How to Protect Yourself From Identity Theft: Free Steps First

Identity theft rarely starts with a movie-style hack. It starts with a stolen password that gets reused, a Social Security number from a breach, a convincing text from “your bank,” or a piece of mail taken from a mailbox. Then someone opens a credit card, files a tax return or drains an account in your name.

You’ll see plenty of ads for identity theft protection services promising to keep you safe. Some are useful. But the steps that actually prevent most identity theft are free, and many people pay for a service without ever doing them.

This guide starts with the free protections, in order of impact, then explains what paid services do, what they don’t, and who might find them worth the cost.

The most common types of identity theft

Knowing what thieves do helps you decide where to focus.

• New account fraud: opening credit cards, loans or phone plans in your name.
• Existing account takeover: getting into your bank, email, shopping or social media accounts.
• Tax identity theft: filing a tax return with your Social Security number to collect a refund.
• Medical identity theft: using your insurance to get care or prescriptions.
• Government benefits fraud: claiming unemployment or other benefits in your name.
• Child identity theft: using a child’s clean credit history, often undetected for years.

The FTC lists the early warning signs: bills that stop arriving, charges or bills you don’t recognize, bank withdrawals you didn’t make and accounts on your credit report you didn’t open.

The free protections, in order of impact

Start here. These 5 steps cost nothing and block the most common forms of identity theft.

Free step 1: Freeze your credit

A credit freeze is the single most effective protection against new account fraud. It blocks lenders from viewing your credit report, so most new credit can’t be opened in your name.

• It’s free to place and lift under federal law.
• You must contact each of the 3 bureaus: Equifax, Experian and TransUnion.
• It doesn’t affect your credit score or existing accounts.
• Lift it temporarily, usually online in minutes, when you apply for credit.
• Freezes for children under 16 are also free and stay in place until you remove them.

You can also place a free fraud alert, which tells lenders to verify your identity first. It lasts 1 year, and you only need to contact one bureau.

Free step 2: Secure your accounts

Most existing account takeovers start with a reused or phished password.

1. Use a unique password for every account. A password manager does the remembering for you.
2. Turn on multi-factor authentication for email, banking, shopping, social media and your phone carrier account.
3. Prefer passkeys or an authenticator app over text message codes where offered. Our guide to passkeys explains why they resist phishing.
4. Protect your email above everything. It’s the reset button for every other account.
5. Add a port-out PIN or number lock with your mobile carrier to protect against SIM swaps.

Free step 3: Lock down your tax and government records

• Get an IRS Identity Protection PIN. Anyone with a Social Security number or ITIN who can verify their identity can request one through their IRS online account. It must be on your return, so a thief can’t file in your name without it. It changes every calendar year.
• Create a my Social Security account at ssa.gov so a criminal can’t create one for you. Review your earnings history once a year.
• Shred tax documents, bank statements and medical paperwork before throwing them away.

Free step 4: Monitor your own credit and accounts

Paid credit monitoring mostly automates something you can do yourself.

• Check your credit reports for free every week at AnnualCreditReport.com, the official site. The 3 bureaus made free weekly reports permanent in 2023.
• Turn on transaction alerts with your bank and card issuers for every purchase or withdrawal above a low amount.
• Read medical explanation of benefits statements for care you didn’t receive.
• Sign up for USPS Informed Delivery to see images of incoming mail and notice if something goes missing.
• Opt out of prescreened credit offers at OptOutPrescreen.com, the official site run by the bureaus, to cut the number of preapproved offers in your mailbox.

Free step 5: Learn the scams that steal identities

Your information is often handed over voluntarily to someone who sounds legitimate.

• Assume unexpected calls, texts and emails are suspicious, even when they show your bank’s name. The FTC notes that the IRS, your bank and your employer won’t call, email or text you asking for your Social Security number.
• Hang up and call back using the number on your card or the official website.
• Watch for AI voice clones and fake videos of family members asking for money. Our guide on how to spot a deepfake covers the warning signs.
• Cut down robocalls by using your carrier’s call-blocking tools and your phone’s spam filter.
• Ask why whenever someone requests your Social Security number, and whether the last 4 digits or another ID will do.

Key takeaway: A credit freeze, unique passwords with MFA and an IRS IP PIN block the 3 most common forms of identity theft. All 3 are free and take about an hour combined.

What paid identity theft protection services do

Paid services usually bundle 4 types of help. The FTC describes each one, and they work very differently.

A few points to keep in mind:

• Monitoring is after the fact. An alert tells you something happened. A freeze stops it from happening.
• Coverage claims vary. Read the policy limits, deductibles and exclusions before you buy. The FTC has taken action against identity theft protection companies over misleading marketing.
• Pricing varies widely by plan, family size and features, usually as a monthly or annual subscription. Compare what’s included against the free steps above.

Who might find a paid service worth it

Paid services make the most sense when convenience and recovery help matter more than the cost.

• People who won’t keep up with manual checks. Automated alerts are better than no monitoring.
• Families managing several people’s credit, including children and older parents.
• Recent breach victims who are offered free coverage. Take the free offer.
• People who want hands-on recovery help if the worst happens, and would rather pay than handle letters and calls themselves.

Before paying, check whether you already have coverage. Some banks, credit cards, employers and home insurance policies include identity theft monitoring or recovery services.

Where to start this week

1. Freeze your credit at Equifax, Experian and TransUnion.
2. Turn on MFA for your email, bank and phone carrier account.
3. Request an IRS Identity Protection PIN.
4. Set transaction alerts on every bank and card account.
5. Put a monthly reminder on your calendar to pull a free credit report.
6. Decide whether a paid service adds anything you won’t do yourself.

If you’ve already received a breach notice, follow our step-by-step guide on what to do after a data breach. Wondering if a VPN belongs on this list? See do you need a VPN for an honest look at what it protects.

If it happens anyway

Report identity theft at IdentityTheft.gov, the FTC’s official site. It builds a free personal recovery plan and creates pre-filled letters for credit bureaus, businesses and debt collectors. Contact the companies where fraud happened, dispute errors with the bureaus and keep records of every call and letter.

The bottom line

You don’t need to spend money to be well protected against identity theft. Freeze your credit, secure your accounts, lock down your tax records and keep an eye on your statements. Paid services can add convenience and recovery support, but they work best on top of the free steps, not instead of them.

Sources

• FTC: What To Know About Identity Theft — warning signs, prevention steps and what paid protection services do and don’t cover
• FTC: What To Know About Credit Freezes and Fraud Alerts — free credit freezes, fraud alerts and child freezes
• IRS: Get an Identity Protection PIN — IP PIN eligibility and annual renewal
• FTC Consumer Advice: Credit reports are free every week — permanent free weekly credit reports
• IdentityTheft.gov — official reporting and recovery plans