Every 4.9 seconds, someone in the United States becomes a victim of identity theft. That’s not a future threat — it’s happening right now, to people who thought they were being careful. The FTC received over 1.1 million identity theft reports in 2024, a 9.5% jump from the year before, and financial losses topped $12.5 billion.
Here’s what the data tells us: most victims don’t get hit because they made one big mistake. They get hit because they left a handful of small doors open — doors that identity thieves know exactly how to walk through.
This guide covers the seven moves that make you genuinely hard to target. Not because they’re secret, but because most people never actually do them.
Move 1: Freeze Your Credit at All Three Bureaus
This is the single most effective thing you can do — and almost nobody does it until after they’ve been robbed.
A credit freeze blocks any new lender from accessing your credit file. No access, no new accounts opened in your name. It’s free, it doesn’t affect your credit score, and it doesn’t expire until you lift it. Under federal law (the Economic Growth, Regulatory Relief, and Consumer Protection Act), all three bureaus are required to offer it at no charge.
The catch most people don’t know: you have to freeze all three bureaus separately. A freeze at Equifax does nothing at Experian or TransUnion. Here’s where to go:
| Bureau | Website | Phone |
|---|---|---|
| Equifax | equifax.com/personal/credit-report-services/credit-freeze | 1-888-298-0045 |
| Experian | experian.com/help/credit-freeze | 1-888-397-3742 |
| TransUnion | transunion.com/credit-freeze | 1-800-916-8800 |
Each takes under 10 minutes online. When you need to apply for credit, you lift the freeze temporarily at the bureau the lender uses — it goes back on automatically after your window closes. If you have children, freeze their credit too. Kids’ Social Security numbers are prime targets because they have no existing credit activity to trigger alerts.
Move 2: Check Your Exposure Right Now
Identity thieves are often working with information they bought months or years ago. You may already be in multiple breach databases without knowing it.
The fastest free check: go to haveibeenpwned.com and enter your email address. It searches hundreds of confirmed breach databases and tells you exactly which ones included your account. Run every email address you use — including old ones you barely check anymore.
If your email shows up in a breach, assume every password you used on that site is compromised, even if the breach only exposed hashed passwords. Crackers have tools that reverse most common hash formats quickly.
For ongoing monitoring, Google’s built-in Password Checkup (in Chrome settings or Google Password Manager) automatically flags saved passwords that have appeared in known breaches. It’s not a full identity monitoring service, but it catches the most common vector — reused, stolen passwords — at no cost.
Move 3: Stop Reusing Passwords
This one is painful to hear because fixing it takes effort. But credential stuffing — where attackers take logins stolen in one breach and automatically test them across hundreds of other sites — is one of the most industrialized forms of identity theft running today. In 2025, over 1.8 billion login credentials were stolen from infected devices and sold on dark web markets, according to data from Recorded Future.
If you use the same password on two sites and one of them gets breached, both are now compromised. Attackers don’t manually try your credentials — they run automated tools that test millions of combinations per second.
The fix: a password manager. Pick one (Bitwarden is free and open-source; 1Password and Dashlane are solid paid options), let it generate a unique 20-character random password for every site, and never reuse anything again. You only need to remember one master password.
Move 4: Turn On Two-Factor Authentication Everywhere
A strong, unique password stops most attacks. Two-factor authentication (2FA) stops almost everything else.
When 2FA is enabled, even if someone has your exact username and password, they still can’t log in without a second code — one that expires in 30 seconds and only appears on your phone or hardware key. Enable it on every account that holds money, medical records, email, or anything tied to your identity.
Prioritize in this order:
- Email (attackers who own your email can reset everything else)
- Banking and financial accounts
- Social Security Administration (create a my Social Security account at ssa.gov and enable 2FA there to block fraudulent benefit claims)
- Apple ID / Google Account
- Any account storing payment info
Authenticator apps (Google Authenticator, Authy, Microsoft Authenticator) are more secure than SMS codes. SMS can be intercepted through SIM-swapping attacks, where a thief convinces your carrier to transfer your number to their device. App-based 2FA doesn’t have this weakness.
Move 5: Delete the Digital Trail You Don’t Need
You’ve probably forgotten about dozens of accounts you created years ago — old e-commerce sites, apps you used once, forums you signed up for. Each one is a potential breach vector. And many of them hold your email, password, and possibly your address or payment details.
Data brokers are a separate problem. These are companies that aggregate your personal information from public records, loyalty programs, and other sources, then sell it to anyone who pays. Marketers buy it. But so do people trying to find your address, phone number, or enough details to answer your security questions.
To start trimming your exposure: use JustDeleteMe to find deletion instructions for hundreds of services. For data brokers specifically, tools like DeleteMe or Kanary automate the opt-out process (it’s tedious to do manually since there are hundreds of brokers). Even if you can’t remove everything, shrinking your profile makes targeted attacks harder.
Move 6: Recognize How Thieves Actually Get Your Information
Most people imagine identity theft as a hacker in a hoodie targeting them specifically. The reality is more mundane — and more preventable.
The most common methods in 2026:
Phishing remains the top entry point. A convincing email, text, or call pretends to be your bank, the IRS, or a delivery company. You click a link, enter your credentials, and they’ve got everything they need. The AI-enhanced voice cloning scams making headlines lately are a newer variation — a caller sounds exactly like your bank’s fraud department, or even a family member.
Data breaches are largely out of your control — you can’t stop a company from getting hacked. But you can limit damage by using unique passwords and monitoring for breach notifications. The ITRC recorded 3,322 data compromises in 2025 alone, a 79% jump over five years, generating nearly 140 million victim notices in just Q1 of 2026.
Social engineering exploits information you’ve made publicly available — your birthday on Facebook, your employer on LinkedIn, your dog’s name in your Instagram bio. That’s often enough to answer security questions and reset account access.
Mail theft is old-fashioned but still real. Checks, pre-approved credit card offers, and bank statements in physical mailboxes remain targets. If you’re not on paperless statements already, switch now.
Knowing these vectors helps you spot attempts before they succeed. When something feels slightly off — an unexpected urgency, a link that almost looks right — slow down. Legitimate institutions don’t pressure you to act within minutes.
Move 7: Know the Signs Before the Damage Is Done
Catching identity theft early dramatically limits the damage. The problem is that most people don’t find out for months, because thieves often hold stolen information before using it — waiting for breach alerts tied to the original incident to expire.
Watch for these signals:
- Unexpected hard inquiries on your credit report — someone applied for credit using your information
- Bills or collection notices for accounts you never opened
- A tax return rejection because someone already filed using your Social Security number
- Your health insurer denying a claim because “you’ve already met your deductible” — for treatment you didn’t receive
- Login notifications or password reset emails you didn’t request
You’re entitled to one free credit report per year from each of the three bureaus at AnnualCreditReport.com — the only federally authorized site for this. Stagger your checks (one bureau every four months) to get year-round coverage at no cost.
If you find something wrong, file a report at IdentityTheft.gov. The FTC’s site generates a personalized recovery plan and pre-filled letters for disputing fraudulent accounts, which significantly speeds up the cleanup process.
The Honest Summary
You can’t make yourself completely immune to identity theft. Data breaches happen to companies you trusted, and you have no control over that. What you can control is how much damage a breach can cause and how quickly you catch it.
The seven moves above remove the easiest opportunities: they freeze new credit in your name, surface compromised credentials before attackers use them, eliminate reused passwords that make one breach into twenty, and shrink the personal information available to anyone trying to piece together your identity.
None of these take more than an afternoon to set up. For most people, the hardest part is starting. Start with the credit freeze — it takes about 30 minutes to complete all three bureaus — and work down the list from there.
Does a credit freeze hurt your credit score?
No. A credit freeze has zero impact on your credit score. It simply blocks new lenders from pulling your file, which prevents new accounts from being opened in your name. Your existing accounts, payment history, and score are completely unaffected. You can lift the freeze temporarily whenever you need to apply for credit, then re-freeze afterward.
How do identity thieves get your Social Security number?
The most common sources are data breaches at companies that stored your SSN (healthcare providers, insurers, government agencies), phishing emails or calls that trick you into entering it, mail theft from physical statements or pre-approved offers, and dark web purchases of previously stolen data. Children’s SSNs are particularly targeted because they’re unused and generate no fraud alerts. Once your SSN is out, it doesn’t expire — thieves can use it years after the original theft.
What’s the difference between a credit freeze and a fraud alert?
A credit freeze completely blocks new creditors from accessing your file without your explicit permission. A fraud alert lets creditors access your file but flags it as potentially compromised, asking them to take extra verification steps. Fraud alerts are easier to set up (placing one at any bureau automatically notifies the other two), but they’re weaker protection — a lender can still technically proceed without verifying your identity. For most people, a freeze at all three bureaus is the stronger choice.
How long does identity theft recovery typically take?
Recovery time varies significantly depending on how quickly the theft is caught and how many accounts were affected. Simple cases — a single fraudulent account caught early — can often be resolved in a few weeks. Complex cases involving multiple fraudulent accounts, tax fraud, or medical identity theft can take six months to two years and hundreds of hours of documentation. Early detection through credit monitoring and regular credit report checks is the most reliable way to keep recovery manageable.
Is it worth paying for an identity theft protection service?
It depends on your situation. The core protections — credit freezes, breach monitoring via Have I Been Pwned, free annual credit reports, and 2FA on your accounts — are available at no cost and cover the most common attack vectors. Paid services add convenience (automated monitoring, faster alerts, one place to manage everything) and identity theft insurance that covers recovery costs. If you’ve already been a victim, handle sensitive financial transactions frequently, or simply want the insurance coverage and dedicated restoration support, paid services like Aura, LifeLock, or Identity Guard are worth considering. If you’re willing to do the manual steps yourself, free tools get you most of the way there.