How to Protect Yourself From Identity Theft: 7 Smart Steps 2026

Identity theft is fraud that happens when someone uses your personal information, usually your name plus your Social Security number or date of birth, to open accounts, take out credit, make purchases or file taxes without your permission. To protect yourself from identity theft, freeze your credit at all three bureaus, turn on two-factor authentication everywhere it is offered, and put your accounts on a review schedule. The whole plan below takes about an hour to set up and roughly ten minutes a month to maintain.

Most people don’t need a paid service for that. A credit freeze costs nothing, takes a few minutes per bureau, and blocks the one thing thieves use your file for most often: opening new credit in your name. The gaps it leaves — existing accounts, your tax return, medical benefits — are why the later steps matter as much as the first one.

Last reviewed for 2026. Everything here follows Federal Trade Commission guidance and the rules at Equifax, Experian and TransUnion. Rules and eligibility vary by state, so check the current terms on each bureau’s site before you rely on a specific deadline.

Table of Contents

1. What You Need
2. Step-by-Step: How to Protect Yourself From Identity Theft
3. 1. Freeze or lock your credit reports
4. 2. Use strong authentication on financial accounts
5. 3. Reduce how much of your personal information is exposed
6. 4. Check accounts and statements on a fixed schedule
7. 5. Protect your devices, email and network
8. 6. Respond immediately when something looks wrong
9. 7. Report it and build a recovery plan
10. Common Mistakes
11. Frequently Asked Questions
12. What is the difference between a credit freeze and a fraud alert?
13. Does credit monitoring stop identity theft?
14. What should I do first if I see a transaction I do not recognize?
15. How can I check whether someone has opened an account in my name?
16. Should I place a freeze at all three credit bureaus?
17. What information can I ask a company to remove from my file?
18. Conclusion

What You Need

Before you start, gather these. The setup is much faster when everything is open in front of you.

• Your Social Security number and where you last used it, including your tax return, W-2 and any employment application.
• Contact details for all three bureaus: Equifax, Experian and TransUnion. Use the numbers published on their official sites, not ones from an email or a search ad.
• Your login credentials for email, your bank, your brokerage and your cell phone carrier account. Email is the master key — most account resets run through it.
• A list of your open accounts: cards, loans, utilities, subscriptions and the phone number for each fraud department.
• Your devices: the laptop or phone you normally bank from, plus its current system version.
• A place to record dates and reference numbers. A notebook or a plain text file works. Write down the date, the name of every person you speak to, and the case number they give you.

If you are responding to a data breach notice, add the breach letter itself to that list. It names the fields that leaked, and those fields tell you exactly which steps to prioritize.

Step-by-Step: How to Protect Yourself From Identity Theft

Seven steps, in this order. Freezing credit comes first because it is free and it stops the most common form of theft on its own; the later steps handle the cases a freeze cannot reach.

1. Freeze or lock your credit reports

A security freeze stops lenders from pulling your credit file without your permission. It does not stop someone with an existing account, and it does not touch your credit score. You place one separately with each bureau, it stays in place until you lift it, and it costs nothing in any state.

Go to each bureau’s freeze page directly — equifax.com, experian.com and transunion.com — and create an account. You will need to know where you lived for the past five years. Save the PIN or one-time passcode each bureau gives you; you need it to thaw the file later.

Then verify it actually landed. One person on Reddit called a bureau to check and was told no freeze was on file, which is a reported failure mode and not a rumor. Log back in at each bureau after a few days and confirm the freeze shows as active before you close the tab.

2. Use strong authentication on financial accounts

Turn on two-factor authentication for email first, then banking, brokerage and retirement accounts. If an attacker resets one password, email is where the reset code lands, so it is the account that protects all the others.

Use a password manager so every account has its own long password. Reused passwords are the single most common way one breach becomes ten: a leaked password from a shopping site gets tried against your bank. A password manager generates and stores a unique one for each login.

Prefer an authenticator app or a hardware key over SMS codes where your bank offers the choice. SMS fails when someone takes over your phone number. Skip security questions as a recovery method — mother’s maiden name and first pet are public or guessable, which is why they are weak.

3. Reduce how much of your personal information is exposed

Your Social Security number is the number thieves prize. Note the last four digits and keep the card out of your wallet unless you are at an office that requires it. Ask a company to redact it when it appears on an application or form.

Mail is still a real leak. Use a locked mailbox if you have one, and ask the post office to hold your mail while you travel. A stack of pre-approved credit card offers in an unlocked mailbox is a complete identity kit, and it arrives more often than people expect.

Shred anything with an account number, SSN or birth date on it, and buy a crosscut shredder rather than a strip shredder, which leaves readable strips. Data brokers are another route: they buy contact details and sell them to callers who pose as lenders. Opt out at the broker sites, and keep your social accounts private rather than posting birthdays, addresses and family details.

4. Check accounts and statements on a fixed schedule

Pick a cadence and stick to it. Most of the time that means ten minutes weekly and an hour or two once a year.

• Weekly: glance at card and bank transactions. Screenshot anything you do not recognize before disputing it.
• Monthly: download your free reports from AnnualCreditReport.com, which is the only site that gives you all three reports weekly at no cost. Look for accounts you never opened and hard inquiries you do not recognize.
• Quarterly: read the statement from every account that doesn’t generate one, including your 401k or IRA and any student loan servicer.
• Annually: file your taxes early and check for a notice that a return was filed in your name. Review every profile that has your address on it.

Three unfamiliar credit report accounts appearing together is a strong signal. One stray inquiry is often a lender you forgot about.

5. Protect your devices, email and network

Updates matter more than most people expect. Install operating system and browser updates on a schedule rather than when something reminds you, and run reputable antivirus software on anything that isn’t a phone or a Mac updated to the current version.

Treat unexpected calls and texts as hostile. Smishing uses your bank’s real name in the message; vishing uses a spoofed caller ID. The rule that ends most of it: hang up, wait a minute, and call the number printed on the back of your card. Never use a number the caller gave you.

Avoid financial transactions on public Wi-Fi at coffee shops and libraries. If you must, use your phone’s hotspot. Turn Bluetooth and near-field communication off when you are not actively using them.

When you dispose of an old phone, laptop or drive, wipe it properly rather than just resetting. A crosscut shredder handles paper; for electronics, use the manufacturer’s factory reset or a certified data destruction service.

6. Respond immediately when something looks wrong

Speed matters more than perfection. Here is the order.

1. Call the bank or card issuer on the number on the back of the card and ask them to close the card and open a new one.
2. Change the password on the affected account, then change your email password if email was involved.
3. Note the date, the representative’s name and the case number before you hang up.
4. Ask the bank to flag the account so the new card number is the only one that works.
5. Keep screenshots of every fraudulent charge. Disputes usually require proof, and rebuilding a timeline later is miserable work.

Don’t close an account without documenting the fraud first. Closing an account can erase the transaction history you need to win a dispute, and it may leave the debt with you anyway.

7. Report it and build a recovery plan

Start at IdentityTheft.gov, the FTC’s official site. You answer questions once, and it generates a personalized recovery plan with the specific forms, letters and contacts for each institution involved. Doing this by phone with each agency separately takes hours.

From there, file an Identity Theft Report at the FTC with the case number the site gives you. One document, by law, obliges participating companies to act on it.

File a police report when there’s been a physical loss, an account takeover or a breach at a specific company, and keep the report number. Then work the plan item by item: bureau dispute, bank escalation, IRS Form 14039 if a return was filed in your name, and an Equifax or Experian block for a flagged identity.

Set a calendar reminder to check each item every ten days. Recovery drags because each institution hands the problem to the next one.

Common Mistakes

Reusing passwords. One breach becomes several. A password manager fixes this in an afternoon.

Believing a freeze stops everything. A freeze blocks new credit. It does nothing about charges on cards you already hold, your bank login, your tax return or medical benefits. This is the most common misunderstanding out there.

Trusting paid monitoring as prevention. Consumer Reports has been blunt that these services do not prevent fraud, and much of what they offer you can be done free: alerts on your own accounts, your own weekly reports, and your own freeze. Where a paid plan earns its cost is cleanup help and insurance after an incident.

Ignoring unfamiliar mail. Pre-approved offers and notices from lenders you never used are early warnings. Junk mail is the normal channel for the first contact.

Posting too much publicly. Birthdays, graduation years, street numbers and family members’ names are the raw material for an opening in someone else’s name.

Closing accounts before documenting. Save the records first, then close.

Believing a freeze will ruin your chances of credit later. You lift it in minutes using the PIN you saved, and lenders still see your history when it’s on.

Never verifying the freeze registered. Log back into each bureau’s portal after a few days and check. This step takes two minutes and catches a silent failure.

Frequently Asked Questions

Conclusion

If you do three things this week, make them these. Place a free security freeze with Equifax, Experian and TransUnion, then log back in to confirm each one registered. Turn on two-factor authentication for your email, your bank and your brokerage, starting with email. Read your transactions once this week and pull your free reports at AnnualCreditReport.com so you know what your file looks like before something changes.

That baseline takes about an hour. It is free, it stops the most common form of identity theft outright, and it gives you a clear picture to compare against later if something does go wrong.