Enable multi-factor authentication on your bank, email, and phone accounts today, check your bank and credit card activity daily, and place a credit freeze if you suspect any exposure. Those three actions block the majority of the tactics thieves use to open accounts in your name. Identitytheft and the three major credit bureaus are your primary tools if something already went wrong. Everything below walks through how to do each step correctly.
TL;DR:
A credit freeze provides the strongest protection by blocking access to your credit file, but it requires lifting temporarily for new credit applications.
Enabling multi-factor authentication with authenticator apps or hardware keys drastically reduces the risk if passwords are stolen.
Regularly checking all three credit reports and setting recurring credit alerts helps detect unauthorized accounts early.
Recognizing common scam formats, such as urgent emails or texts requesting personal information, is essential to avoid falling victim.
Acting immediately by contacting banks, disputing charges, and reporting to authorities can limit damage and speed up recovery after identity theft occurs.
Table of Contents
Your Priority Checklist for Preventing Identity Theft
Most people treat identity protection as one big project. It works better as a short list of habits, split by how often you need to do them.
Daily habits:
-
Scan your bank and credit card app for transactions you don’t recognize
-
Bring in your mail promptly, or hold it at the post office when you’re traveling
Weekly or monthly habits:
-
Review full statements line by line, not just the balance
-
Check your credit report for new accounts or inquiries you didn’t authorize
-
Rotate passwords on your email, bank, and any account tied to money movement
One-time setup (do this once, then forget about it):
-
Freeze your credit at all three bureaus, or place a fraud alert if you’re not ready to freeze
-
Turn on multi-factor authentication everywhere it’s offered
-
Install a password manager and let it generate unique logins
-
Lock your Social Security card and other ID documents in a drawer or safe, not a wallet
A credit freeze is the strongest single move on this list, but it comes with a minor tradeoff: if you’re applying for a loan, a new credit card, or even a cell phone plan, you’ll need to lift it temporarily first. That takes minutes online or by phone, so it’s rarely a real obstacle.
Pro Tip: Set a recurring monthly calendar reminder labeled “credit check.” Fraud that sits unnoticed for 60 days is far harder to unwind than fraud caught in week one.
How Do Passwords and MFA Stop Identity Theft?
Stolen credentials are useless if a thief can’t get past a second layer. That’s the entire point of multi-factor authentication (MFA), and it’s the fastest upgrade on this whole list.
Start with a password manager like Bitwarden, 1Password, or the one built into your browser. Look for one that generates random, unique passwords for every site and syncs across your devices. Reusing a password means one leaked site can unlock your bank, your email, and your Amazon account with the same key.
For MFA, skip SMS codes when you can. Text messages can be intercepted through SIM-swapping scams. Authenticator apps (Google Authenticator, Authy) or a hardware key like a YubiKey are harder to defeat. Turn MFA on for email first, since email resets almost every other password you own.
Last step: open your account recovery settings on your bank, email, and phone carrier, and delete any old phone numbers or backup emails you no longer control.
Pro Tip: Your email account is the master key to your digital life. Secure it before anything else on this list.
Should You Freeze Your Credit or Place a Fraud Alert?
A fraud alert tells lenders to verify your identity before opening new credit. It’s free, lasts one year, and takes seconds to set up. A credit freeze is stronger: it blocks lenders from even accessing your credit file, which stops new accounts from being opened at all. Both are free to place and lift at Equifax, Experian, and TransUnion.
Use a fraud alert if you want light protection with no lifting hassle. Use a freeze if you suspect your data has actually been exposed, such as after a data breach notice. Alerts are useful for quick detection, but a freeze is the more reliable barrier against new-account fraud specifically because it stops the application before it starts.
Get your free reports at Annualcreditreport, the only federally authorized source, and check all three bureaus, not just one.
-
Fraud alert: free, one year, requires lender verification
-
Credit freeze: free, indefinite, blocks new account access entirely
-
Paid monitoring services: alert you after suspicious activity occurs but can’t prevent theft outright
Paid monitoring can be worth it if you want someone else watching your dark-web exposure, but it’s not a substitute for the free protections above, according to NerdWallet’s comparison of identity theft protection services.
How Do You Recognize a Phishing or Impersonation Scam?
Scammers rely on speed and panic. Slowing down is the single best defense you have.
Watch for these formats:
-
Email phishing — a message claiming your account is locked, with a link to “verify” your login.
-
Smishing — a text about a missed delivery or unpaid toll, asking you to click a link.
-
Robocalls and voice scams — a caller claiming to be from the IRS, Social Security, or your bank’s fraud department.
-
Social media impersonation — a fake profile of a friend or company asking for money or codes.
Red flags include urgency (“act within 24 hours”), pressure to stay on the phone, and any request for your Social Security number or a one-time passcode. The FTC notes that legitimate companies and government agencies rarely call or text demanding passwords or SSNs.
Verify independently: look up the company’s number yourself instead of using the one in the message, and hover over links to check where they actually lead before clicking anything.
Pro Tip: If a message creates urgency, that’s the scam working as designed. Close it, then contact the company directly using a number from their real website.
Securing Your Devices, Wi-Fi, and Physical Mail
Digital and physical exposure both matter. Keep your phone and computer software updated, turn on device encryption, and run reputable security software rather than skipping updates because they’re inconvenient.
At home, set a strong, unique Wi-Fi password and change the router’s default admin credentials. Avoid logging into banking apps on public Wi-Fi. Use a VPN if you must.
-
Shred anything with your Social Security number, account numbers, or full birthdate before tossing it
-
Store your Social Security card and passport in a locked drawer, not your wallet
-
Wipe devices completely before donating, selling, or recycling them
-
Use a locked mailbox or a PO box if your building’s mail area isn’t secure
-
Think before posting your birthday, address, or travel plans publicly
What Should You Do the Moment You Suspect Identity Theft?
Speed determines how much damage gets undone. Follow this order:
-
Call your bank and card issuers immediately to freeze or close compromised accounts and dispute unauthorized charges.
-
Change passwords on the affected accounts and anything sharing that password.
-
Report it at Identitytheft, which generates an official FTC Identity Theft Report and builds you a personalized, step-by-step recovery plan with prefilled letters.
-
File a local police report when the theft involves a specific crime, like a stolen wallet or a break-in.
-
Place an extended fraud alert or credit freeze with all three bureaus, not just one.
-
Send your Identity Theft Report and documentation to each credit bureau. Once received, credit reporting agencies must block fraudulent information within four business days.
-
Track every call and letter, and follow up until each item is actually removed, not just “under review.”
Many victims stop after contacting one bureau. That’s a mistake. Each bureau maintains a separate file, so you need to notify Equifax, Experian, and TransUnion individually for a freeze or a fraud dispute to fully take effect.
Scruteon’s Role in Ongoing Scam Awareness
Prevention isn’t a one-time task. Scruteon sends 1 to 2 free emails a week breaking down real, current scams the moment they start circulating, romance schemes, tech support fraud, elder targeting, so the checklist above stays current against tactics that didn’t exist last year.
What Happens After You Report Identity Theft?
Filing the report is the start, not the finish. Recovery often stretches over weeks as disputes work through each institution.
Once your Identity Theft Report is filed, follow up with each creditor and bureau in writing, not just by phone, and keep copies of everything you send. If a collections agency contacts you about a debt you didn’t incur, respond in writing citing your Identity Theft Report and request they stop reporting the account. Under federal rules, once a bureau receives your report and documentation, it has four business days to block the fraudulent item from your file, so don’t accept “60 to 90 days” as an answer if a representative tells you that.
If the theft involved a stolen passport or government ID, that adds a separate track: notify the issuing agency and watch for related scams. Fraudsters sometimes pose as expediting services to “help” replace stolen documents for a fee. Guidance on spotting passport expeditor scams is worth reading if you’re dealing with a stolen wallet or bag.
Beyond paperwork, check whether your bank or employer offers free identity restoration support, many do through insurance partnerships. If your credit score took a hit, dispute inaccurate items directly rather than paying a credit repair company, since disputes through the bureaus themselves are free. Keep monitoring your reports for at least a year after the incident closes, since fraudulent activity sometimes resurfaces months later once a thief resells your data on another list.
Emotional fallout is real too. Being targeted isn’t a reflection of carelessness, thieves run these schemes at scale, and support resources exist through the FTC and CFPB if the process feels overwhelming to navigate alone.
Why Speed Beats Perfection in Fraud Prevention
The gap between people who avoid real damage and those who don’t usually comes down to how fast they act, not how much they know. Enable MFA on one account right now, check your last week of bank statements, and you’ve already outpaced most identity thieves’ timelines.
— Winston
Get Free, Ongoing Scam Alerts From Scruteon
Scruteon costs nothing and asks nothing of you beyond an inbox. You get 1 to 2 short emails a week that flag the scam tactics actually circulating right now, written in plain language, no security jargon required to understand them.
The checklist in this article covers the fundamentals, but scam tactics shift constantly, phishing templates change, new impersonation scripts appear, fresh tech support scams target different software. Staying current on those shifts is exactly what the Scruteon newsletter is built for. If you ever get a message that feels off but you can’t quite pin down why, use the free advice channel to ask before you click, reply, or send anything. Sign up for the newsletter today and you’ll have a second set of eyes on your inbox going forward.
The information in this article is for educational purposes only. Scam tactics change fast, and we cannot guarantee that this information is always complete or up to date.