How to Safeguard Your Identity: The First Steps That Matter Most

Freeze your credit first. After that, secure your email, your phone number, and your Social Security number, and cut off the data brokers that help fuel fraud.

Reading time 9 minutes

Identity theft often begins with an unexpected notice, such as a credit card welcome letter you never requested or an IRS message saying a tax return has already been filed in your name. By the time that happens, the fallout is usually underway, and the next few weeks can get swallowed by forms, calls, and follow-up. Americans reported more than a million identity theft cases to the FTC in 2024, and consumers also said they lost $12.5 billion to fraud that year.

Many advice columns respond with a long checklist that treats every step as equally urgent, which often leaves people doing none of it. This guide focuses on the order that actually helps: what to do first, then what to add next, so the time you spend makes a real difference.

Start Here: Freeze Your Credit

If you only do one thing after reading this, freeze your credit. Most costly identity theft involves someone trying to open a new account in your name, whether that is a credit card, a loan, or a phone contract, and lenders usually check your credit file before approving anything. A freeze blocks that file, causing the application to fail.

You must place the freeze separately with all three bureaus, Equifax, Experian, and TransUnion, using their websites or apps. Federal law has made this free since 2018. It does not lower your credit score and it does not affect accounts you already have. If you later need credit yourself, you can temporarily lift the freeze online and then turn it back on afterward.

People often ask whether a fraud alert does the same job. It is less restrictive: it tells lenders to verify your identity before approving new credit, it lasts for a year, and placing one alert with a single bureau is enough because that bureau notifies the other two. A fraud alert can be useful right after a scare, such as learning your information was exposed in a breach, but a freeze is the setting we would keep in place long term.

Children also deserve attention here, since identity theft involving minors can go undetected for years until a first student loan application is denied. Parents can freeze a child’s credit file directly with each bureau, even if no file exists yet, and there is no cost.

Secure Your Email and Phone Number

After your credit is frozen, the next priority is your accounts, and the most important one is your email. Whoever controls your email can reset the password for your bank, Amazon account, and nearly everything else, so it should use the strongest password you have and two-factor authentication.

That second factor works best with an authenticator app or a security key. Text-message codes are better than nothing, but they rely on your phone number, and phone numbers can be stolen. In a SIM swap, a scammer tricks your carrier into moving your number to a new SIM card, and then every code meant for you goes to their phone. To reduce that risk, call your carrier or use its app to set up a port-out PIN or a number lock; all three major carriers now offer that option.

A password manager handles the rest by letting you use a different long password on every site without needing to memorize them. That matters because breaches happen constantly, and if you reuse passwords across multiple sites, one leak can become many. On public Wi-Fi, avoid logging in to your bank if possible, or use a VPN when you must.

Protect Your Social Security Number

Your Social Security number (SSN) is the master key in the American system, so the simplest move is to stop carrying the card. Leave it at home with your passport, and when a form asks for the number, such as at a doctor’s office, ask whether it is truly necessary.

The IRS also offers a tool that many people do not know about. Anyone who can verify their identity online can request an Identity Protection PIN, a six-digit code that changes each year and must be included on your tax return. Without it, a return filed in your name is rejected, which helps stop one of the most common tax-season scams.

There is another related step that many guides overlook. Fraudsters sometimes open online accounts with the IRS or the Social Security Administration in someone else’s name and then use those accounts to redirect refunds or benefits. If you create your own accounts first on IRS.gov and SSA.gov, that route is closed and you can check your records whenever you want.

Two smaller steps help round things out. You can place a free security freeze with ChexSystems, the agency banks check when someone opens a checking account, because a credit freeze does not cover that. You can also stop prescreened credit card offers, which can be useful to anyone going through your mail, by using OptOutPrescreen.com, the official site run by the credit bureaus.

Offline Habits That Still Matter

A surprising amount of identity theft still starts on paper. Bank statements, medical bills, and prescreened offers can contain your name, address, and sometimes account numbers, so they belong in a shredder rather than the recycling bin. If your mailbox does not lock, the Postal Service’s free Informed Delivery service shows what should arrive each morning, making it easier to notice when something is missing.

The phone is another weak point. Banks, the IRS, and Medicare do not call to ask for your Social Security number or for a code they just texted you, so anyone who does is not who they claim to be. The safest response is to hang up and call back using the number printed on your card or listed on the official website.

Watch for Problems

Prevention lowers the risk, and monitoring catches what gets through. The free tools are generous: you can download your credit reports from all three bureaus every week at AnnualCreditReport.com, the official site, and checking them every few months is usually enough to spot an unfamiliar account. Turning on transaction alerts in banking and card apps does the same job in real time, since you are notified the moment a purchase happens.

Paid identity theft protection services add credit monitoring, dark web monitoring, insurance, and recovery help. They do not stop theft, and a credit freeze does more to prevent it than any of them, but the assistance with cleanup can still be valuable when recovery takes months.

How Data Brokers Fit In

One question most identity theft guides leave out is where criminals get the details they need in the first place. Breaches are one source. Data brokers are another, and often a more convenient one, because they sell profiles that include exactly the kind of information a thief can use to answer security questions or write a convincing phishing email: your date of birth, every address you have used, your phone numbers, and the names of your relatives.

Some brokers are people-search sites that anyone can use. Others are private database brokers that trade credit, income, and financial information, and those are not even searchable by the public. You can send each one a deletion request yourself at no cost, and it usually takes about ten minutes per broker. Our guide to removing your personal information from the internet explains how. The hard part is that there are hundreds of them, and many restore your details after a few months.

That is why some people use a removal service. Our top pick among the best data removal services is Incogni. You enter your name and address, add up to three email addresses, home addresses, and phone numbers, and sign an authorization form. From there, it sends deletion requests to more than 420 data brokers, including people-search sites and private databases.

We tested it on our own profile for almost four months. During that period, it sent 107 requests to 44 brokers, closed 102 of them, and added us to 17 suppression lists, meaning those brokers should not rebuild the file. The Unlimited plan also includes an exposure scanner that searches for your details on other sites, custom removals for the pages it finds, and a privacy score updated every 30 days. Ours was 54 out of 100, with five sites still showing a home address, so the work was clearly not finished.

The Standard plan costs $95.88 per year, or $7.99 per month. Unlimited costs $179.88 per year, and every plan includes a 30-day money-back guarantee.

For U.S. residents who want monitoring and recovery in one subscription, Incogni also offers a plan called Protect, priced at $248.88 per year, or $20.74 per month. It includes everything in Unlimited, plus identity protection from its partner Coveron: credit monitoring with alerts, dark web monitoring for your email, Social Security number, phone number, and card numbers, and a case manager who handles restoration if your identity is stolen. It also includes up to $1 million in identity theft insurance, except for residents of New York and Washington, and up to $10,000 for losses tied to online scams.

If Your Identity Has Already Been Stolen

Speed matters more than perfection. Start by freezing your credit with the three bureaus, or at least placing a fraud alert, so the thief cannot open anything else while you work through the damage. Then write down what you know: which accounts were affected, which dates matter, and which letters or calls made you suspicious.

Your next stop is IdentityTheft.gov, the FTC’s website, where you can report what happened and get a recovery plan tailored to your case, along with pre-filled letters for the companies involved. Contact those companies directly to close fraudulent accounts, change passwords on anything that may be exposed, and file a police report if a creditor asks for one.

The Order We Would Follow

If you have an hour this week, freeze your credit with all three bureaus, then secure your email with an authenticator app and ask your carrier for a number lock. Over the next weekend, request your IRS Identity Protection PIN, create your IRS and Social Security accounts, and opt out of prescreened offers.

After that, the work becomes a matter of limiting what is available about you and watching for anything unusual. Free credit reports and bank alerts cover the monitoring. For data brokers, you can send requests yourself or let Incogni handle them on a schedule, and if you want insurance and recovery help in the same place, Protect includes that as well.

FAQ

What Is the Single Most Effective Way to Prevent Identity Theft?

Freezing your credit with Equifax, Experian, and TransUnion. It is free, it does not affect your credit score, and it prevents anyone from opening a new credit account in your name until you lift the freeze yourself.

Should I Freeze My Credit or Put On a Fraud Alert?

A freeze is stronger because it blocks new credit outright, while a fraud alert simply asks lenders to verify your identity before approving an application. A fraud alert can make sense right after a scare, and a freeze is the better long-term option.

How Can I Protect My Identity Online?

Use a password manager, turn on two-factor authentication with an authenticator app, and protect your email account first because it can reset everything else. Ask your carrier for a number lock, and avoid logging in to sensitive accounts on public Wi-Fi unless you are using a VPN.

How Can I Protect My Identity for Free?

Most of the protection is free: credit freezes, fraud alerts, an IRS Identity Protection PIN, weekly credit reports from AnnualCreditReport.com, bank alerts, and opt-outs from prescreened credit offers. Removing your information from data brokers is free too if you send the requests yourself.

What Should I Do If My Identity Is Stolen?

Freeze your credit or place a fraud alert, write down what happened, and report it at IdentityTheft.gov, which creates a recovery plan and the letters you need. Contact the companies where the fraud occurred, and file a police report if a creditor asks for one.