Identity theft has a way of arriving quietly. There is no break-in and no alarm, only a letter weeks later about a loan you never applied for, a tax return that has already been filed or a medical bill for a clinic you never visited. Prevention is therefore a game of closing doors in advance. The good news is that a short list of steps stops the large majority of attempts, and most of them are free. This guide gives twelve of them, in the order that delivers the most protection for the least effort, updated for what criminals and agencies are doing in 2026.
1. How identity theft actually happens
Identity thieves need a few ingredients: your name, a date of birth, a Social Security number, an address and a way to pass verification. They get them from breaches, phishing messages, stolen mail, public records and data broker profiles. The FBI’s Internet Crime Complaint Center received 31,675 identity theft complaints in 2025 and 67,456 personal data breach complaints, with personal data breaches alone accounting for about $1.3 billion in reported losses (FBI IC3). Those figures cover only people who reported to that center. Broader fraud, including imposter scams, drove the FTC’s total of $15.9 billion in reported consumer losses for 2025 (FTC).
If you want the fundamentals, start with what identity theft is and online personal information and identity theft.
2. The 12 steps
Step 1: Freeze your credit at all three bureaus
A security freeze stops lenders from viewing your file to approve new credit, which blocks most account-opening fraud. It is free by federal law, takes about ten minutes per bureau and does not affect your score. You can lift it temporarily when you need credit. See what a credit freeze is.
Step 2: Get an IRS Identity Protection PIN
Anyone with an SSN or ITIN who can verify their identity can request an IP PIN, and parents or guardians can request one for dependents. The fastest route is your IRS online account, with alternatives that include Form 15227 or an in-person appointment at a Taxpayer Assistance Center (IRS).
Step 3: Use unique passwords and a password manager
Reused passwords turn one breach into many. A password manager generates and stores a different password for every account, and it will not fall for lookalike login pages.
Step 4: Turn on two-factor authentication everywhere that matters
Prefer an authenticator app, a passkey or a hardware security key over text messages, which can be intercepted by SIM-swap attacks. Start with email, banking, mobile carrier and cloud storage.
Step 5: Lock your mobile carrier account
Add a PIN or passcode to your wireless account and ask for port-out protection. This blocks criminals from moving your number to a new device. Learn more in how to remove your phone number from the internet.
Step 6: Protect your mail
Stolen mail supplies pre-approved offers, statements and checks. Collect mail promptly, use a locking mailbox or hold mail when traveling, and opt out of pre-approved credit offers. Our guide on checking your mail for fraudsters has practical tips.
Step 7: Monitor your accounts and credit reports
Check bank and card statements weekly, enable transaction alerts and review your credit reports regularly. Dispute anything you do not recognize right away.
Step 8: Think before you click or share
Phishing messages impersonate banks, delivery services and government agencies. Do not click links in unexpected texts or emails, and never give out codes or Social Security numbers to inbound callers. See avoiding phone scams and phishing for personal info.
Step 9: Shrink your public footprint
Data broker and people-search profiles hand thieves your address, birth year and relatives. Remove them with official opt-outs, starting with the sites that rank highest. See how to opt out of the most popular people-search sites.
Step 10: Tighten social media
Remove your birth date, hometown, phone number and photos of documents. Criminals use quiz-style posts and public profiles to answer security questions. See identity theft and social media.
Step 11: Secure documents and devices
Shred paperwork with account numbers, use device passcodes and keep software updated. Back up files so ransomware cannot hold them hostage.
Step 12: Know your recovery plan
If something goes wrong, speed matters. Bookmark IdentityTheft.gov and read how to report identity theft before you need it.
Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.
3. Freeze, lock, alert: which is which
The vocabulary around credit protection confuses people, so here is a quick comparison.
| Tool | What it does | Cost | Notes |
|---|---|---|---|
| Security freeze | Blocks access to your credit file for new credit | Free | Strongest protection; lift when applying |
| Fraud alert | Asks businesses to verify identity | Free | Lasts one year (longer for victims); weaker than a freeze |
| Credit lock | App-based on/off switch from a bureau | Varies | Convenient, but a freeze has stronger legal footing |
| Credit monitoring | Alerts you to changes | Free to paid | Detects, does not prevent |
4. Special situations
- Children. Freeze a child’s credit file, since a clean record is attractive to thieves. See how to freeze your child’s credit.
- Older adults. Scammers target seniors heavily; victims aged 60 and older reported $7.7 billion in losses to FBI IC3 in 2025 (FBI IC3). Freezes, call blocking and family code words help.
- After a data breach. Follow our data breach response strategies and change affected passwords.
- After a move or divorce. Update addresses, remove old listings and re-check shared accounts.
5. Building a monthly five-minute routine
Prevention fails when it depends on memory. Pick one day each month and run a short checklist: scan your bank and card statements for charges you do not recognize, confirm your credit freezes are still active, check that your mail is arriving normally, and review which apps have access to your contacts and location. The guide to checking your mail for fraudsters explains the mail signs that deserve attention. Five minutes a month catches most problems while they are small.
6. What to do the moment something looks wrong
Speed matters more than perfection. If a charge, a letter or a call suggests someone is using your identity, place a fraud alert or freeze right away, then report the theft at the federal reporting site, IdentityTheft.gov, which produces a recovery plan and an official report you can show to banks. Change the passwords on your email account first, because email resets everything else. For the full playbook, read the advanced identity theft prevention guide.
7. Protecting the people around you
Identity thieves often reach you through someone close. An elderly parent who shares a bank login, a teenager with a reused password or a partner who answers a scam call can open the door for everyone in the household. Hold a short family conversation twice a year: agree that nobody gives out codes, passwords or account numbers on an incoming call, agree on a safe word for emergencies, and agree that anyone can pause and ask the others before paying a stranger. Set up alerts on shared accounts so that unusual activity reaches more than one person.
Children deserve special attention because their records are rarely checked. A thief can use a child’s Social Security number for years before anyone notices. Freezing a minor’s credit file closes that route, and the steps are in how to freeze your child’s credit. Keep paper documents such as birth certificates and Social Security cards locked away, and carry only the identification you need on a given day.
8. When prevention and recovery overlap
No plan stops everything, so decide in advance who you will call and what you will check if something goes wrong. Keep a list of your bank fraud lines, your credit freeze logins and the location of your important documents. Prepared people recover in days; unprepared people lose weeks to hunting for basic information while the damage grows.
9. Three scenarios
Scenario 1: A breach notice arrives. Freeze your credit, change the exposed password everywhere you used it and watch statements. Do not accept the first call or email from a stranger offering to help.
Scenario 2: Your tax return is rejected. The IRS may have received a return already filed in your name. Report it, request an IP PIN and follow the IRS identity theft guidance at irs.gov.
Scenario 3: A bill arrives for a service you never used. Dispute it in writing, request the application records and file a report at IdentityTheft.gov so the account is documented as fraud.
10. Common mistakes
- Relying on credit monitoring alone, which alerts but does not block.
- Using text messages as the only second factor on important accounts.
- Forgetting the mobile carrier, which holds the keys to your number.
- Leaving people-search profiles up while locking everything else.
- Waiting until after an incident to learn the recovery steps.
11. What to expect: a realistic timeline
| Task | Time |
|---|---|
| Credit freezes at three bureaus | 30 minutes |
| IRS IP PIN | 15 to 30 minutes once verified |
| Password manager and two-factor setup | 1 to 2 hours |
| People-search opt-outs | Hours to submit, days to weeks to take effect |
| Relisting checks | Every 30 to 90 days |
12. How Wiperts supports identity theft prevention
Wiperts handles step nine so you do not have to. It scans more than 100 data brokers and people-search sites for your name, date of birth, salary, address and phone number, submits the removal requests, removes personal results from Google and Bing, blurs your home on maps and monitors 24/7 for profiles that come back. It is one layer among the twelve, not a replacement for a freeze or good passwords.
Check which sites currently show your details.
100% Free Diagnosis: Check Your Exposure
Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:
- First Name
- Last Name
- Select State
- Email Address
- Website
Scan Databases Now — no payment is needed to see your exposure report.
13. Key takeaways
- Freeze credit and get an IRS IP PIN first; both are free.
- Use unique passwords, app-based two-factor and a locked carrier account.
- Remove the personal data thieves use to impersonate you.
- Know your recovery plan before you need it.
Pick the Wiperts plan that fits your household
| Plan | Covers | One-time deep scrub | Then |
|---|---|---|---|
| Individual | 1 person | $89 | $14/month |
| Couples (most popular) | 2 people | $149 | $24/month |
| Family | Up to 4 people | $199 | $39/month |
Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal
14. Frequently Asked Questions
What is the best way to prevent identity theft?
The strongest single step is a credit freeze at all three bureaus, because it blocks most new accounts opened in your name. Pair it with unique passwords, two-factor authentication, an IRS Identity Protection PIN and removal of exposed personal data.
Is a credit freeze better than a fraud alert?
For most people, yes. A freeze stops lenders from accessing your file, while a fraud alert only asks businesses to verify your identity. Freezes are free and can be lifted temporarily when you apply for credit.
What is an IRS Identity Protection PIN?
It is a six-digit number the IRS gives you to confirm your identity on tax returns, which helps prevent someone filing a return in your name. Anyone with a Social Security number or ITIN who can verify their identity can request one through their IRS online account.
How do I know if my identity has been stolen?
Warning signs include unfamiliar accounts or charges, collection notices for debts you do not recognize, denied credit, rejected tax returns, unexpected mail or medical bills. Check your credit reports regularly and respond to any sign quickly.
Can removing my data from the internet prevent identity theft?
It reduces the raw material criminals use. Removing addresses, phone numbers and birth dates from people-search sites does not stop all theft, but it makes impersonation harder, especially combined with a credit freeze.
What should I do first if my identity is stolen?
Report it at IdentityTheft.gov to get a recovery plan, place a freeze and fraud alert, contact affected companies, and file a police report if needed. Keep records of every call and letter, because disputes often need proof.
Sources
Related Reading
- What Is Identity Theft? Types, Warning Signs and Recovery
- How to Report Identity Theft: A Step-by-Step Guide for 2026
- What Is a Credit Freeze? How to Place, Lift and Use It in 2026
- Advanced Identity Theft Prevention: Beyond the Basics
- Two Great Tips to Prevent Fraud: Share Less and Verify More
- Online Personal Information and Identity Theft in 2026
- Questioning Identity Fraud: Who Is Responsible and How to Protect Yourself
- Check Your Mail for Fraudsters: Mail Theft and Mail Scams
Ready to erase your footprint?
Stop letting data brokers profit from your personal life. Start your removal today.
Start Removing