How to Prevent Identity Theft: Warning Signs, Protection Services and More

How to prevent identity theft

There's no fail-safe way to prevent identity theft, but there are some things you can do to reduce chances you’ll be a target, spot warning signs and take quick action to minimize damage.

Freeze your credit

Freezing your credit with all three major credit bureaus — Equifax, Experian and TransUnion — restricts access to your records so new credit files cannot be opened. It’s also a way to prevent identity theft online. It’s free to freeze your credit and unfreeze it when you want to open an account. A credit freeze provides the best protection against an identity thief using your data to open a new account.

Safeguard your Social Security number

Your Social Security number is the master key to your personal data. Guard it as best you can. When you are asked for your number, ask why it is needed and how it will be protected. Don’t carry your card with you. Securely store or shred paperwork containing your Social Security number.

» Learn how to protect your Social Security number

Be alert to phishing and spoofing

Scammers can make phone calls appear to come from government entities or businesses, and emails that appear to be legitimate may be attempts to steal your information. Initiate a callback or return email yourself, working from a known entity such as the official website, rather than responding to a call or email. And be wary of attachments — many contain malware.

» Learn how to to stay safe from financial scams

Use strong passwords and add an authentication step

Use a password manager to create and store complex, unique passwords for your accounts. Don’t reuse passwords. Adding an authenticator app can reduce your risk, too.

Don’t rely on security questions to keep your accounts safe. Scammers can easily find out things like your pet's name or your local high school mascot by perusing your social media accounts. It's worth thinking carefully about what you disclose on social media so you don't give away key data or clues about how you answer security questions.

Use alerts

Many financial institutions will text or email when transactions are made on your accounts. Sign up so that you know when and where your credit or debit cards are used, when there are withdrawals or deposits to financial accounts and more.

Watch your mailbox

Stolen mail is one of the easiest paths to a stolen identity. Have your mail held if you’re out of town. Consider a U.S. Postal Service-approved lockable mailbox. You can also sign up for Informed Delivery through the USPS, which gives you a preview of your mail so you can tell if anything is missing.

Shred, shred, shred

Any credit card, bank or investment statements that someone could fish out of your garbage shouldn’t be there in the first place. Shred junk mail, too, especially preapproved credit offers.

Use a digital wallet

If you’re paying online or in a store, use a digital wallet, which is an app containing secure, digital versions of credit and debit cards on your smartphone. You can use it to shop online or at a compatible checkout terminal. Transactions are tokenized and encrypted, which makes them safer.

Protect your mobile devices

Use passwords on your electronic devices. Use a banking app rather than a mobile browser for banking.

Check your credit reports regularly

The three major credit reporting bureaus give consumers access to free credit reports weekly, accessible by using AnnualCreditReport.com. Check to be sure that accounts are being reported properly and watch for signs of fraud, like accounts you don't recognize. You can also sign up for a free credit report and score from NerdWallet to receive alerts when there are changes.

» Get your free credit report from NerdWallet

Monitor financial and medical statements

Read financial statements. Make sure you recognize every transaction. Know due dates and call to investigate if you do not receive an expected bill. Review “explanation of benefits” statements to make sure you recognize the services provided to guard against health care fraud.

Types of identity theft and warning signs

Here are common ways a criminal may exploit your information:

Credit identity theft

Credit identity theft happens when a criminal uses your personal information, such as birthdate and Social Security number, to apply for a new credit line.

Child identity theft

With this type of identity theft, criminals steal a child’s identity and apply for credit in that child’s name. Often it is not discovered until the victim applies for college loans or other credit.

» Try it now: prevent child identity theft and freeze their credit

Synthetic identity theft

Synthetic identity theft is when criminals use a patchwork of identity details to construct a fictitious consumer, using a Social Security number — often one of a minor child or one that is simply made up — that is not yet in the credit bureaus’ database and combining it with a name and address. They then apply for loans and credit cards, often making payments for years as the credit limits grow. Once the credit cards are maxed out, the criminals disappear, leaving you with the unpaid balance.

Taxpayer identity theft

Sometimes fraudsters use a Social Security number to file a tax return and steal your tax refund or tax credit.

Medical identity theft

Using someone else’s identity to get health care services is medical identity theft. It’s particularly dangerous because it can result in medical histories being mixed, giving doctors and hospitals wrong information as they are making health care decisions.

Account takeover

Criminals use personal data to access your financial accounts, then change passwords or addresses so that you no longer have access.

Criminal identity theft

Criminal identity theft occurs when someone gives law enforcement authorities someone else’s name and address during an arrest or investigation. This is often done with false identification, such as a fake driver’s license.

How identity theft happens

Here are some of the ways your personal information can be compromised and tips to avoid ID theft:

1. Lost wallet

When your wallet is lost or stolen, someone else may gain access to all the information in it. Here are some tips for minimizing damage if your wallet is stolen:

• Don’t carry your Social Security card or more credit or debit cards than you use regularly, and don’t keep a list of passwords and access codes in your wallet.

• Some debit and credit card issuers allow you to temporarily “turn off” a lost card; with others, you have to cancel and get a new card issued. Consider using this option in case you eventually find your card, but check to make sure there aren’t any odd transactions before unlocking your card.

2. Mailbox theft

Someone simply takes your mail or forwards your mail to a different address so that you suddenly stop getting most mail. Here are some tips for keeping your mail safe:

• Sign up for USPS Informed Delivery. You’ll get an email with images of the items that should be delivered to you so you’ll know if things are missing.

• Choose a secure mailbox and retrieve mail promptly.

3. Using public Wi-Fi

Hackers may be able to see what you are doing when you use free public Wi-Fi. Here's how to prevent prying eyes:

• Don’t use public Wi-Fi for shopping, banking or other sensitive transactions. If you choose to use public Wi-Fi, use a virtual private network service to create a secure connection.

• Purchase a privacy screen for your laptop to keep prying eyes from seeing the information on your screen. 

• You may also consider sticking with secured versus unsecured Wi-Fi networks, keeping your firewall enabled to protect from malware threats or turning off file-sharing options.

4. Data breaches

Hackers commonly invade databases holding sensitive information to try and access people's personal banking, email and other accounts. As a result, almost everyone has been affected by a data breach. Here's what you need to know:

• Assume that your data is already out there and take precautions accordingly. Monitor your credit reports, especially for new accounts or inquiries resulting from credit applications.

• Check your credit scores often — unexpected changes can be a clue — and read financial and insurance statements carefully. Monitor your credit reports, especially for new accounts or inquiries resulting from credit applications.

» Learn how to protect your credit after a data breach

5. SIM card swap

A SIM card swap happens when someone takes over your phone number. You may stop getting calls and texts, or you may get a notice that your phone has been activated. Consider taking these steps to prevent SIM swapping:

• Set up a PIN or password on your cellular account.

• Consider using an authentication app for accounts with sensitive financial information. Authentication apps are mobile apps that add an extra layer of security to your online accounts by requesting one time passwords that are typically time sensitive.

6. Phishing or spoofing

Some fraudsters try to get you to disclose personal data, such as credit or debit card numbers, Social Security numbers and banking information, by sending an official-looking email. Spoofing involves doing much the same thing with caller ID, so that the number appears to be that of a trusted company or government agency. Take these steps if you get a “phishy” email:

• Do not give out personal data in response to an email or call.

• Find contact information from a trusted source, such as your bank website, and use it to verify whether the call or email is legitimate.

7. Skimming

Skimming is getting credit or debit card information, often from a small device, when a card is used at a brick-and-mortar location such as a gas pump or ATM. Here's how to protect yourself at checkout:

• Use cards with chips, which have added protections.

• Pay inside at the gas station if you can, because skimming devices are more likely to be placed at unmonitored payment sites.

• Detect fraudulent activity early by setting email or text alerts that let you know when your credit or debit cards are used. If a card is used without your authorization, call the issuer immediately.

8. Phone scams

You may be told you have won something or even that you are in danger of being arrested. The caller claims to need personal, banking or credit information to verify your identity or to know where to send you money. Here's how to avoid a phone scam:

• Don’t give personal information out over the phone.

• Be aware of common phone scams. The IRS, for example, does not initiate contact with taxpayers by phone (or email or social media) to request personal or financial information, nor does it call with threats of arrest or lawsuits.

9. Looking over your shoulder

Fraudsters can learn a password just by watching your fingers as you key it in. The information on your credit or debit card can be photographed with a smartphone while you shop online in a public place. A business might leave sensitive information where people can see it. Follow these tips when you're out in public:

• Be aware of your surroundings.

• Don’t leave cards where they can be seen.

• Cover your hand when you key in passwords or codes.

10. Malware

Opening an email attachment or visiting an infected website can install malicious software on your computer, such as a keylogger. That does what it sounds like — logs every keystroke, giving criminals access to passwords, account numbers and more. The following should be top of mind when you use your digital devices like laptop, tablet or smartphone:

• Be cautious about clicking on attachments or links in emails and about the websites you visit.

• Use a password manager, which lets you avoid keying in login credentials.

How to report identity theft

Reporting identity theft starts an investigation and the process of restoring your good name. While some steps might vary depending on the type of identity theft, here are some basic steps to take to protect yourself:

1. File a report with the FTC by visiting IdentityTheft.gov. This website is a one-stop shop for information and reporting identity theft. Follow the recommended steps to make a recovery plan that you can put into action. 

2. Place a fraud alert on your credit reports. It’s free for one year, and you’ll only need to contact one of the three major credit bureaus — Experian, Equifax or TransUnion — and they must notify the others. 

3. Call the companies where you suspect fraudulent activity occurred. Explain your circumstances and ask them to freeze or close the accounts to prevent further action. Take this time to change your login and password information. Credit and debit card issuers generally replace the cards with new ones with a different number, and you're back in business.

4. Get your free credit reports from Annualcreditreport.com and note any suspicious activity that you will need to dispute. 

5. You might want to file a police report. Take your FTC identity theft report, photo ID and any proof of theft with you to your local station. 

» Get more details about the steps to take after ID theft

For tax ID theft: The IRS has a phone line for identity theft, at 800-908-4490, and a taxpayer guide to identity theft on its website. As a warning, taxpayer identity theft or theft of benefits are typically resolved more slowly than other kinds of identity theft.

For medical ID theft: If it appears someone else used your health benefit, contact your health insurer and consider contacting any involved providers to make sure someone else’s health history is not mixed with yours.

No matter which type of identity theft you experience, keep extensive notes about phone conversations and retain related emails.

Identity theft protection services

Identity theft protection services let you know that your identifying information has been used, or that it is at risk because it was exposed in a data breach. If you are a victim of identity theft, they may also guide you through the process of cleaning up the mess and restoring your identity — and reimburse you for costs.

If you’re already doing all you can do to protect your identity or feel you don't have time to do it, you may want to consider an identity theft protection service. Protections vary, and most offer additional ways to protect your privacy and other services. The best choice among the paid services is one that fits your budget and offers you the coverage you care about.

» Check out our list of the best identity theft protection services

Before you pay for one, though, check to be sure you don’t have a free identity theft benefit or discount you’re not using. This free protection might be offered through an existing credit card, as an employer benefit or through your bank or credit union.

If you decide to purchase a protection plan, NerdWallet has reviews of:

• Aura

• IdentityForce

• IDShield

• LifeLock