November 6, 2026
Updated: November 6, 2026
A plain-English checklist built on official US guidance, with what each step stops, what it misses, and what to do if your identity is stolen.
Mohammed Khalil
Learning how to prevent identity theft starts with a credit freeze at Equifax, Experian and TransUnion, followed by long unique passwords and multifactor authentication on your email and financial accounts, plus a PIN on your phone account. Next, get an IRS Identity Protection PIN, secure your mail and documents, and review your statements and credit reports regularly. No plan guarantees safety, because companies that hold your data can be breached. These steps make stolen data harder to use and help you catch misuse early, and most of them are free.
The FTC defines identity theft as someone using your personal or financial information without your permission. That can mean buying things, opening accounts, stealing a tax refund, getting a job or medical care, or even posing as you during an arrest.
The Social Security Administration describes how numbers get stolen: stolen wallets and mail, trash, unsecured websites, insiders selling records, and people posing by phone, email, text or social media as someone with a legitimate reason to ask. Some thieves go further. Synthetic identity fraud blends real and invented details into a new identity.
You can't control every route, because your data also sits with the organizations you deal with. So the practical goal has two parts: make your data hard to use, and notice quickly when someone tries.
A note on this guide: DeepStrike is a penetration testing company, not affiliated with the agencies or credit bureaus named here. We don't sell consumer identity protection products, and we describe categories rather than recommending brands. This is general information based on official US guidance, not legal or financial advice. For the numbers, see our identity theft statistics.
This order is our editorial suggestion: blocking steps first, then habits that catch what gets through. The steps themselves come from the official sources linked in each section below.
Start here
Next
Keep doing
If you care for a child or an older adult, apply the same steps for them using the section on family below.
These steps aren't interchangeable. A credit freeze does nothing for a stolen tax refund, and an IRS PIN does nothing for a stolen email account. This table shows why you need more than one.
| Control | What it helps with | What it doesn't cover |
|---|---|---|
| Credit freeze | New credit accounts opened in your name | Takeover of existing accounts, tax, job and medical identity theft |
| Fraud alert | Makes lenders verify your identity before new credit | Doesn't block access to your report; same gaps as a freeze |
| Long unique passwords and MFA | Account takeover, including password reuse after a breach | New accounts opened elsewhere with your details |
| Phone account PIN or password | Port-out scams that hijack your number | A carrier that gets tricked anyway |
| IRS Identity Protection PIN | Someone filing a federal return with your number | Credit, account and medical identity theft |
| E-Verify Self Lock | Job fraud at employers that use E-Verify | Employers that don't use E-Verify |
| Statement and report reviews | Detecting fraud early | They catch misuse rather than prevent it |
| my Social Security work history | Detecting someone working under your number | They catch misuse rather than prevent it |
A credit freeze is the strongest single step against new accounts. While it's in place, nobody can open a new credit account in your name, including you. It's free to place and lift, it lasts until you remove it, and it doesn't affect your credit score. Anyone can place one, even if their identity hasn't been stolen.
You have to contact each bureau separately. By law, a bureau must place a freeze within one business day of an online or phone request, and lift it within one hour. When you apply for credit, a job, an apartment or insurance, ask which bureau will be checked and lift the freeze only there.
| Tool | Cost | How long it lasts | How to set it up | Best for |
|---|---|---|---|---|
| Credit freeze | Free | Until you lift or remove it | Contact all three bureaus | Most people who aren't applying for credit soon |
| Initial fraud alert | Free | One year, renewable | Contact one bureau; it must tell the other two | Suspected exposure when you can't or won't freeze |
| Extended fraud alert | Free | Seven years | Contact one bureau with an FTC or police report | Confirmed identity theft victims |
| Credit lock | Often a fee, often bundled | Depends on the provider | Through a bureau's product | Rarely needed; the CFPB says locks are no more effective than freezes |
Active duty servicemembers can also place a free one-year active duty alert, renewable for the length of a deployment. To set up a freeze, type the addresses yourself or use the numbers listed on IdentityTheft.gov:
Two limits matter. A freeze doesn't stop thieves from taking over existing accounts, which is why Step 2 matters. And banks often use a separate screening report when you open a checking account. The CFPB says ChexSystems will freeze your report on request, if you want similar protection for deposit accounts.
Start with your email, because password reset links go there. CISA's password guidance gives the example of Emma, who reused one password on her bank and email, then couldn't reset her bank login because she was locked out of her email too. After email, move on to your bank, phone carrier, government and health accounts.
Account takeover doesn't need your credit data. It only needs a working login.
Your phone number often acts as a key, because many banks text security codes to it. In a port-out scam, a criminal uses your personal details to convince your carrier to move your number to a device they control, then tries to reset your accounts. Our SIM swap statistics cover the trend.
The FCC recommends four habits:
Sudden loss of service can be the first sign. If your phone goes dark, the FCC says to contact your phone company and your bank right away.
An Identity Protection PIN is a six-digit number that stops someone else from filing a federal return using your Social Security number. Anyone with a Social Security number or ITIN who can verify their identity can get one, even if they don't have to file, and parents can request one for dependents.
The fastest route is the IRS app or your IRS online account. Each PIN is valid for one calendar year and is generally available online from mid-January through mid-November. If you can't verify online, the IRS lists alternatives, including Form 15227 and in-person appointments.
The IRS will never ask for your IP PIN. A call, email or text asking for it is a scam. The IRS Identity Theft Central page covers the rest of tax identity theft.
The SSA says not to routinely carry your card, and to keep documents showing your number somewhere safe. When someone asks for your number, ask why they need it, how they'll protect it, and whether another identifier will work. The FTC notes that agencies, banks and employers won't call, email or text you to ask for it.
Two free tools add more protection:
Stolen mail is a route the SSA names, so follow the Postal Inspection Service's mail theft tips:
Informed Delivery is a free USPS service that emails you images of incoming letter mail, so you can notice when something expected doesn't show up. USPS verifies your identity at signup, and some apartment buildings aren't eligible.
At home, the FTC says to store financial records and ID cards safely, and to shred papers before throwing them out. You can also reduce preapproved credit offers at the industry's official OptOutPrescreen site, for five years online or permanently by mail.
Thieves often ask you for the data they need. The FTC's phishing guidance lists the usual signs: a generic greeting, a claimed problem with your account or payment details, an invoice you don't recognize, or a request to click a link. CISA adds that poor grammar is no longer a reliable sign, since AI can write flawless messages. Our guides to social engineering and spear phishing explain why these messages work.
The rule that defeats most of them: don't use the contact details in the message. Look up the company's number or website yourself, or use the number on your card or statement.
What about public Wi-Fi? Older advice often says to avoid it. The FTC's current position, from February 2023, is that it's usually safe, because most websites now encrypt your connection. The real risk is a fake site, since encryption doesn't protect you from the scammers running it. The FCC adds that you should check for imposter hotspots and consider your phone's data plan for sensitive tasks.
Our guide to your digital footprint covers how to reduce what you share online.
Check your credit reports at AnnualCreditReport.com, the site federal law authorizes. You can check each bureau's report once a week for free, and checking doesn't affect your score. Read your bank and card statements too, because card fraud won't always appear on a credit report.
Warning signs listed by the FTC include:
Should you pay for identity theft protection? The FTC says monitoring services may cost money and have gaps, and that identity theft insurance usually doesn't repay money stolen from you. Monitoring tells you about a problem after it starts, and you can check your credit reports yourself for free. If a company offers free monitoring after a breach, IdentityTheft.gov says to accept it.
A child generally won't have a credit report, so misuse of a child's number can go unnoticed. The FTC's child identity theft guidance covers the main steps:
Warning signs include a collection call for an account you never opened, a benefit denied because the number is already in use, an IRS letter about your child's income, or a student loan denied for bad credit.
The same checklist applies, and a family member can help set it up. Three steps are especially useful:
Someone using your insurance can leave errors in your medical records, not just a bill. Warning signs in the FTC's medical identity theft guidance include a bill or Explanation of Benefits for care you didn't get, and an insurer saying you've hit a benefit limit. Read every statement, shred paperwork, and black out information on items like prescription bottles. If you find errors, request your records and report the errors in writing. The provider must respond within 30 days. See our medical identity theft statistics.
A notice doesn't mean your identity has been stolen. It means your data was exposed, and the right response depends on what was exposed. This table condenses the IdentityTheft.gov guidance for lost or exposed information.
| What was exposed | What to do first |
|---|---|
| Social Security number | Check, freeze and monitor your credit; review your work history; consider E-Verify Self Lock; file taxes early |
| Password or login | Change it, change it anywhere you reused it, consider two-factor authentication |
| Debit or credit card number | Ask the issuer to cancel and replace the card; review transactions; update automatic payments |
| Bank or investment account | Tell the institution; close the account and open a new one; update automatic payments |
| Driver's license | Report it to your nearest DMV; the state may flag the number or suggest a duplicate |
| Passport | Report it to the US State Department |
| Medicare, Medicaid or insurance details | Report it to the program or insurer and order a replacement card if needed |
| A child's information | Request a free freeze for the child and ask each bureau whether a report exists |
Scammers pretend to be businesses you know, so use contact details you find yourself, such as the number on your card, not those in a message.
Act quickly, and write down who you contacted and when. The FTC's free IdentityTheft.gov site is built for this: it creates an Identity Theft Report and a recovery plan, and it can pre-fill letters for you. You can also call 1-877-438-4338. Spanish speakers can use RobodeIdentidad.gov.
The FTC's recovery steps run in this order:
A few situations need extra steps:
Thieves also get data from the organizations that hold it. If your company stores personal data or opens accounts, the same logic applies: make the data hard to reach, and make misuse hard to complete.
A penetration test doesn't guarantee that identity fraud can't happen, but it shows where your controls fail before a criminal finds out. DeepStrike's penetration testing services cover web and mobile applications and include social engineering simulations such as phishing and phone calls. To discuss scope, contact our team.
No single step covers everything. For most people, the strongest combination is a credit freeze at all three bureaus plus long unique passwords and MFA on email and financial accounts. The freeze addresses new credit, and MFA protects accounts you already have.
No. The FTC and CFPB both say a freeze doesn't affect your score. You can still use existing cards and check your own reports, but you'll need to lift the freeze before applying for new credit.
A freeze stops lenders from seeing your report, so new credit generally can't be opened. A fraud alert leaves your report visible but requires lenders to verify your identity first. You must contact all three bureaus for a freeze, but only one for an alert.
It depends on what you want. The core protections, including freezes, fraud alerts and weekly credit reports, are free. Paid services may add convenience and alerts, but the FTC warns they can have gaps, and they usually tell you about a problem after it starts.
No. Your data can be exposed through a company breach you have no control over. You can make that data much harder to use, and you can shorten the time between misuse and discovery, which limits the damage.
Pick one item today. We'd start with the credit freeze, then your email. Work through the rest at your own pace, then help a parent or child do the same. If something already looks wrong, go straight to IdentityTheft.gov.
Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.
Official sources were checked on November 6, 2026.
Stay secure with DeepStrike penetration testing services. Reach out for a quote or customized technical proposal today
Contact Us
