← All guides

Digital security

Identity & Financial Protection: The Complete Starting Guide

Published October 1, 2026

Some links on this site may earn us a commission, at no cost to you. It never decides what we recommend. How we make money.

Good protection here has two halves. Preventative controls make it hard for someone to open accounts or move money in your name. Reactive ones tell you quickly when something has gone wrong, so you can start fixing it right away. You want both.

Start with the freezes, since they do the most to stop the problem before it begins. Then add the alerts that catch what slips through. Almost all of it is free.

The agencies and rules here are for the US. Elsewhere, the same ideas apply, but the names and steps differ.

Lock it down

Freeze more than the big three

Most people stop at Equifax, Experian and TransUnion. There are more places that hold your data and can be used against you: Innovis, ChexSystems, NCTUE, LexisNexis, The Work Number, E-Verify and the IRS. Freeze or lock all of them, and do it for your kids and any older relatives whose finances you manage.

Keep a record of everything you froze and how to lift each one, in a password manager. You’ll need it when you apply for a loan or a new job.

Our credit freeze checklist has the full list, what each one covers, how to lift a freeze, and how a freeze differs from a fraud alert.

What good looks like: a freeze or lock at every place that holds your data, and a record of how to lift each one.

Put a verbal password on your accounts

Ask your bank or credit union if you can add a verbal password. When you call in or walk into a branch, they’ll ask for it on top of their usual identity checks. It’s a cheap extra layer, and it stops someone who has your personal details but not that word.

What good looks like: a phrase that isn’t guessable from public information, stored in your password manager.

Create your government accounts first

Set up your own online accounts with the Social Security Administration and the IRS before someone else does it in your name. If the account already exists under your control, a thief has a harder time claiming it. Protect each with a strong, unique password and MFA.

What good looks like: an account you control at each agency, with MFA on.

Lock your phone number

Your phone number is a recovery route for a lot of your accounts. Ask your carrier about a port-out PIN or number lock, so nobody can move your number to another carrier or SIM without it.

What good looks like: a carrier PIN or lock on the account, kept in your password manager.

Protect the logins to your financial accounts

Use a strong, unique password and MFA on your bank, card, brokerage and credit bureau accounts. A hardware security key is the strongest MFA option where a site supports one.

What good looks like: MFA on every financial login, and a hardware key for the accounts that matter most.

Watch for trouble

Check your credit reports

You can get your credit reports for free through AnnualCreditReport.com, the official site for free reports. Read them for accounts you don’t recognize, addresses you’ve never lived at and hard inquiries you didn’t make.

Signs to watch for: unfamiliar accounts, inquiries and addresses.

Credit monitoring

Credit monitoring tells you when someone pulls your credit or when something unusual shows up. With your credit frozen, new accounts are already hard to open, so monitoring matters less than the ads suggest. Free monitoring from a bureau, your bank or a card issuer covers the basics.

Paid services add monitoring at all three bureaus and help with cleanup if your identity is stolen. Some bundle identity theft insurance. Before you pay, check what you already have: many card issuers, banks and home insurance policies include some of this. Read what a policy actually covers, since many pay for expenses like paperwork and calls, not the money that was stolen.

What good looks like: alerts for new inquiries and new accounts, and clear terms on what recovery help covers. A freeze first, monitoring second.

Transaction alerts on every account

Turn on alerts for every credit card, debit card and bank account you have. You’ll know in real time when money moves or a card is used.

Some credit cards go further and let you limit use by category or location, or turn a card off entirely when you’re not using it. Set those up as well.

What good looks like: alerts by text or push for every transaction, not just large ones, and card controls you can switch on and off yourself.

USPS Informed Delivery

Sign up for USPS Informed Delivery, or the equivalent where you live. It shows you what mail is on its way. If you’re expecting something that matters, like a check, a new credit card or anything with identifying information on it, and it never shows up, you’ll know to start an investigation with the postal service.

What good looks like: a daily preview of incoming mail, and the habit of checking it when you expect something important.

Limit what a thief can take

Use credit cards, not debit cards

If you can only carry one, make it a credit card. A debit card is a direct link into your bank account, while a credit card isn’t. Under US law your liability for unauthorized credit card charges is capped at $50, and most issuers waive even that. With a debit card, the money leaves your account first, and your protection shrinks the longer you take to report it. The FTC explains the limits.

What good looks like: a card with strong alerts and card controls.

Reduce what’s out there to steal

Data brokers

Data brokers collect and sell your name, address, phone number and more, which makes it easier for someone to impersonate you or target you with phishing. You can opt out of each broker yourself for free, but there are a lot of them and they re-list you. Paid removal services do it on a schedule. They save time, but none reaches every broker, so treat them as a convenience, not a guarantee.

What good looks like: opt-outs from the largest brokers first and a recurring reminder to repeat them, or a service that lists which brokers it covers and re-checks regularly.

Your mail and your trash

Mail is still a source of the details thieves need. A locking mailbox keeps incoming mail from being taken. Shred anything with account numbers, your Social Security number or pre-approved offers before it goes in the trash, along with anything else that identifies you. Even small details like your name, address, birth date or the businesses you use can help someone impersonate you or talk their way into your accounts. A micro-cut shredder is best, since it turns paper into specks that are much harder to piece back together than strips or cross-cut pieces.

What good looks like: a mailbox that locks and a micro-cut shredder, not a strip cut one.

If it happens anyway

Move quickly and keep a record of everything you do.

1. Freeze your credit and place a fraud alert if you haven’t. The credit freeze checklist has every place to freeze.
2. Call the bank or card company, then change the passwords on any affected accounts.
3. Report the theft at the FTC’s IdentityTheft.gov. It builds a recovery plan and generates the paperwork for you, for free.
4. Keep copies of every report, case number and call.

What good looks like: a written record of every step, since you may need it months later.