Quick Take
Think of this as the one page you bookmark and come back to — whether you’re setting up protections for the first time, just got a breach notification email, or you’re staring at a strange charge on your bank statement wondering what to do next. This identity theft prevention checklist pulls together the essential protections, official contacts, and step-by-step actions you need in one place, so you’re never scrambling to remember what to do or who to call.
You don’t need to do everything on this page today. Start with the prevention checklist, come back when something happens, and use the recovery section if you ever need to clean up active fraud. That’s exactly what this guide is built for.
Essential Information
Key facts everyone should know
Identity theft isn’t one thing — it’s a category of crimes. financial identity theft (someone opens a credit card in your name) is the most common, but there’s also medical identity theft (someone uses your insurance), criminal identity theft (someone gives your name during an arrest), synthetic identity theft (a fake identity built using a real Social Security number, often a child’s or a deceased person’s), and child identity theft, which can go undetected for years because kids don’t check their credit.
Your personally identifiable information (PII) — your Social Security number (SSN), date of birth, address history, and account numbers — is the raw material thieves need. Data breaches expose this information regularly, and millions of records are exposed each year across retailers, hospitals, schools, and financial institutions. Having your data exposed in a breach doesn’t mean you’ll become a victim — but it does mean you should act.
How the system works
Three national credit bureaus — Equifax, Experian, and TransUnion — each keep a separate file on you. Lenders report your activity to some or all of them, which is why your credit reports can look slightly different at each bureau. This also means protections like credit freezes have to be set up at all three separately.
When a company experiences a data breach, most states require them to send you a breach notification if your personal information was involved. That notice is your cue to act — not to panic.
Your rights under federal law
The Fair Credit Reporting Act (FCRA) gives you the right to see what’s in your credit file, dispute inaccurate information, and get errors corrected — usually within 30 days. The Fair and Accurate Credit Transactions Act (FACTA) built on this by giving you free annual credit reports and stronger identity theft protections, including the right to place fraud alerts and get fraudulent information blocked from your credit report once you’ve filed an identity theft report.
Under the FTC’s Red Flags Rule, many financial institutions and creditors are required to have programs in place to detect and respond to signs of identity theft on your accounts. You also have the right to place a security freeze on your credit file for free, and to remove it whenever you choose.
What institutions are required to do for you
Credit bureaus must let you freeze and unfreeze your credit file for free. Banks and credit card issuers are required to investigate disputed charges. Companies that experience breaches involving your data are generally required to notify you. None of this happens instantly — but knowing what you’re entitled to means you can push back when something moves too slowly.
Official Resources and Contacts
| Resource | What It’s For | Website | When to Use It |
|---|---|---|---|
| IdentityTheft.gov | FTC’s official recovery site — creates your identity theft report and recovery plan | identitytheft.gov | The moment you suspect fraud |
| AnnualCreditReport.com | The only federally authorized source for free credit reports from all three bureaus | annualcreditreport.com | Every year, or after a breach |
| FTC (Federal Trade Commission) | Handles identity theft reports, consumer complaints, scam tracking | ftc.gov | Filing a report or researching a scam |
| CFPB (Consumer Financial Protection Bureau) | Handles complaints against banks, lenders, and credit bureaus | consumerfinance.gov | If a company won’t resolve a dispute |
| SSA (Social Security Administration) | Handles SSN misuse and benefit fraud | ssa.gov | If your SSN is used fraudulently |
| IRS | Handles tax-related identity theft | irs.gov/identity-theft-central | If someone files a tax return using your info |
| Equifax | Credit freeze, fraud alert, dispute filing | equifax.com/personal/credit-report-services | Freezing/unfreezing, disputing errors |
| Experian | Credit freeze, fraud alert, dispute filing | experian.com/freeze | Freezing/unfreezing, disputing errors |
| TransUnion | Credit freeze, fraud alert, dispute filing | transunion.com/credit-freeze | Freezing/unfreezing, disputing errors |
| Local police department | Files an official police report for identity theft | Local non-emergency line | When you need a police report for disputes or the FTC affidavit |
When to file a police report
You don’t always need one, but it helps when a creditor requires proof for a dispute, or when the fraud involves something serious like criminal identity theft. Bring your FTC Identity Theft Report (generated at IdentityTheft.gov) and any documentation of the fraud — this speeds things up considerably.
Action Checklists
Prevention checklist (do this now, before anything happens)
- [ ] Freeze your credit at all three bureaus (free and reversible)
- [ ] Set up two-factor authentication (2FA) on email, banking, and social accounts
- [ ] Use a password manager to generate and store unique passwords
- [ ] Review your credit report at AnnualCreditReport.com at least once a year
- [ ] Opt out of pre-approved credit offers at OptOutPrescreen.com
- [ ] Shred documents with PII before discarding them
- [ ] Enable transaction alerts on bank and credit card accounts
- [ ] Be alert to phishing (email), smishing (text), and vishing (phone) scams — no legitimate bank asks for your password or full SSN over the phone
Post-breach checklist (what to do the day you get a notification)
- [ ] Read the notice carefully — what specific data was exposed?
- [ ] Change the password on the affected account, and anywhere else you reused it
- [ ] Turn on 2FA if it isn’t already active
- [ ] If your SSN was exposed, place a credit freeze at all three bureaus
- [ ] Watch your accounts and credit report closely for the next several months
- [ ] Consider a fraud alert if you’d rather not fully freeze your file (more on the difference below)
Recovery checklist (if you’re dealing with active fraud)
- [ ] File a report at IdentityTheft.gov — this generates your official FTC Identity Theft Report and a personalized recovery plan
- [ ] Freeze your credit at all three bureaus immediately
- [ ] Contact the fraud department of any account involved
- [ ] File a police report if needed for disputes
- [ ] Dispute fraudulent accounts or charges in writing with the creditor and credit bureaus
- [ ] Follow up in writing — keep copies of everything you send and receive
- [ ] If your SSN was misused for benefits or taxes, contact the SSA or IRS directly
Annual review checklist
- [ ] Pull your credit reports from all three bureaus at AnnualCreditReport.com
- [ ] Review your Social Security statement at ssa.gov for wage discrepancies
- [ ] Check that your credit freeze is still active if you set one
- [ ] Update passwords on financial accounts and your password manager’s master password
- [ ] Review your digital footprint — old accounts, unused apps, oversharing on social media
- [ ] Check your child’s credit report if you have minors (child identity theft often goes unnoticed for years)
Tools and Services
Free tools everyone should use
Credit freezes, fraud alerts, and your annual credit reports are all free by law — there’s no reason to pay for these basics. AnnualCreditReport.com, each bureau’s freeze page, and IdentityTheft.gov cost nothing and form the foundation of solid protection.
When to consider paid monitoring or recovery services
Free tools are reactive — they tell you what’s already in your credit file. Paid identity monitoring services add dark web monitoring (scanning criminal marketplaces for your leaked information), tri-bureau credit monitoring (versus checking one bureau at a time), and real-time alerts when someone tries to use your information. These are worth considering if you’ve been in multiple breaches, you’re a parent trying to protect a child’s clean credit file, or you simply want ongoing peace of mind instead of checking manually.
How to evaluate whether a tool is legitimate
A legitimate service will clearly explain what data it monitors, never ask you to pay before providing an account setup, and offer real human support if you need to resolve fraud — not just an automated report. Be wary of any service that contacts you out of the blue claiming your identity is “at risk” and pressures you to act immediately — that pressure tactic is itself a common scam.
Credit freeze vs. fraud alert — know the difference
| Credit Freeze | Fraud Alert | |
|---|---|---|
| What it does | Blocks new accounts from being opened entirely | Requires lenders to verify your identity before approving credit |
| Cost | Free | Free |
| Duration | Until you lift it | 1 year (initial) or 7 years (extended, for confirmed victims) |
| Best for | Anyone wanting maximum protection | People who still want some credit activity but with extra verification |
| Setup | Must be done at all 3 bureaus separately | Setting it at one bureau notifies the other two |
IdentityProtector.com’s role in all of this
This checklist gives you the framework — IdentityProtector.com helps you actually maintain it without the manual work. Our monitoring watches for your information across data breaches and dark web marketplaces, tracks your credit across all three bureaus, and sends real-time alerts the moment something looks off. And if fraud does happen, you’re not left with a checklist and a phone book — our recovery specialists work the case with you.
FAQ
Should I freeze my credit even if I haven’t been in a breach?
Yes. A credit freeze is free, reversible, and one of the strongest protections available since it blocks new accounts from being opened in your name entirely. Most people benefit from freezing proactively rather than waiting for a reason.
Does a credit freeze hurt my credit score?
No. Freezing and unfreezing your credit file has no impact on your credit score — it simply restricts who can view your file to approve new credit.
How do I know if a breach notification is real or a phishing attempt?
Legitimate breach notifications don’t ask you to click a link and enter your password or SSN. If you’re unsure, go directly to the company’s official website rather than clicking anything in the email.
What’s the difference between credit monitoring and dark web monitoring?
Credit monitoring watches for changes to your credit report, like new accounts or inquiries. Dark web monitoring scans criminal marketplaces where stolen data is bought and sold, which can alert you before the fraud even reaches your credit file.
My child got a pre-approved credit card offer in the mail — what does that mean?
It likely means someone opened credit using your child’s SSN, since kids shouldn’t have a credit file at all. Check their credit report immediately and consider a credit freeze for them.
Conclusion
Identity theft prevention isn’t about living in fear — it’s about putting a handful of durable protections in place once, then checking in on them regularly. The steps in this checklist — freezing your credit, monitoring your accounts, knowing exactly who to contact and when — are the same ones professional investigators recommend to their own families.
Bookmark this page and come back whenever you need it: setting up your defenses for the first time, responding to a breach notice, or working through recovery after fraud. And if you’d rather have someone watching for you around the clock, IdentityProtector.com gives you comprehensive identity monitoring, real-time alerts when your information turns up in a breach or on the dark web, credit monitoring across all three bureaus, and expert recovery support if the worst happens. Take control of your identity security today.
