It usually starts with a piece of mail that makes no sense, like a welcome letter for a credit card you never applied for, or a notice from the IRS saying your tax return has already been filed, by someone who is not you. By then the damage is done, and the following weeks tend to disappear into phone calls and forms. Americans reported more than a million cases of identity theft to the FTC in 2024, a year in which consumers also reported losing $12.5 billion to fraud.
Most guides answer this with a list of twenty tips, all presented as equally important, which tends to leave people doing none of them. We would rather tell you what to do first, then what to add, so that an hour spent on this actually changes something.
Start Here: Freeze Your Credit
If you only do one thing after reading this, freeze your credit. Most identity theft that costs real money involves someone opening a new account in your name, whether a credit card, a loan or a phone contract, and every one of those lenders checks your credit file first. A freeze locks that file so the check fails and the application goes nowhere.
You have to do it separately with each of the three bureaus, Equifax, Experian and TransUnion, on their websites or apps. It has been free by federal law since 2018, it does not lower your credit score, and it does not affect the cards and loans you already have. When you need to apply for credit yourself, you lift the freeze online for a day or two and put it back afterwards, which is a small annoyance for a lot of peace.
People often ask whether a fraud alert would do the same job. It is lighter: a fraud alert asks lenders to verify your identity before approving anything, it lasts a year, and placing it with one bureau is enough because that bureau informs the other two. It makes sense right after a scare, for instance when you learn your data was in a breach, but the freeze is the setting we would leave on permanently.
Children deserve a mention here, because their identity theft can go unnoticed for years, until the first student loan application is turned down. Parents can freeze a child’s credit file directly with each bureau, even if the child has no file yet, and it costs nothing.
Lock Down Your Email and Your Phone Number
Once your credit is frozen, the next target is your accounts and the one that matters most is your email. Whoever controls it can reset the password of your bank, your Amazon account and almost everything else, so it deserves the strongest password you have and two-factor authentication.
That second factor works best through an authenticator app or a security key. Codes sent by text message are better than nothing, but they depend on your phone number, and phone numbers can be stolen. In a SIM swap, a fraudster convinces your carrier to move your number to a new SIM card, and from that moment every code meant for you arrives on their phone. The defense is a quick call to your carrier, or a visit to its app, to set up a port-out PIN or a number lock, which all three big carriers now have.
A password manager takes care of the rest, since it lets you use a different long password on every site without remembering any of them. That matters because breaches are constant, and a password reused on ten sites turns one leak into ten. On public Wi-Fi, we would avoid logging into your bank at all, or use a VPN if you have to.
Protect Your Social Security Number
Your Social Security number (SSN) is the master key in the American system, and the simplest step is to stop carrying the card. Leave it at home with your passport, and when a form asks for the number, at a doctor’s office for instance, ask whether it is really needed.
The IRS has a tool that too few people know about. Anyone who can verify their identity online can request an Identity Protection PIN, a six-digit code that changes every year and has to appear on your tax return. Without it, a return filed in your name is rejected, which shuts down one of the most common frauds of the tax season.
Here is a related tip that most guides skip. Fraudsters sometimes create online accounts at the IRS or the Social Security Administration in someone else’s name, then use them to redirect refunds or benefits. If you create your own accounts first, on IRS.gov and SSA.gov, that door is closed, and you can see your records whenever you like.
Two smaller steps finish the job. You can place a free security freeze with ChexSystems, the agency that banks consult when someone opens a checking account, since a credit freeze does not cover that. And you can stop prescreened credit card offers, which are a gift to anyone going through your mail, at OptOutPrescreen.com, the official site run by the credit bureaus.
The Offline Habits That Still Matter
A surprising share of identity theft still begins on paper. Bank statements, medical bills and those prescreened offers carry your name, your address and sometimes account numbers, so they belong in a shredder and not in the recycling bin. If your mailbox does not lock, the Postal Service’s free Informed Delivery service shows you each morning what is due to arrive, so you notice when something goes missing.
The phone is the other weak point. Banks, the IRS and Medicare do not call to ask for your Social Security number or a code they just texted you, so a caller who does is not who they claim to be. The safest reflex is to hang up and call back on the number printed on your card or on the official website.
Keep an Eye on Things
Prevention reduces the risk, and monitoring catches what gets through. The free part is generous: you can download your credit reports from all three bureaus every week at AnnualCreditReport.com, the official site, and a glance every few months is enough to spot an account you do not recognize. Turning on transaction alerts in your banking and card apps does the same job in real time, because you are told about a purchase the moment it happens.
Paid identity theft protection services add credit and dark web monitoring, and above all insurance and help with recovery. They do not prevent theft, and a freeze does more for prevention than any of them, but the recovery help has real value when cleaning up can take months.
Where Data Brokers Fit In
There is a question most identity theft guides leave aside, which is where fraudsters find the details they need in the first place. Breaches are one source. Data brokers are another, and a much more convenient one, because they sell profiles that include exactly what a thief uses to pass security questions or write a believable phishing email: your date of birth, every address you have had, your phone numbers and the names of your relatives.
Some of these brokers are people-search sites that anyone can check. Others are private-database brokers that trade credit, income and financial information, and those you cannot even search. You can send each of them a deletion request yourself, which is free and takes around ten minutes per broker, and our guide to removing your personal information from the internet explains how. The difficulty is that there are hundreds of them, and that they put your details back after a few months.
This is the part we would hand to a removal service, and the one we recommend, at the top of our ranking of the best data removal services, is Incogni. You enter your name and address, add up to three email addresses, home addresses and phone numbers, and sign an authorization form, and from there it sends deletion requests to more than 420 data brokers, people-search sites and private databases alike.
We used it on our own profile for almost four months. In that time it sent 107 requests to 44 brokers, closed 102 of them and got us onto 17 suppression lists, which means those brokers should not rebuild the file. The Unlimited plan also includes an exposure scanner that looks for your details on other sites, custom removals for the pages it finds, and a privacy score updated every 30 days. Ours was 54 out of 100, with five sites still listing a home address, so the work was clearly not over (check out our Incogni 2026 review here).
The Standard plan costs $95.88 per year, or $7.99 a month, Unlimited costs $179.88 per year, and every plan has a 30-day money-back guarantee.
Remove Your Data From Brokers With Incogni
For US residents who want monitoring and recovery in the same subscription, Incogni also sells a plan called Protect, at $248.88 per year, or $20.74 a month. It includes everything in Unlimited, plus identity protection from its partner Coveron: credit monitoring with alerts, dark web monitoring for your email, Social Security number, phone and card numbers, and a case manager who handles the restoration work if your identity is stolen. It also comes with up to $1 million in identity theft insurance, except for residents of New York and Washington, and up to $10,000 toward losses from online scams.
If Your Identity Has Already Been Stolen
Speed matters more than perfection here. Start by freezing your credit with the three bureaus, or at least placing a fraud alert, so that the thief cannot open anything else while you sort things out. Then write down what you know: which accounts, which dates, which letters or calls tipped you off.
The next stop is IdentityTheft.gov, the FTC’s site, where you report what happened and get a personalized recovery plan, along with pre-filled letters for the companies involved. Contact those companies directly to close the fraudulent accounts, change the passwords on anything that may be exposed, and file a police report if a creditor asks for one.
The Order We Would Follow
If you have an hour this week, freeze your credit with the three bureaus, then secure your email with an authenticator app and ask your carrier for a number lock. Next weekend, request your IRS Identity Protection PIN, create your IRS and Social Security accounts, and opt out of prescreened offers.
After that, it becomes a matter of reducing what is out there about you and watching for anything odd. Free credit reports and bank alerts take care of the watching. For the data brokers, you can send the requests yourself or let Incogni do it on a schedule, and if you want insurance and recovery help in the same place, Protect covers that too.
Start Protecting Your Identity With Incogni
FAQ
What Is the Single Most Effective Way to Prevent Identity Theft?
Freezing your credit with Equifax, Experian and TransUnion. It is free, it does not affect your credit score, and it stops anyone from opening a new credit account in your name until you lift the freeze yourself.
Should I Freeze My Credit or Put On a Fraud Alert?
A freeze is stronger, since it blocks new credit outright, while a fraud alert only asks lenders to check your identity before approving an application. A fraud alert makes sense right after a scare, and a freeze is the better long-term setting.
How Can I Protect My Identity Online?
Use a password manager, turn on two-factor authentication with an authenticator app, and protect your email account first, because it can reset everything else. Ask your carrier for a number lock, and avoid logging into sensitive accounts on public Wi-Fi without a VPN.
How Can I Protect My Identity for Free?
Most of the protection is free: credit freezes, fraud alerts, an IRS Identity Protection PIN, weekly credit reports from AnnualCreditReport.com, bank alerts and opt-outs from prescreened credit offers. Removing your details from data brokers is free too if you send the requests yourself.
What Should I Do If My Identity Is Stolen?
Freeze your credit or place a fraud alert, write down what happened, and report it at IdentityTheft.gov, which builds a recovery plan and the letters you need. Contact the companies where the fraud took place, and file a police report if a creditor asks for one.