Identity theft happens when someone uses your personal information — Social Security number, credit card numbers, bank account details, or other data — without your permission to commit fraud or theft. It is one of the most common financial crimes in the United States, affecting millions of people every year. The good news is that most identity theft is preventable with a set of consistent habits and protective measures.
How Identity Theft Happens
Identity thieves obtain information through several methods:
- Data breaches: Companies you have accounts with get hacked, exposing your credentials and personal data.
- Phishing: Fake emails, texts, or websites trick you into entering login credentials or personal information.
- Mail theft: Stolen bank statements, credit card offers, or tax documents.
- Social engineering: Someone impersonates a bank, government agency, or company to extract information from you directly.
- Skimming: Devices placed on ATMs or card readers capture your card information.
- Dark web purchases: Stolen data from breaches is sold in bulk and used for account takeovers.
Freeze Your Credit: The Most Effective Protection
A credit freeze prevents any new credit accounts from being opened in your name, even if someone has your Social Security number and personal information. This is the single most effective protection against identity theft that leads to fraudulent new accounts.
To freeze your credit, contact all three bureaus:
- Equifax: equifax.com or 1-800-685-1111
- Experian: experian.com or 1-888-397-3742
- TransUnion: transunion.com or 1-888-909-8872
A credit freeze is free, does not affect your credit score, and can be temporarily lifted (thawed) when you need to apply for new credit. It can be re-frozen immediately after.
Use Strong, Unique Passwords
Reusing passwords across accounts is one of the most common ways identity theft spreads. When one company is breached, attackers try those credentials on every other major service (“credential stuffing”). Use a password manager (such as Bitwarden or 1Password) to generate and store unique, complex passwords for every account. You only need to remember one master password.
Enable Two-Factor Authentication
Two-factor authentication (2FA) adds a second step to the login process — usually a code sent to your phone or generated by an authentication app. Even if someone has your password, they cannot log in without the second factor. Enable 2FA on every account that offers it, especially email, banking, and investment accounts. Use an authenticator app (Google Authenticator, Authy) rather than SMS text codes when possible — SIM-swap attacks can intercept SMS codes.
Monitor Your Accounts and Credit Reports
- Review bank and credit card statements weekly for unauthorized transactions.
- Check your credit reports at annualcreditreport.com — you are entitled to one free report from each bureau per year, and in 2026 free weekly reports are available through annualcreditreport.com.
- Set up account alerts for every transaction over $0 — most banks and credit cards offer this by email or text.
- Consider a credit monitoring service that alerts you when new accounts are opened or inquiries are made in your name.
Protect Your Social Security Number
Your SSN is the master key to identity theft. Protect it by:
- Never carrying your Social Security card in your wallet.
- Not giving out your SSN unless legally required (employers, banks, government agencies).
- Asking why an SSN is needed whenever it is requested — many requests are unnecessary.
- Filing your taxes early each year to prevent a thief from filing a fraudulent return in your name first.
What to Do If You Are a Victim
- Place a fraud alert with one of the three credit bureaus (it automatically alerts the other two).
- Freeze your credit at all three bureaus immediately.
- Report the theft to the FTC at identitytheft.gov — they provide a personalized recovery plan.
- File a police report if the theft involved criminal activity (this creates an official record).
- Contact the fraud departments of any affected banks, credit cards, or other institutions.
- Change passwords and enable 2FA on all affected and related accounts.