The most effective way to reduce identity-theft risk is to use several controls together: freeze your credit reports with Equifax, Experian, and TransUnion; secure the accounts that can reset everything else; use unique passwords and strong multifactor authentication; request an IRS Identity Protection PIN; turn on financial and login alerts; and regularly check credit, bank, tax, Social Security, and health-insurance activity.
No single step can prevent every type of identity theft. A credit freeze can make it harder to open new credit accounts, but it does not automatically protect an existing bank account, email account, phone number, tax return, medical record, employment record, or utility account. The goal is to reduce exposure, block common forms of impersonation, detect misuse quickly, and make recovery easier.
What identity theft includes
Identity theft occurs when someone uses your personal or financial information without permission. It is broader than a stolen credit-card number. The Federal Trade Commission lists examples including opening credit cards or loans, taking over an existing bank or email account, opening phone or utility service, filing a fraudulent tax return, using an SSN to get a job, using health-insurance or Medicare information for medical care, claiming government benefits, using a child’s identity, or presenting stolen identity information during a law-enforcement encounter. See the FTC’s identity-theft overview.
That range explains why no checklist can guarantee prevention. The right strategy is layered:
#1 Best Overall
- PORTABLE SCANNER FOR USE ON-THE-GO — The fastest and lightest mobile single-sheet-fed compact document scanner in its class¹
- QUICK DOCUMENT SCANNING ― This Epson ultra-fast scanner scans a single page as quickly as 5.5 seconds²; Windows and Mac compatible
- VERSATILE PAPER HANDLING ― Portable scanner scans documents up to 8.5 x 72 in; Also easily digitizes receipts and ID cards to make accounting, bookkeeping, and organizing simpler
- INTUITIVE, HIGH-SPEED SOFTWARE — Epson ScanSmart Software³ is a smart tool allowing you to easily scan, review, and save; Stay organized easily with the help of this Epson scanner
- EASY SETUP — USB-powered connect to your computer for quick and simple scanning; No batteries or external power supply required to operate portable document scanner; Standard Connectivity: USB 2.0
- Reduce exposure: share less sensitive information and protect physical documents.
- Protect access: secure the accounts and devices that hold or reset your information.
- Block new accounts: freeze credit and, when appropriate, relevant specialty consumer reports.
- Detect misuse: use alerts and review credit, financial, medical, tax, and government records.
- Recover quickly: contact the affected organization, document the incident, and use IdentityTheft.gov when theft has occurred.
These layers address different problems. A credit freeze helps with new-credit applications; it does not stop an attacker who already knows your online-banking password or has taken over your phone number.
1. Freeze your credit reports first
For most U.S. consumers, a free security freeze at all three nationwide credit bureaus is the highest-leverage preventive step. A freeze restricts prospective creditors from accessing your credit file, which can make it substantially harder for an identity thief to open a new credit card or loan in your name. It does not affect your credit score, and it generally remains in place until you remove or lift it. The Consumer Financial Protection Bureau explains the federal freeze rules.
You must place the freeze separately with Equifax, Experian, and TransUnion. Freezing only one report leaves the other two available to a lender that uses them.
Freeze, fraud alert, monitoring, or credit lock?
| Control | What it does | How it is placed | Duration and cost | Main limitation |
|---|---|---|---|---|
| Security freeze | Restricts prospective creditors from accessing your credit file, making many new-credit applications harder to approve. | Contact all three nationwide bureaus separately. | Free; remains until you lift or remove it. | You must lift it before some legitimate credit applications. It does not stop account takeover, tax, medical, employment, utility, phone, or existing-account fraud. |
| Initial fraud alert | Requires creditors to take reasonable steps to verify your identity before opening new credit, issuing an additional card, or raising a credit limit. | Contact any one major bureau; that bureau must notify the other two. | Free; lasts one year and can be renewed. | It does not block access to your report. |
| Extended fraud alert | Provides a longer verification warning for a confirmed identity-theft victim. | Requires an identity-theft report. | Free; lasts seven years. | It is intended for victims, not simply as a general precaution. |
| Active-duty alert | Requires an additional identity-verification step and removes the servicemember from nationwide prescreened credit and insurance offers. | Contact any one major bureau. | Free; lasts 12 months and can be renewed. Prescreened offers are suppressed for two years. | It is not a substitute for account security or a freeze. |
| Credit lock | A commercial service that may restrict access to a bureau file. | Terms depend on the provider. | May be bundled with a paid service; terms vary. | The CFPB says locks are no more effective than free security freezes and may have different terms. |
See the FTC’s guide to credit freezes and fraud alerts and the CFPB’s guidance for people who think they are victims of identity theft.
Recommended Free Tools
How to freeze all three reports
- Open the official Equifax freeze page, create or access your account, and complete identity verification.
- Use the official Experian freeze page.
- Use the official TransUnion freeze page.
- Confirm that each freeze is active. Save confirmation numbers, usernames, recovery methods, and any PINs or passwords in your password manager.
- When you apply for a mortgage, card, apartment, insurance product, or other service that checks credit, ask which bureau the provider will use. If possible, lift only that bureau temporarily and specify how long the lift should last.
- After the application is complete, confirm that the report is frozen again.
Under federal rules, a nationwide bureau generally must place a freeze within one business day when you request it by telephone or secure electronic means. A temporary lift requested electronically or by telephone generally must occur within one hour. Mail requests have longer deadlines. Website verification, identity-proofing problems, and an account that needs manual review can still create real-world delays, so do not wait until the hour before closing on a loan.
2. Check your credit reports correctly
Use AnnualCreditReport.com, the federally authorized source, rather than an unfamiliar advertisement or a search result that charges for a report. Reports are also available by phone at 1-877-322-8228 or by mail. Current official guidance says consumers can request free reports weekly from each of the three major bureaus. Requesting your own report is a soft inquiry and does not lower your credit score. USAGov also explains the process at usa.gov/credit-reports.
Inspect each report for:
- Credit cards, loans, or collections you did not open.
- Hard inquiries from companies you never contacted.
- Unknown addresses, employers, names, SSN fragments, or dates of birth.
- Balances, credit limits, payment histories, or account statuses that do not match your records.
- Accounts shown as closed when they are not, or open when they should be closed.
A credit report is not a credit score, and a clean report is not proof that no identity theft has occurred. Tax, medical, employment, bank, phone, utility, and account-takeover fraud may never appear on a standard credit report.
3. Do not overlook specialty consumer reports
The three major bureaus are only part of the U.S. consumer-reporting system. Specialty reporting companies may collect information about checking accounts, telecommunications, utilities, employment, tenant screening, insurance, and other transactions. The CFPB maintains a current list of consumer-reporting companies.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteExamples include:
- ChexSystems: checking-account applications, openings, closures, and reasons for account closure.
- Early Warning Services: banking and payment-related information.
- NCTUE: telecommunications, pay-TV, utility accounts, and payment histories. The CFPB has a dedicated NCTUE information page.
- Innovis: supplementary identity and credit information.
- LexisNexis and C.L.U.E.: public-record, insurance, and related information.
Do not assume you need to freeze every specialty report. Instead, match the report to the risk. If a checking account was opened fraudulently or a bank denied an application for an unexplained reason, request the relevant checking-account reports; the CFPB explains how to obtain a checking-account consumer report. If a phone, cable, or utility account was opened in your name, investigate NCTUE and other relevant reporting companies. If a landlord, insurer, or employer reports an unexplained screening problem, ask which consumer-reporting company supplied the information and request that report.
4. Secure the accounts that can reset everything else
Start with accounts in this order:
- Primary email.
- Password manager.
- Mobile-carrier account.
- Bank and credit-card accounts.
- Brokerage and retirement accounts.
- IRS and state-tax accounts.
- Social Security account.
- Apple, Google, or Microsoft account.
- Health-insurance and medical portals.
- Shopping, payment, and peer-to-peer payment services.
- Social-media accounts.
Email deserves priority because control of it can allow password resets for many other accounts. That is a practical risk assessment, not a universal technical rule: each provider’s recovery design is different, but a compromised primary inbox can expose reset links, financial notices, tax documents, and security alerts.
Rank #2
- FAST SPEEDS - Scans color and black and white documents a blazing speed up to 16ppm (1). Color scanning won’t slow you down as the color scan speed is the same as the black and white scan speed.
- ULTRA COMPACT – At less than 1 foot in length and only about 1. 5lbs in weight you can fit this device virtually anywhere (a bag, a purse, even a pocket).
- READY WHENEVER YOU ARE – The DS-640 mobile scanner is powered via an included micro USB 3. 0 cable allowing you to use it even where there is no outlet available. Plug it into you PC or laptop and you are ready to scan.
- WORKS YOUR WAY – Use the Brother free iPrint&Scan desktop app for scanning to multiple “Scan-to” destinations like PC, Network, cloud services, Email and OCR. (2) Supports Windows, Mac and Linux and TWAIN/WIA for PC/ICA for Mac/SANE drivers. (3)
- OPTIMIZE IMAGES AND TEXT – Automatic color detection/adjustment, image rotation (PC only), bleed through prevention/background removal, text enhancement, color drop to enhance scans. Software suite includes document management and OCR software. (4)
Password and authentication hierarchy
- Use a unique password for every important account. Never reuse a banking, email, tax, or password-manager password on another site.
- Use a password manager. Protect it with a long, unique master credential and multifactor authentication. Store recovery codes in a secure offline location as well as, where appropriate, in the manager.
- Choose a passkey or hardware security key when supported. NIST describes passkeys as more resistant to phishing than passwords. Hardware security keys can provide strong protection for especially valuable accounts.
- Use an authenticator app if passkeys or security keys are unavailable. This is generally preferable to manually receiving codes by text.
- Use push approval only when it includes number matching or another anti-fatigue feature. Do not approve an unexpected login prompt.
- Treat SMS codes as a fallback. They are better than no MFA but can be defeated if a criminal takes control of your phone number.
NIST’s guidance on passwords and passkeys and its authentication guidance explain why manually entered one-time codes are not considered phishing-resistant. MFA reduces account-takeover risk; it does not make an account invulnerable to phishing, social engineering, device compromise, or recovery-channel abuse.
Resist phishing and impersonation
When an unexpected email, text, social-media message, or phone call asks for sensitive information, stop. Do not provide an SSN, password, one-time code, bank detail, or remote access merely because the caller claims to be from a bank, government agency, delivery company, employer, or security department.
- Do not click links in unexpected messages.
- Do not read an MFA code to a caller unless you initiated a verified support interaction and understand why the code is needed.
- Independently find the organization’s website or phone number. Type a known address manually or use a bookmark you saved earlier.
- Be skeptical of urgency, threats, secrecy, unusual payment methods, and requests to move the conversation to another platform.
- Check the account directly rather than trusting a message that says there is a problem.
The FTC recommends contacting a company through a phone number or website you know is real, not through contact information supplied in a suspicious message. Its guidance on protecting personal information from hackers and scammers is a useful reference.
Protect your phone number from SIM swaps
A criminal who transfers your number to another SIM or carrier may receive SMS authentication codes and use them to reset email, financial, or social accounts. The FTC and FCC describe this risk in their guidance on two-factor authentication and cell-phone fraud.
- Set a unique account PIN or passcode with your mobile carrier.
- Enable the carrier’s SIM-change, port-out, or account-change lock if offered.
- Turn on notifications for SIM changes, device changes, and port-out requests.
- Use a passkey, security key, or authenticator app instead of SMS for high-value accounts.
- Do not make your phone number the only recovery method for email, banking, or investment accounts.
- Keep backup codes and alternate recovery methods secure and current.
Carrier names and menu labels vary, and a carrier lock does not block every possible attack. If your phone suddenly loses service for no obvious reason, use another phone to contact the carrier immediately. Then secure your email, bank, brokerage, tax, and other critical accounts and review recent account changes.
5. Protect bank, card, and existing accounts
A credit freeze protects against many new-credit applications, not unauthorized access to an account you already own. Configure alerts for:
- Every card transaction, or at least transactions above a low threshold.
- Online logins and new devices.
- Password, email, phone-number, mailing-address, and security-setting changes.
- New payees, linked accounts, transfers, and withdrawals.
- Direct-deposit changes.
- Large transfers, low balances, and unusual debit activity.
Review pending and posted transactions regularly. A small unfamiliar debit may be a test before a larger theft; the CFPB specifically warns consumers not to ignore small unauthorized transactions.
For routine purchases, some consumers choose to use a credit card rather than a debit card because a debit transaction can draw directly from a checking account. A separate low-balance account for routine debit-card spending can also limit exposure, but neither approach replaces alerts and prompt reporting. Account protections and liability rules depend on the payment method, account type, and facts.
If a suspicious transaction appears
- Contact the bank or card issuer immediately using the number on the card, official statement, or a website you navigated to independently.
- Ask whether you need to replace the card, account number, PIN, online-banking credentials, linked payment instructions, or all of them.
- Change online-banking credentials and check whether the attacker changed contact information or added a new device.
- Preserve statements, messages, confirmation numbers, case numbers, and written correspondence.
- Follow the institution’s written dispute process and keep proof of submission.
For unauthorized debit transactions, timing matters. CFPB guidance says consumers generally should report an unauthorized transaction within 60 days after the statement showing it becomes available when the card was not lost or stolen; the applicable rules can differ based on the facts and account type. Report suspected fraud immediately rather than waiting to see whether more transactions appear. See the CFPB’s guidance on watching bank accounts after card data is compromised.
6. Minimize exposure of your SSN and identity documents
When a business, school, doctor, landlord, or other organization asks for your SSN, ask:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- FAST DOCUMENT SCANNING — Document scanner with feeder allows you to speed through stacks with a 50-sheet Auto Document Feeder (ADF); Efficient office scanner to help you scan more productively
- INTUITIVE, HIGH-SPEED SOFTWARE — Quickly scan with this desktop document scanner; Epson ScanSmart Software lets you easily preview scans, email files, upload to the cloud, and more; Plus, automatic file naming saves even more time
- SEAMLESS INTEGRATION — Easily incorporate your data into most document management software with the included TWAIN driver; Office document scanner integrates seamlessly with business workflows
- EASY SHARING — Duplex scanner allows you to scan straight to email or popular cloud storage2 services like Dropbox, Evernote, Google Drive, and OneDrive for simple storage and sharing
- SIMPLE FILE MANAGEMENT — Scanner allows the creation of searchable PDFs with Optical Character Recognition (OCR) and convert scans to editable Word or Excel files effortlessly; Designed for home and office document scanning
- Why is the number needed?
- Is it legally required, or is it simply the organization’s standard form?
- Can another identifier be used?
- Would the last four digits be sufficient?
- How will the number be stored, who can access it, and how long will it be retained?
Do not carry your Social Security card, birth certificate, passport, or other identity documents routinely unless you need them. Keep SSN cards, passports, birth certificates, citizenship papers, military records, wills, tax records, and similar documents in a locked location. Remove unnecessary documents from your wallet, vehicle, desk, and unlocked files.
Shred financial, medical, tax, and identity documents before disposal instead of putting them intact in household trash. The FTC explains which documents to keep and which to shred. Before selling, recycling, or giving away a phone, computer, or other device, remove personal data and perform the manufacturer’s secure reset procedure. The FTC also provides phone-protection guidance.
Protect mail
- Remove mail from the mailbox promptly.
- Use USPS forwarding when you move.
- Take an unexpected USPS Change of Address Validation Letter seriously. If you did not submit the change, use USPS’s dispute process described in its Change of Address guidance.
- Consider paperless statements only after securing the related online account with a unique password and MFA.
7. Reduce public and people-search exposure
Limit combinations of information that help an impostor answer security questions or build a convincing profile. Be cautious about publicly displaying your full birth date, home address, personal phone number, email address, family relationships, pet names, childhood information, travel plans, and photographs of identity documents.
People-search sites compile information from public records, social media, and other sources. You may be able to opt out of individual sites, but an opt-out:
- May require identity verification.
- Does not erase public records.
- May not remove you from a relative’s or associate’s report.
- May need to be repeated because information can reappear.
The FTC explains how people-search sites sell information. For people experiencing stalking, domestic abuse, or another safety threat, prioritize safe contact methods and do not submit an opt-out request from a device or email account an abuser may monitor. A domestic-violence or victim-support organization can help plan safer account and address changes.
8. Protect tax, Social Security, and employment identity
Get an IRS Identity Protection PIN
As of 2026, any person with an SSN or ITIN who can verify their identity may request an IRS Identity Protection PIN, or IP PIN. It is a six-digit number that changes each year and helps prevent someone else from filing a fraudulent federal individual income-tax return using your information.
To enroll online, sign in to an IRS Online Account and use the Profile tab. The IRS offers continuous enrollment or one-time enrollment. If you enroll online, retrieve the new PIN each year through your IRS Online Account rather than expecting the mailed CP01A notice used in some situations.
The IP PIN is used with federal Forms 1040, 1040-NR, 1040-PR, 1040-SR, 1040-SS, and 1040-X. It does not replace a state tax PIN and does not protect credit accounts, bank accounts, medical records, employment records, or other uses of an SSN. A tax professional may use your IP PIN when filing but cannot request one on your behalf.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →If you cannot verify online, the IRS lists alternate options, including Form 15227 subject to its stated income limits—currently $84,000 for individuals and $168,000 for married couples filing jointly—or an in-person Taxpayer Assistance Center appointment. Form 15227 is for new enrollment, not for retrieving an already assigned PIN. If you lose an assigned PIN, use your IRS Online Account or the IRS reissue process described in the lost IP PIN guidance. The IRS will not request an IP PIN through an unsolicited call, email, text, or social-media message.
Create and protect your Social Security account
Create or verify your personal my Social Security account before someone else attempts to create one using your information. Current SSA users access the account through Login.gov or ID.me. Use a unique password and strong MFA, and navigate to SSA directly rather than through an unexpected message.
Rank #4
- Scanner type: Document
- Connectivity technology: USB
- With Auto Scan Mode, the scanner automatically detects what you're scanning
- Digitize documents and images
For people receiving benefits, SSA describes two relevant blocks:
- eServices block: prevents anyone, including the account owner, from viewing or changing personal information online.
- Direct Deposit Fraud Prevention block: prevents online or financial-institution changes to direct deposit or address information.
These blocks can make online account management less convenient, so understand how to remove or manage them before you need to make a legitimate change. SSA explains the blocks in its identity-protection guidance.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Review your earnings record
Review your Social Security earnings record for wages you did not earn. Unknown wages can indicate employment-related identity theft. If an employer or tax document shows wages you never received, follow the IRS guidance on employment-related identity theft and contact SSA about the incorrect earnings record.
9. Protect medical information
Medical identity theft can create both financial problems and inaccurate health records. Someone may use your health-insurance or Medicare number to obtain care, prescriptions, equipment, or services. Incorrect information can affect billing, available insurance benefits, and the medical history providers rely on.
- Protect health-insurance cards, Medicare numbers, prescriptions, medical bills, and patient-portal credentials.
- Review every Explanation of Benefits statement for providers, dates, services, prescriptions, and locations you do not recognize.
- Ask medical offices why they need your SSN and whether another identifier or only the last four digits will work.
- Access insurance and medical portals through a known website or saved bookmark, not an unexpected link.
- If you find fraud, request records from the provider, insurer, pharmacy, laboratory, or hospital.
- Dispute errors in writing and keep proof of delivery, copies, dates, and responses.
The FTC’s medical identity-theft guidance explains the records and dispute process.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.10. Special protections for children and servicemembers
Children and minors
A child can have an identity-theft problem before ever applying for credit. For a child under 16, contact Equifax, Experian, and TransUnion separately to request a child credit freeze. If the bureau has no file, it may create a protected record solely to freeze it. The parent or legal guardian must provide documentation proving identity and authority.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesUnder the FTC’s current guidance, a child aged 16 or 17 may request or remove a freeze personally. If you suspect misuse, ask each bureau to conduct a manual search for a credit file using the child’s SSN. A proactive child freeze is different from investigating an existing identity-theft incident.
Also safeguard school, sports, medical, camp, and childcare forms. Ask why an organization needs a child’s SSN or a copy of a birth certificate and whether a different identifier will work. The FTC explains how to protect a child’s identity.
Active-duty servicemembers
An active-duty fraud alert lasts 12 months and can be renewed. Creditors must take reasonable steps to verify the servicemember’s identity, and the alert removes the servicemember’s name from nationwide prescreened credit and insurance offers for two years. A deployed servicemember may designate a representative to answer verification calls or manage the alert. An active-duty alert is useful, but it does not replace a freeze, MFA, account alerts, or secure account-recovery information.
Older adults and caregivers
Older adults and caregivers should agree on a safe, documented process for handling financial calls, account changes, and urgent requests. Use alerts and, where a financial institution offers them, trusted-contact or transaction-review features. Never surrender control of passwords, MFA codes, or remote access because a caller claims to be a government agency, bank, technology company, or family member. A caregiver should use authorized access rather than sharing the account owner’s credentials.
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
- OUR MOST ADVANCED SCANSNAP. Large touchscreen, fast 45ppm double-sided scanning, 100-sheet document feeder, Wi-Fi and USB connectivity, automatic optimizations, and support for cloud services. Upgraded replacement for the discontinued iX1600
- CUSTOMIZABLE. SHARABLE. Select personalized profiles from the touchscreen. Send to PC, Mac, mobile devices, and clouds. QUICK MENU lets you quickly scan-drag-drop to your favorite computer apps
- STABLE WIRELESS OR USB CONNECTION. Built-in Wi-Fi 6 for the fastest and most secure scanning. Connect to smart devices or cloud services without a computer. USB-C connection also available
- PHOTO AND DOCUMENT ORGANIZATION MADE EFFORTLESS. Easily manage, edit, and use scanned data from documents, receipts, photos, and business cards. Automatically optimize, name, and sort files
- AVOIDS PAPER JAMS AND DAMAGE. Features a brake roller system to feed paper smoothly, a multi-feed sensor that detects pages stuck together, and skew detection to prevent paper damage and data loss
11. What to do after a data breach or lost wallet
A breach notice means information was exposed; it does not prove that fraud has already occurred. Treat the notice as a trigger for targeted action.
- Verify the notice independently. Find the organization’s known website or phone number. Do not use links or phone numbers in the notice until you confirm them.
- Identify what was exposed. An email address and password require different action from an SSN, driver’s-license number, financial-account number, health information, or authentication token.
- Change exposed passwords everywhere they were reused. Changing only the password at the breached company is not enough if the same password remains active elsewhere.
- Enable MFA or passkeys. Prefer a passkey, security key, or authenticator app over SMS for sensitive accounts.
- Freeze credit when SSN or financial identity information was exposed. Do not wait for a fraudulent account to appear.
- Review all three credit reports and check relevant bank, card, medical, tax, Social Security, and specialty-reporting activity.
- Contact affected institutions such as banks, card issuers, insurers, mobile carriers, or employers through verified channels.
- Use offered monitoring or recovery services if helpful, but remember that monitoring detects some changes after they happen; it is not a preventive barrier.
- Report confirmed misuse at IdentityTheft.gov.
For a lost wallet, contact the card issuers and bank immediately, replace compromised cards and identification, change any exposed credentials, freeze credit, and report the loss to the appropriate government agency. The FTC and IdentityTheft.gov provide a lost or stolen information response guide.
12. Recognize warning signs
Act promptly when you see:
- An unfamiliar account, collection, inquiry, address, employer, or credit-report change.
- A missing bill or an unexpected bill for a service you did not request.
- A small unexplained debit or unfamiliar bank transfer.
- A debt collector contacting you about a debt you do not owe.
- An Explanation of Benefits statement for care, services, or prescriptions you did not receive.
- Unknown wages, an unfamiliar employer, or a Social Security earnings discrepancy.
- An IRS notice about a duplicate return, a return you did not file, or another unexpected tax problem.
- An unexpected password reset, new device, address change, direct-deposit change, or MFA notification.
- A sudden and unexplained loss of mobile service.
- A USPS address-change validation letter you did not request.
IdentityTheft.gov lists additional warning signs of identity theft.
13. If identity theft has already happened
Switch from prevention to recovery. Do not wait for every detail before acting.
- Report the incident at IdentityTheft.gov. It provides a personalized recovery plan and documentation that may help with creditors.
- Place a credit freeze or fraud alert. Use a freeze for the strongest barrier against new credit. If you are a confirmed victim, ask about an extended fraud alert.
- Contact the company where the fraud occurred. Use its official fraud department, close or secure the affected account, and ask what evidence or affidavit it requires.
- Dispute fraudulent credit information with both the credit bureau and the company that supplied the information. Send copies, not irreplaceable originals, and keep proof of delivery.
- Secure the underlying access. Change reused passwords, terminate unknown sessions, replace compromised cards or account numbers, and protect the mobile-carrier account.
- For tax fraud, use the IRS’s Identity Theft Central guidance and request an IP PIN if eligible. Do not submit Form 14039 automatically merely because an SSN was exposed; follow IRS instructions for your circumstances.
- For employment fraud, contact the IRS and SSA about unknown wages and incorrect earnings records.
- For medical fraud, contact the provider and insurer, request records, and dispute inaccurate information in writing.
- For mail-related fraud, contact USPS and the Postal Inspection Service through official government channels.
- File a police report when necessary for safety, documentation, an insurer, or a creditor’s requirements.
Legal protections and reimbursement deadlines for unauthorized transactions vary by payment method, account type, and facts. Immediate reporting, detailed records, and written follow-up are safer than assuming a bank, insurer, or creditor will automatically reverse the loss.
Prevention, monitoring, and recovery are different
| Purpose | Examples | What it can and cannot do |
|---|---|---|
| Prevention | Credit freezes, unique passwords, passkeys, MFA, carrier locks, minimizing SSN exposure. | Reduces exposure or blocks some attacks before they succeed. It cannot eliminate all risk. |
| Monitoring | Credit reports, bank alerts, login alerts, EOB reviews, Social Security earnings reviews, tax notices. | Can reveal some changes after they occur. It does not prevent stolen information or guarantee detection of tax, medical, utility, employment, or account-takeover fraud. |
| Recovery | IdentityTheft.gov, creditor disputes, account replacement, IRS and SSA contacts, medical-record corrections. | Limits continuing damage and creates a documented path to correction after prevention has failed. |
A paid identity-protection service may combine monitoring, restoration assistance, case management, or insurance. Compare what is actually included, exclusions, renewal prices, cancellation terms, and which types of fraud are monitored. Identity-theft insurance generally covers certain recovery expenses; it should not be assumed to reimburse money stolen by a scammer.
A maintenance schedule that is realistic
Monthly
- Review bank, card, brokerage, and payment alerts.
- Scan transactions and pending activity.
- Review health-insurance EOBs.
- Check for login, password, address, phone, and direct-deposit changes.
Quarterly
- Review security settings for your primary email, phone, banking, tax, and Social Security accounts.
- Confirm that all three credit freezes remain active.
- Review people-search exposure and repeat opt-outs if you use them.
Annually
- Retrieve the new IRS IP PIN if you enrolled online.
- Review all three credit reports.
- Review insurance, employment, and specialty reports when relevant.
- Update recovery codes, trusted contacts, emergency instructions, and the secure record of account confirmations.
The FTC’s identity-theft resource hub, CFPB’s consumer-reporting guidance, and USAGov’s identity-theft overview are useful official references when a provider’s process changes.
Frequently Asked Questions
Does freezing my credit prevent identity theft?
No. A freeze is a strong, free barrier against many new-credit applications and does not lower your credit score, but it does not automatically protect existing bank or email accounts, phone or utility service, tax returns, medical records, employment records, or government benefits.
Should I freeze my credit after a data breach if I do not see fraud?
If the breach exposed your SSN, government ID number, financial-account information, or similar identity data, freezing all three major credit reports is a reasonable precaution even when there is no evidence of misuse. Also change exposed or reused passwords, enable MFA, and review your reports and accounts.
Is credit monitoring enough to protect my identity?
No. Monitoring can alert you to some changes after they occur, but it does not stop stolen information, account takeover, tax fraud, medical identity theft, employment fraud, or every new-account application. Pair monitoring with freezes, strong account security, and transaction alerts.
What should I do if my phone suddenly loses service?
Treat an unexplained loss of service as a possible SIM swap or port-out. Contact your mobile carrier immediately from another phone, restore control of the number, then secure your email, bank, brokerage, tax, and other critical accounts and review recent changes.
The Bottom Line
Start with the controls that protect the most important pathways: freeze Equifax, Experian, and TransUnion; secure your primary email, password manager, phone, bank, tax, and Social Security accounts; use unique credentials and phishing-resistant MFA where possible; request an IRS IP PIN; and turn on alerts. Then add the checks that a credit freeze cannot provide—bank transactions, credit reports, medical EOBs, Social Security earnings, tax notices, mail, and relevant specialty reports.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Layered protection cannot guarantee that identity theft will not happen. It can make impersonation harder, block many new-credit attempts, reveal suspicious activity sooner, and give you a clearer recovery path when prevention fails.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
