Protect Yourself from Identity Theft

Start Here: Highest-Impact Steps

MFA adds a second layer of security to your accounts. Even if an attacker obtains your password through a data breach or phishing attack, they cannot access your account without the second factor.

• Enable MFA on your email account first — it is the master key to most of your other accounts.
• Use an authenticator app (such as Google Authenticator, Authy, or Microsoft Authenticator) rather than SMS text messages when possible. SMS codes can be intercepted through SIM-swapping attacks.
• Enable MFA on financial accounts, social media, and any account that stores sensitive personal information.
• Store backup codes in a secure location in case you lose access to your authentication device.

Weak and reused passwords are responsible for a large share of account compromises. A password manager solves both problems.

• Use a reputable password manager to generate and store unique passwords for every account.
• Never reuse a password across multiple sites. If one site is breached, attackers will try your credentials everywhere else.
• Use long passwords — at least 16 characters. Length matters more than complexity.
• Change passwords immediately if you receive notice that an account or service you use has been breached.

Early detection limits the damage from identity theft. Regular monitoring helps you catch unauthorized activity before it escalates.

• Review bank and credit card statements at least monthly for transactions you don't recognize.
• Set up transaction alerts on your financial accounts so you are notified of any activity in real time.
• Check your credit reports at AnnualCreditReport.com — the only federally authorized free source. All three bureaus (Equifax, Experian, TransUnion) are available.
• Look for accounts, inquiries, or addresses you don't recognize on your credit report. These can be early signs of identity theft.
• Consider a fraud alert at the credit bureaus if you suspect your information has been compromised. A fraud alert requires lenders to verify your identity before opening new credit.

Phishing — fraudulent messages designed to steal your credentials or personal information — is the most common entry point for identity theft. AI has made phishing messages more convincing than ever.

• Be skeptical of any unexpected message — email, text, or phone call — that asks you to click a link, provide personal information, or take urgent action.
• Verify the sender's identity through a known, independent channel before responding. Call the bank or agency using a number from their official website, not from the message.
• Do not click links in unsolicited emails or texts. Navigate directly to the website by typing the address in your browser.
• Be especially cautious of messages that create urgency — 'your account will be closed,' 'act now,' 'limited time.' Urgency is a manipulation tactic.

Limiting the personal information you share — online and offline — reduces your exposure to targeted attacks.

• Be cautious about what you share on social media. Details like your employer, hometown, family members' names, and birthdate can be used to craft convincing targeted attacks.
• Shred documents containing personal information — bank statements, medical records, pre-approved credit offers — before discarding them.
• Be cautious about providing your Social Security number. Ask why it is needed and how it will be protected before sharing it.
• Use a P.O. box or a mail forwarding service if you are concerned about mail theft.