Use Unique, Strong Passwords Everywhere
Reusing passwords across sites means a single data breach can compromise every account using that password. A password manager (which generates and stores unique, complex passwords for every site) removes the burden of remembering dozens of passwords and is one of the highest-impact security habits available.
Enable Two-Factor Authentication (2FA)
2FA requires a second verification step (a code sent to your phone, an authenticator app, or a hardware key) beyond just your password, meaning a stolen password alone isn't enough to access your account. Enable this on email, banking, and any account holding sensitive personal or financial information — email in particular, since it's often the recovery point for other accounts.
Freeze Your Credit
A credit freeze (available for free from each of the three major credit bureaus) prevents new credit accounts from being opened in your name without first "thawing" the freeze — a strong, free protection against new-account identity theft. It doesn't affect your existing accounts or credit score, and can be temporarily lifted when you need to apply for new credit yourself.
Monitor Your Accounts and Credit Regularly
- Check bank and credit card statements regularly for unfamiliar transactions.
- Pull your free credit reports from AnnualCreditReport.com (the official free source) periodically to check for unfamiliar accounts.
- Consider a credit monitoring service if you want automated alerts, though many banks and credit card issuers now offer basic monitoring for free.
Be Skeptical of Phishing Attempts
Phishing (fraudulent messages designed to trick you into revealing credentials or personal information) remains one of the most common attack vectors. Be wary of urgent, unexpected messages asking you to click a link or provide information, and verify independently (by navigating directly to the official website rather than clicking an email link) if something seems suspicious, even if it appears to come from a legitimate organization.
Limit What You Share Publicly
Information often used for security questions or account recovery (birthdate, mother's maiden name, pet names) is frequently shared casually on social media — consider what personal details are publicly visible and whether they could be used to answer common security questions or impersonate you.
Secure Your Devices
- Keep operating systems and apps updated, since updates often patch known security vulnerabilities
- Use a screen lock (PIN, biometric) on all devices
- Be cautious using public Wi-Fi for sensitive transactions; consider a VPN if you frequently need to use public networks
What to Do If You Suspect Identity Theft
- Place a fraud alert or credit freeze immediately with the credit bureaus
- Report the theft at IdentityTheft.gov (the official FTC resource), which provides a recovery plan
- Contact affected financial institutions directly to report and dispute fraudulent activity
- File a police report if needed for your specific situation