Assume your personal information is already for sale. Your Social Security number, date of birth, old addresses, and old passwords have almost certainly been exposed in some breach, and there is no version of the internet where you get them back.
That sounds bleak, and it changes the question in a useful way. You cannot keep the data secret. You can make it useless, by putting locks on the specific places a thief has to reach.
Most of those locks are free, and the strongest one takes about fifteen minutes.
How It Actually Happens
Data breaches supply the raw material. A company you did business with gets compromised, your records join a database that gets traded and eventually sold cheaply, and you learn about it from a notification letter months later.
Phishing turns that material into access. A message that looks like your bank asks you to confirm something urgent. The modern version arrives by text or phone call, with the caller ID spoofed to show your bank's real number, and the caller already knows your last four digits because those came from a breach. The defense is a habit, not a skill: hang up and call the number printed on your card.
SIM swapping targets your phone number. An attacker persuades or bribes a carrier employee to move your number onto a SIM card they control, and every text message code then goes to them, which is enough to reset passwords. Most carriers will add a port-out PIN or number lock if you ask.
Mail theft is old and still productive. Preapproved credit offers, tax forms, and new cards sit in unlocked boxes. You can stop most prescreened offers at OptOutPrescreen.com, the opt-out site run by the credit bureaus.
Public wifi belongs on this list, near the bottom. Nearly all web traffic is encrypted by default now, so a stranger on the cafe network reading your banking session is far less likely than it was a decade ago. Real, but small next to a reused password.
The Credit Freeze
A credit freeze restricts access to your credit report. When a lender cannot pull the report, it will not open the account, so an application filed in your name simply fails. This is the direct counter to new-account fraud, the expensive kind you find out about from a collections agency.
Since a 2018 federal law, freezes are free at all three nationwide credit bureaus, and so is lifting them. A freeze does not lower your score, touch your existing accounts, or block your own access. When you want to apply for something you thaw it temporarily, and bureaus must act on a lift request made online or by phone within one hour.
Two weaker things get confused with it:
A fraud alert asks lenders to take reasonable steps to verify your identity first. It is free, lasts one year, and you place it with one bureau, which must tell the other two. It is a request rather than a block.
Paid credit monitoring watches for changes and emails you when something appears. That is detection after the fact. It never stops the account from being opened.
You have to freeze at each bureau separately: Equifax, Experian, and TransUnion. Freezing one and stopping leaves the other two open, and lenders pull from whichever they prefer.
Read Your Own Reports
AnnualCreditReport.com is the federally authorized site for free credit reports, and since 2023 you can pull all three every week at no cost. Look for accounts you never opened and addresses you never lived at. An unfamiliar address is often the first sign, because a thief needs the mail to go somewhere.
Why Paying With Credit Is Safer Than Debit
The two cards look identical and the legal protection behind them is not remotely the same.
Credit cards fall under the Fair Credit Billing Act, which caps your liability for unauthorized charges at $50. Most issuers waive even that. The money at stake was the bank's, so while a disputed charge is investigated your own cash sits untouched.
Debit cards fall under the Electronic Fund Transfer Act and its Regulation E, where the protection runs on a clock. Report the loss or unauthorized transfer within two business days of learning about it and liability is capped at $50. Report later but within 60 days of the statement being sent and it rises to $500. Wait past 60 days and, for transfers after that window, the law caps nothing.
There is a practical difference too. Debit fraud pulls real money out of your checking account while the bank investigates, and rent does not pause for the investigation.
Passwords and Second Factors
Password reuse is the most exploited weakness there is. Attackers take email and password pairs from one breach and try them automatically across hundreds of sites, so one old leak opens whatever else shares that password. Unique passwords everywhere is the fix, and generating them is the real job of a password manager.
For two-factor authentication, the second step after your password, prefer an authenticator app or a hardware security key over text message codes. Codes generated on your device cannot be intercepted by someone who took over your phone number. SMS is still far better than nothing, so use it where it is the only option offered.
Children Are Targets
A child's Social Security number is unused, unmonitored, and attached to no credit history, which makes it ideal for building a fake identity. Nobody notices for a decade, and the discovery usually arrives when a teenager applies for a first job or student aid.
The same 2018 law lets a parent or guardian place a free freeze on a minor's file, and if no file exists the bureau creates one specifically to freeze it. A child has no reason to apply for credit, so there is essentially no cost to doing it.
If It Already Happened
Start at IdentityTheft.gov, the Federal Trade Commission's recovery site. It builds a personalized plan and generates an FTC Identity Theft Report, the document that unlocks stronger rights, including an extended fraud alert lasting seven years and the right to have fraudulent information blocked from your reports.
From there, call the fraud department at each company where an account was opened, freeze all three bureaus if you have not, and change any password you reused elsewhere. If a fraudulent tax return was filed under your number, the IRS handles that through its own identity theft affidavit and can issue you an Identity Protection PIN for future filings.
Summary
Your data is already out there, so the work is locking the doors it opens. Freeze your credit at all three bureaus, read the free weekly reports for accounts and addresses that are not yours, pay with credit rather than debit where you have the choice, and use unique passwords with an authenticator app instead of text codes. If something goes wrong, IdentityTheft.gov produces the paperwork every other step will ask you for.
