FTC calls that a scam.
• Don’t carry your Social Security card. Keep it, your birth certificate and passport somewhere safe at home.
• When a form asks for your SSN (a doctor’s office, a school), ask why it’s needed and how it’s stored. Often it’s optional.

10. Protect your mail and paper records

• Shred bank statements, pre-approved credit offers, medical bills and anything with account numbers before you throw them away.
• Collect mail promptly, and use a locking mailbox if mail theft is common where you live. Ask the post office to hold mail while you travel.
• Switch to paperless statements where you can, so fewer documents sit in your mailbox.
• Store tax returns and financial papers in a safe place, not in a car or an open drawer.

11. Lock down your phone and mobile account

Your phone number is the key to many text codes and password resets. In a SIM swap, a thief convinces your carrier to move your number to their SIM card and then receives your codes.

• Add a PIN or passcode to your mobile carrier account and turn on any number-lock or port-out protection your carrier offers.
• Use a screen lock and keep your phone’s software up to date.
• Install apps only from the official app stores.

If your phone is acting strangely, our guide on how to know if your phone is hacked walks through the checks for iPhone and Android.

12. Monitor your accounts and statements

• Turn on transaction alerts in your bank and card apps, so every charge shows up on your phone.
• Read bank and card statements each month for purchases, withdrawals or address changes you didn’t make.
• Check medical bills and insurance statements (explanations of benefits) for care you never received. Medical identity theft is easy to miss.
• Paid identity theft protection services can add monitoring and help, but they don’t do anything you can’t do yourself for free with the steps above. If you hold crypto, add the extra steps in our crypto wallet security guide; a credit freeze doesn’t cover wallets or exchanges.

What to do if your identity is stolen

Act quickly; each step limits the damage.

1. Report it at IdentityTheft.gov (external site). The FTC’s site asks what happened and gives you a free, personal recovery plan, an Identity Theft Report you can use as proof, and sample letters to send to companies. Spanish speakers can use RobodeIdentidad.gov.
2. Call the fraud departments of the companies where fraud happened. Ask them to close or freeze the accounts and remove the charges.
3. Place an extended fraud alert or a credit freeze at the bureaus, if you haven’t already.
4. Change passwords and sign out other devices on email, banking and any account the thief may have reached. Turn on two-factor sign-in.
5. Fix your credit reports: dispute accounts and inquiries that aren’t yours with each bureau. Your recovery plan shows how.
6. Tax fraud: if the IRS says a return was already filed with your SSN, follow the IRS identity theft steps and get an IP PIN for next year.

The CFPB also has plain guides on fixing credit report errors and dealing with debt collectors chasing debts that aren’t yours, on consumerfinance.gov (external site).

FAQ

What is the best way to protect yourself from identity theft?

Freeze your credit at Equifax, Experian and TransUnion. It’s free, it doesn’t hurt your score, and it stops most new-account fraud. Add an IRS IP PIN and two-factor sign-in on your email and bank for strong all-round protection.

Does freezing your credit hurt your credit score?

No. The FTC says a credit freeze does not affect your credit score. Your existing accounts keep working; only new lenders are blocked from seeing your report until you lift it.

Is a credit freeze or a fraud alert better?

A freeze is stronger because lenders can’t see your report at all. A fraud alert only asks lenders to verify your identity. A fraud alert is quicker (one bureau covers all three), so it’s useful right after a breach while you set up freezes.

Is identity theft protection worth paying for?

For most people, no. The core protections (freezes, fraud alerts, free weekly credit reports, an IRS IP PIN) are free. Paid services mainly bundle monitoring and recovery help; you can do the most important steps yourself for free.

How do I know if someone is using my identity?

Common signs are charges or accounts you don’t recognize, bills for things you didn’t buy, missing mail, calls from debt collectors about unknown debts, medical bills for care you didn’t get, or a rejected tax return. Check your free credit reports and report anything suspicious at IdentityTheft.gov.

$4.99Free when you subscribe

Get 100 tech terms explained in plain English

8-page PDF on AI, coding, slang and SEO + one tech email a week.

Email address

Send me the PDF →

Sent by email. Unsubscribe anytime. See our privacy policy.