Identity Theft Protection: How to Safeguard Your Identity

Introduction

Identity theft occurs when someone uses your personal information — name, Social Security number, credit card number, driver’s license, or other identifiers — without your permission to commit fraud or other crimes. The consequences range from unauthorized credit card charges to fraudulent tax returns, medical identity theft, and criminal charges filed in your name.

In the United States alone, the Federal Trade Commission received over 1.1 million identity theft reports in 2023, with reported losses exceeding $10 billion. The true figure is almost certainly higher, as many incidents go unreported. The average victim spends approximately 200 hours and hundreds of dollars resolving identity theft over several months or years.

The good news: most identity theft is preventable with proactive measures. A credit freeze, strong authentication, careful document handling, and awareness of common attack methods dramatically reduce your risk. This guide covers prevention, detection, and step-by-step recovery procedures.

How Identity Theft Happens

Understanding the methods criminals use helps you target your defenses effectively.

Data Breaches

Data breaches are the most common source of identity theft. A company you do business with suffers a security breach, and your personal information — name, email, password, address, and sometimes Social Security number or financial details — is exposed. Major breaches at companies like Equifax, Target, Marriott, and Facebook have each exposed the personal data of hundreds of millions of people.

You cannot prevent data breaches at companies you trust with your data. What you can control is limiting how much data you share, using unique passwords for every account, and freezing your credit so exposed information cannot be used to open new accounts.

Phishing Attacks

Phishing remains one of the most effective attack methods. You receive an email, text message, or phone call that appears to be from a legitimate company — your bank, a shipping carrier, a government agency — asking you to verify your account, reset a password, confirm a payment, or update your information. The message contains links to a fake website designed to capture your credentials.

Spear phishing targets specific individuals with personalized messages that reference real information about their job, hobbies, or recent purchases. These attacks are harder to spot than generic phishing and often succeed against even security-conscious individuals. For a detailed guide on identifying these attacks, see How to Spot Phishing Emails.

Physical Theft

A stolen wallet provides a thief with your name, address, credit cards, and driver’s license number. Stolen mail can contain bank statements, tax documents, credit card offers, and pre-approved credit applications. Dumpster diving targets discarded documents containing personal information.

Social Engineering

A thief calls your bank, credit card company, or other service provider pretending to be you. Armed with personal details gleaned from social media, data breaches, or public records, they answer security questions and take over your account. Once they have access, they change the contact information and password, locking you out.

Account Takeover

Account takeover combines credential theft with social engineering. The thief obtains your username and password from a data breach or phishing attack. If you reuse passwords across services, they try the same credentials on your bank, email, and social media accounts. Once inside, they change the password, recovery email, and phone number, effectively stealing the account.

Prevention Steps

Freeze Your Credit

A credit freeze — also called a security freeze — prevents anyone from opening new credit accounts in your name. When your credit is frozen, a lender or creditor cannot access your credit report, which means they cannot approve new credit applications. This blocks identity thieves from opening credit cards, loans, or other accounts even if they have your Social Security number.

Freezing your credit is free under federal law. You must freeze your credit at each of the three major credit bureaus separately:

• Equifax: equifax.com/personal/credit-report-services
• Experian: experian.com/freeze/center.html
• TransUnion: transunion.com/credit-freeze

A credit freeze does not affect your existing accounts, credit score, or ability to use your current credit cards. You can temporarily lift the freeze — called a thaw — when you need to apply for new credit, then reinstate it when the application process is complete. Thaws can be set for a specific duration or a specific creditor.

Monitor Your Accounts

Even with a credit freeze, you need to monitor existing accounts for unauthorized activity.

• Check bank and credit card statements weekly for transactions you do not recognize. Small test charges — $1 to $5 — often precede larger fraudulent purchases.
• Review your credit report at AnnualCreditReport.com. You are entitled to one free credit report from each bureau every week. Stagger your requests — pull one report every four months for continuous monitoring at no cost.
• Set up transaction alerts for any charge over $0 or $1. Most banks and credit card issuers allow you to configure alerts by SMS, email, or push notification.

Secure Your Documents

Physical document security is an often-overlooked component of identity theft prevention.

• Shred documents containing personal information before discarding. Cross-cut shredders are more secure than strip-cut models. Shred credit card offers, bank statements, medical bills, and any document with your Social Security number or account numbers.
• Store important documents — Social Security card, passport, birth certificate, property deeds — in a fireproof home safe or bank safety deposit box.
• Opt out of pre-approved credit offers by visiting OptOutPrescreen.com or calling 1-888-5-OPTOUT. This stops credit card companies from sending pre-approved offers that identity thieves can steal from your mailbox.
• Request electronic statements from your bank, credit card companies, and other financial institutions to reduce the amount of sensitive mail arriving at your home.

Use Strong Authentication

Weak authentication is a primary enabler of account takeover.

• Enable two-factor authentication on every account that supports it. Use an authenticator app (Google Authenticator, Authy, or Microsoft Authenticator) rather than SMS-based codes when possible. For a detailed guide, see Two-Factor Authentication.
• Use unique passwords for every account. A password manager generates and stores strong random passwords so you never need to reuse credentials across services. See Password Manager Guide for recommendations.
• Never answer security questions truthfully. Security questions are a weak form of authentication. Use your password manager to generate and store random answers. “What was the name of your first pet?” should be answered with something like “F7k9#mQ2” rather than a real pet name.

Protect Your Social Security Number

Your Social Security number is the master key to your identity. Treat it with extreme care.

• Do not carry your Social Security card in your wallet. Memorize the number and store the card in a safe.
• Do not give out your SSN unless absolutely necessary. Ask if you can provide a different identifier — driver’s license number, employee ID, or a unique identifier generated by the organization.
• Ask why your SSN is needed and how it will be protected. Organizations that collect SSNs should provide clear answers about their data protection practices.
• Check your Social Security earnings statement annually at ssa.gov. This statement shows all reported earnings under your SSN and can alert you to fraudulent employment or benefit claims.

Warning Signs of Identity Theft

Early detection minimizes damage. Watch for these indicators:

• Unexplained bank withdrawals or credit card charges
• Collection calls for accounts you never opened
• Credit applications denied for no apparent reason
• Missing mail — bills, statements, or credit cards that do not arrive as expected
• Medical bills for services you never received
• IRS notice that more than one tax return was filed in your name
• Unexpected changes to your credit score
• Bills or statements addressed to someone else at your address

If you notice any of these signs, act immediately by following the recovery steps below.

What to Do If You Are a Victim

If you discover that your identity has been stolen, prompt action limits the damage and shortens the recovery process.

Step 1: Document Everything

Create a dedicated file — physical or digital — containing:

• The date and time you discovered the theft
• The accounts affected and the nature of the fraudulent activity
• Any fraudulent transactions, including amounts and dates
• Copies of communications with companies, credit bureaus, and law enforcement
• A log of every phone call with names, dates, and outcomes

Detailed documentation is essential for disputing fraudulent accounts and demonstrating to creditors that you were a victim rather than the perpetrator.

Step 2: Contact Affected Companies

Call the fraud department of each affected company. Close compromised accounts and open new ones with new account numbers, passwords, and PINs. Request written confirmation that the fraudulent accounts have been closed and that you are not liable for the charges.

Step 3: Place a Fraud Alert

Contact one of the three credit bureaus to place a fraud alert on your credit file. The bureau you contact is legally required to notify the other two.

• Equifax: 1-800-525-6285
• Experian: 1-888-397-3742
• TransUnion: 1-800-680-7289

A fraud alert lasts one year and requires businesses to verify your identity — typically by calling you at a number you provide — before opening new accounts. You can renew it annually. If you have already frozen your credit, the fraud alert provides an additional verification layer.

Step 4: File a Report with the FTC

Visit IdentityTheft.gov to create an official Identity Theft Report and a personalized recovery plan. The FTC provides a step-by-step process tailored to the specific type of identity theft you experienced, with pre-filled letters and forms for disputing fraudulent accounts.

Step 5: File a Police Report

File a report with your local police department. Bring your FTC Identity Theft Report, government-issued photo ID, proof of address, and any documentation of the fraud. A police report provides legal documentation that you were a victim of identity theft and may be required by some creditors or government agencies.

Step 6: File Complaints with Affected Agencies

If the thief used your identity in encounters with specific government agencies, file complaints directly:

• IRS Identity Protection Specialized Unit: 1-800-908-4490, if tax-related fraud occurred
• Social Security Administration OIG Fraud Hotline: 1-800-269-0271, if your SSN was used for employment or benefits fraud
• Department of State: 1-877-487-2778, if a passport was fraudulently obtained in your name

Identity Theft Protection Services

Commercial monitoring services track your credit, personal information, and the dark web for signs of identity theft.

Important caveat: No monitoring service can prevent identity theft. They can only alert you after there is evidence that your identity has been compromised. A credit freeze is more effective at preventing new account fraud than any monitoring service and costs nothing. Consider monitoring services as a supplement to — not a replacement for — a credit freeze.

FAQ

What is the difference between a credit freeze and a fraud alert? A credit freeze blocks all access to your credit report, preventing any new accounts from being opened. A fraud alert requires lenders to verify your identity before opening new accounts. A freeze is stronger and more effective. Use a freeze as your primary defense and a fraud alert as additional protection if you have been a victim.

How long does identity theft take to resolve? Simple cases involving credit card fraud may be resolved in a few days. Complex cases involving tax fraud, medical identity theft, or criminal identity theft can take months or years. The average victim spends approximately six months and 200 hours resolving identity theft.

Does identity theft protection insurance cover financial losses? Most identity theft protection services include insurance that covers out-of-pocket expenses — legal fees, notary costs, lost wages, and sometimes stolen funds. Policy limits typically range from $25,000 to $1 million. Review the specific policy details before purchasing, as coverage varies significantly between providers.

Can someone steal my identity without my Social Security number? Yes. Identity theft can occur with just your name, address, and date of birth — information that is widely available through public records, data breaches, and social media. A stolen credit card number alone constitutes financial fraud but not full identity theft. Social Security number theft enables the most damaging forms of identity theft.

What should I do if my child’s identity is stolen? Child identity theft is particularly damaging because it often goes undetected for years. Freeze your child’s credit at all three bureaus — each requires specific documentation, typically a copy of the child’s birth certificate, Social Security card, and proof of your guardianship. Monitor for suspicious mail addressed to your child. If fraud is discovered, follow the same recovery steps as adult identity theft.

For more on protecting your accounts, see Two-Factor Authentication Guide and Password Manager Guide. To secure your home network from intrusions, read Home Network Security Guide.