Identity Theft Protection: Prevention and Response
Protect yourself from identity theft with credit freezes, monitoring setup, password management, and a response plan if your information is compromised.
Freezes are free by federal law. Freeze at Equifax (equifax.com), Experian (experian.com), and TransUnion (transunion.com). Each provides a PIN to temporarily lift the freeze when you need new credit.
Freeze your credit at lesser-known bureaus
Also freeze at Innovis, NCTUE (National Consumer Telecom and Utilities Exchange), and ChexSystems. These smaller bureaus are used by telecom, utility, and banking companies to verify identity.
Set up free credit monitoring alerts
All three bureaus offer free weekly credit reports at AnnualCreditReport.com. Many banks and credit cards provide free credit score tracking with alerts for new accounts or inquiries.
Review your credit reports for unauthorized accounts or inquiries
Check all three reports since creditors may report to only one bureau. Dispute any unfamiliar accounts or hard inquiries in writing. The bureau has 30 days to investigate and respond.
Password and Account Security
Set up a password manager and generate unique passwords
Use a different password for every account, each at least 16 characters. A password manager stores them securely so you only remember one master password. Most password managers cost $0-36 per year.
Enable two-factor authentication on all financial accounts
Use an authenticator app instead of SMS text codes when possible. SIM-swapping attacks can intercept text messages. An authenticator app generates codes locally on your device.
Set up account alerts for all bank and credit card accounts
Enable notifications for transactions over $1, new logins from unknown devices, password changes, and address changes. Immediate alerts let you catch fraud within minutes instead of days.
Use a dedicated email address for financial accounts
Create a separate email exclusively for banking, investments, and insurance. Do not use this email for newsletters, social media, or online shopping. This reduces phishing risk significantly.
Physical Document Security
Shred all documents containing personal or financial information
Use a cross-cut shredder (not strip-cut) for bank statements, pre-approved credit offers, medical bills, and tax documents. A basic cross-cut shredder costs $30-60 and handles 6-8 pages at a time.
Opt out of pre-screened credit and insurance offers
Call 1-888-5-OPT-OUT (1-888-567-8688) or visit OptOutPrescreen.com to stop pre-approved credit card offers. These offers in your mailbox can be stolen and used to open accounts in your name.
Store sensitive documents in a fireproof safe or safety deposit box
Keep Social Security cards, birth certificates, passports, and tax returns in a secure location. A fireproof home safe rated for 1 hour of protection costs $50-150. Safety deposit boxes run $25-75 per year.
Use informed delivery from USPS to monitor incoming mail
USPS Informed Delivery emails you grayscale images of mail pieces scheduled for delivery. This lets you know if expected mail (especially checks or financial documents) goes missing from your mailbox.
Online and Social Media Privacy
Audit your social media privacy settings
Set profiles to private or friends-only. Remove your birth date, phone number, and home address from public profiles. Thieves use this information to answer security questions and verify your identity.
Remove your personal information from data broker sites
Search your name on sites like Spokeo, WhitePages, and BeenVerified, then submit opt-out requests. Each site has a different removal process. Expect to spend 15-20 minutes per site.
Check if your email or passwords have been exposed in data breaches
Enter your email at haveibeenpwned.com to see if it appeared in known breaches. If compromised, change the password for that account and any other account where you used the same password.
Annual Credit Report Review
Pull your free credit reports from all three bureaus
Use AnnualCreditReport.com, the only federally authorized source. Stagger requests every 4 months (one bureau per quarter) for year-round monitoring at no cost.
Verify all listed accounts, addresses, and employers are yours
An unfamiliar address could indicate someone used your identity to open an account. Dispute any information you do not recognize immediately through the bureau's online dispute portal.
Check for and dispute any errors or unauthorized inquiries
About 25% of credit reports contain errors that could affect your score. Hard inquiries you did not authorize may indicate someone applied for credit in your name. File disputes online for fastest resolution.
If You Become a Victim
File an identity theft report at IdentityTheft.gov
The FTC site creates a personalized recovery plan and generates an official Identity Theft Report. This report is required by creditors and bureaus to remove fraudulent accounts from your record.
Place a fraud alert on your credit reports
An initial fraud alert lasts one year and requires creditors to verify your identity before opening new accounts. Contact just one bureau and they must notify the other two. An extended alert lasts 7 years.
File a police report with your local law enforcement
Some creditors require a police report in addition to the FTC report. Bring your FTC Identity Theft Report and any evidence of the fraud. Get a copy of the police report for your records.
Contact each company where fraud occurred
Call each company's fraud department, explain the situation, and request they close or freeze the fraudulent account. Follow up in writing within 10 days. Companies must respond within 30 days of receiving your dispute.
Frequently Asked Questions
How much does identity theft cost the average victim?
The median out-of-pocket cost for identity theft victims is $500-$1,000, but cases involving new account fraud (someone opens loans or credit cards in your name) average $1,200-$1,500 and can exceed $10,000. Beyond money, victims spend an average of 100-200 hours over 6-12 months resolving the fraud, including filing disputes, police reports, and dealing with collection agencies.
Is a credit freeze or credit lock better for protection?
A credit freeze (free by federal law since 2018) is stronger because it is regulated by law and cannot be overridden by the credit bureau. A credit lock is a bureau-offered service that works similarly but is governed by the bureau's terms of service, which can change. Freezes must be temporarily lifted with a PIN when you apply for credit, taking 1-3 minutes online. Place freezes at all three bureaus (Equifax, Experian, TransUnion) plus the often-forgotten Innovis and NCTUE.
What should I do in the first 24 hours after discovering identity theft?
Immediately freeze your credit at all three bureaus, change passwords on all financial accounts starting with email and banking, and file an identity theft report at identitytheft.gov (which generates an FTC affidavit). Contact your bank and credit card companies to flag your accounts and dispute unauthorized charges. File a police report, as many creditors require one to remove fraudulent accounts. Time is critical because thieves often escalate activity rapidly.
Do identity theft protection services like LifeLock actually work?
Paid monitoring services ($10-$30/month) provide credit monitoring, dark web scanning, and identity restoration assistance, but they cannot prevent theft. You can replicate much of this protection for free: credit freezes (the single most effective prevention), free credit monitoring through Credit Karma, and bank transaction alerts. Where paid services add value is the restoration assistance, where a dedicated agent helps you through the recovery process.