How to Prevent Identity Theft: 10 Steps That Actually Work

Identity theft is the most common form of consumer fraud in America. In 2024, over 26 million people became victims, with an average loss of $500 per person. But here's the scary part for people with bad credit: criminals know you're already stressed about finances, making you an easier target for scams.

If someone steals your identity, they can open credit cards in your name, take out loans, drain bank accounts, or file fraudulent tax returns. This can wreck your credit score even further, making it harder to get approved for loans, mortgages, or even job opportunities. The Fair Credit Reporting Act (FCRA) protects you by requiring credit bureaus to correct errors, but prevention is always cheaper than repair.

The good news? Most identity theft is preventable. Unlike a credit card that can be replaced, your Social Security number is forever. Protecting it isn't optional—it's essential. This guide gives you 10 specific, actionable steps that actually work, based on what security experts and law enforcement recommend.

A credit freeze is your first line of defense. It prevents anyone—including criminals—from opening new accounts using your SSN without your permission. The best part? It's completely free under federal law.

Here's how it works: When a lender checks your credit before approving a loan or card, they need access to your credit report. A freeze blocks that access. The criminal can have your SSN and still can't open a credit card because the lender can't see your credit file.

You have three major credit bureaus: Equifax, Experian, and TransUnion. Contact all three to freeze your credit. You can do this online, by phone, or by mail:

Equifax: 1-800-349-9960 or equifax.com/personal/credit-report-services

Experian: 1-888-397-3742 or experian.com/freeze

TransUnion: 1-888-909-8872 or transunion.com/credit-freeze

The process takes about 10 minutes per bureau. You'll get a confirmation number—save these. When you actually need to apply for credit, you'll unfreeze temporarily (also free). This is different from a fraud alert, which lasts one year and costs nothing but requires lenders to verify your identity before opening accounts. Do both for maximum protection.

You're entitled to one free credit report from each bureau every 12 months under the FCRA. Smart people check one bureau every four months instead of all three at once, giving continuous monitoring.

Go to AnnualCreditReport.com (the official, federally authorized site—not the impersonators). Don't pay for this. There's no reason to. Download your reports and read them carefully. Look for:

Accounts you didn't open. New credit cards, loans, or lines of credit you don't recognize are red flags.

Hard inquiries you didn't authorize. These show when someone applied for credit using your name.

Wrong personal information. Old addresses, employers, or misspelled names can indicate fraud.

Incorrect payment history. Late payments you know you made on time, or accounts showing activity after you closed them.

If you find errors, dispute them immediately. Under the FCRA, bureaus must investigate within 30 days. Write a letter with specifics: "Account #[number] on [bureau name] report shows a late payment from [date], but I have proof of on-time payment." Send certified mail to the bureau's disputes address (on their website).

For people with bad credit, this step is doubly important. Criminals sometimes use existing bad credit as cover—extra accounts won't seem suspicious. Stay vigilant.

Weak passwords are how most accounts get hacked. If a criminal gets your email password, they can reset passwords on every account linked to that email—bank, credit card, PayPal, everything.

Here's the rule: Never use the same password twice. I know that's hard to remember, but that's the point. A password manager like Bitwarden (free), 1Password ($2.99/month), or LastPass ($3/month) stores passwords encrypted so you only need to remember one master password. This is non-negotiable if you want real security.

What makes a strong password? Think "random chaos.":

• Minimum 12 characters (16+ is better)
• Mix of uppercase, lowercase, numbers, and symbols
• NOT personal information (birthdate, kid's name, etc.)
• NOT words from the dictionary
• Examples: "Kj7#mP2@xLq9Wv" or use a passphrase like "Coffee-Maker-Blue-Tiger-47"

For your most important accounts (email, bank, credit card portal), use ultra-strong passwords and enable two-factor authentication (2FA). This means even if someone gets your password, they can't access your account without a code sent to your phone or generated by an app.

Enable 2FA on: Gmail/Outlook, all banking apps, PayPal, Amazon, and your credit bureau accounts. Most offer free options via text message or authenticator apps like Google Authenticator.

Your SSN is the master key to identity theft. Once stolen, it's nearly impossible to change. So stop giving it out casually.

Who actually needs your SSN?

• Banks and financial institutions (checking accounts, loans)
• Your employer (tax withholding)
• The IRS (tax returns)
• Government agencies (benefits, licenses)
• Credit card companies (after you apply)

Who doesn't need it:

• Your doctor's office (use your insurance ID)
• Utilities (they'll ask but don't legally require it; use driver's license instead)
• Retail stores (refuse if they ask at checkout)
• Schools (use ID number; some will demand SSN but push back)

When you do provide your SSN, ask: "Why do you need this? What will you do with it?" Businesses often collect it out of habit, not necessity.

Never carry your Social Security card in your wallet. Keep it in a safe (physical or digital). Don't post your SSN anywhere online, including social media, even partially. Criminals can piece together your number from multiple sources—a leaked database here, a careless post there.

If you're working with a debt collector or credit counselor, be extra careful about your SSN. The FDCPA allows debt collectors to contact you but they should never request sensitive information via email or unsecured methods. If something feels off, hang up and call the company directly using a number from their official website.

Your email and phone are the keys to your digital life. Whoever controls these can reset your passwords and access your accounts.

Secure your email:

Enable 2FA (two-factor authentication) immediately. This means when someone tries to log in from a new device, Google/Microsoft sends a code to your phone. Even with your password, they can't get in.

Review connected apps and devices. In Gmail settings, click "Security" then "Your devices." Remove anything you don't recognize. Reduce the number of apps that have access to your email (Instagram doesn't need to auto-post to your email).

Create a separate, stronger password just for email. This is your most important password because email is the password reset master key.

Secure your phone number:

Enable SIM-swap protection with your carrier (AT&T, Verizon, T-Mobile, etc.). This prevents someone from transferring your phone number to a different SIM card and accessing your accounts. Call your carrier or visit in person—set up a PIN required to make changes.

Enable 2FA on your carrier's account too. If someone calls pretending to be you, they still can't port your number.

Be cautious about "2FA via text." It's better than nothing, but app-based authentication (Google Authenticator, Authy) is more secure. Use text 2FA for critical accounts only.

Never give your phone number to unknown callers. Scammers use phone numbers to reset passwords and breach accounts. Your phone is worth more than your password.

This is the fastest way to catch identity theft. If someone opens an account or makes unauthorized charges, you'll see them here first—before they damage your credit score.

Set a recurring alarm. Every Sunday, spend 10 minutes reviewing:

• Bank account transactions (check, savings, money market)
• Every credit card statement (even store cards)
• Paypal, Venmo, or other payment app history
• Recurring charges (subscriptions you authorized)

Look for:

• Charges you don't recognize (especially small ones—fraudsters test with $1-$5 charges)
• Withdrawals from ATMs you didn't visit
• New accounts opened
• Missing deposits or paychecks

If you find fraud, act immediately. Call your bank and credit card company directly (use the number on your card or statement, not a number from Google—scammers fake these). Report the fraud and request that charges be reversed. By law, your liability is $0 if you report within 60 days, but report within 24-48 hours to prevent further theft.

For bank accounts, you have protections under the Electronic Funds Transfer Act. For credit cards, the Truth in Lending Act (TILA) limits liability to $50 per card. You're protected, but only if you report quickly.

Documentation matters. Take screenshots of unauthorized transactions. Request written confirmation from your bank. Keep this for disputes and your records.

If you have bad credit already, you might feel like your accounts don't matter much. Wrong. Thieves still target them because the damage is already done—you're less likely to notice quickly.

Old-school identity theft still happens. Trash thieves dig through garbage looking for bills, statements, and documents with your SSN, address, and account numbers.

What to shred:

• Bank statements and canceled checks
• Credit card statements
• Medical bills and insurance documents
• Tax returns and W-2s (keep for 7 years, then shred)
• Utility bills with account numbers
• Any document with your SSN or full account numbers
• Pre-approved credit offers (especially if you have bad credit—criminals want these)

Invest in a cheap cross-cut shredder ($20-$40). Strip shredders are useless. A cross-cut shredder makes the paper unrecoverable. Shred at least quarterly, or more if you get lots of mail.

Manage your physical mail:

• Collect mail immediately. Don't leave it in your mailbox overnight.
• Put a lock on your mailbox if you rent.
• Stop mail you don't need. Call companies and ask to go paperless. Most will.
• For bills, use online banking and statements instead of paper.
• Opt out of pre-approved credit offers (OptOutPrescreen.com). This reduces mail fraud and identity theft attempts.
• If you're expecting sensitive mail but haven't received it after a week, call the sender. Theft in transit is real.

If you move, file a mail forwarding request with USPS and update your address with banks and creditors. Thieves watch for mail sent to old addresses.

For people with bad credit, this step prevents new debt in your name. Shredding takes 5 minutes. Getting fraudulent accounts off your credit report takes months.

Most people only freeze credit with the three major bureaus. But criminals can also open services in your name with smaller specialty bureaus that report to different industries.

Specialty bureaus to contact:

Innovis (the "fourth bureau"—less known but important): innovis.com/optout or call 1-800-540-2505. Request a credit freeze.

LexisNexis (used for insurance, utilities, telecom): optout.lexisnexis.com or 1-866-797-3579.

Clarity (used by lenders): clarityservices.com or 1-800-262-0299.

ChexSystems (used by banks for checking accounts): chexsystems.com/consumer or 1-888-696-4642. You can't freeze here, but you can place a fraud alert.

These bureaus specialize in different data. Someone might open a cell phone account using your SSN and address. If you've frozen these specialty bureaus, they can't.

Also contact your utility companies, phone companies, and internet providers directly. Ask them to add a password or PIN to your account. Require this PIN before making changes—adding services, upgrading, or transferring.

Most companies will do this at no cost. Some require you to visit in person. It's worth the trip because utilities are often opened first in fraudulent identity theft. A fraudster gets your SSN, opens a $2,000 electric account in your name, then disappears. You're stuck with the bill and damaged credit.

For people with bad credit, utility fraud is common because you're already vulnerable. Criminals assume you won't notice another bill.

Despite all precautions, theft might still happen. Know your rights and how to respond within critical timeframes.

If you discover theft, do this immediately (within 24 hours):

1. Call your bank and credit card companies. Report unauthorized transactions. Request account freezes or closures. Ask for written confirmation.

2. File a report with the FTC at IdentityTheft.gov. This creates an official record. The FTC will generate a recovery plan. You'll get a number proving you reported within 60 days (important for liability limits). This is free and takes about 10 minutes online.

3. File a police report. Go to your local police station or file online if your jurisdiction allows. Get a case number. Provide this to credit companies and bureaus.

4. Freeze your credit with all three bureaus immediately if you haven't already. You can now freeze online in minutes using your case number from the police report.

5. Place a fraud alert with the bureaus. Call one bureau; they'll notify the others. This lasts one year and requires lenders to verify your identity before opening accounts.

Next 30 days:

• Review all credit reports (you get free ones when you've been victimized)
• Dispute unauthorized accounts and charges in writing
• Request credit limits be lowered or accounts closed
• Change passwords for all online accounts
• Monitor accounts daily

Next 90 days:

• Follow up on disputes
• Get written confirmation that fraudulent accounts are closed
• Monitor for new fraudulent activity

Know your protections:

Under the Fair Credit Reporting Act (FCRA), bureaus must investigate disputes within 30 days. Under the Truth in Lending Act (TILA), credit card liability maxes at $50. The Electronic Funds Transfer Act (EFTA) limits bank account liability to $50 if reported within 2 business days, $500 if reported within 60 days.

Beware of debt collectors contacting you about fraudulent accounts. The Fair Debt Collection Practices Act (FDCPA) prohibits harassment, but collectors might try to collect anyway. Respond in writing requesting proof that the debt is yours. Keep all documentation.

You can't protect what you don't know you have. Create a comprehensive inventory of all accounts, financial institutions, and personal information.

Create a document with:

• Bank accounts (checking, savings, money market) with institution names, account numbers, and phone numbers
• Credit cards (even closed ones) with card numbers and customer service numbers
• Loans (auto, personal, student) with lender names and account numbers
• Investment accounts (brokerage, retirement, crypto) with login information
• Utility accounts (electric, water, gas, internet, phone) with account numbers
• Insurance policies (auto, home, health, life) with policy numbers
• Online accounts (email, social media, shopping) with usernames
• Important documents (passport number, driver's license number, SSN—for reference)
• Emergency contacts and important dates

Store this securely:

NOT in a Google Doc shared with anyone. NOT on your phone's Notes app accessible without password. Instead:

• Option 1: Password-protected Word document on an encrypted USB drive, locked in a safe
• Option 2: Bitwarden or 1Password (password managers) which encrypt everything
• Option 3: Physical notebook in a locked safe (old school, but secure)

Give a copy to a trusted family member or executor. In emergencies (your death, incapacity), they'll need to access accounts.

Update yearly:

Set a calendar reminder every January 1st. Add new accounts, remove closed ones, update phone numbers. This way you always know exactly what's in your name and can spot fraud instantly.

For people with bad credit, this inventory is gold. You know how many accounts you have, which are legitimate, and which are collection accounts. This prevents criminals from adding more fake accounts without your notice.