How to Prevent Identity Theft: A Complete Guide

Most identity theft starts with small pieces of information rather than one big break-in. A delivery text you tapped, an old password reused on several websites, a form filled in on a copied bank page, or paperwork thrown away without shredding. On their own these look harmless. Put together, they are often enough for someone to convince a company that they are you.

That is why prevention is mostly about a handful of ordinary habits, not about being good with computers.

• A letter, email or app notification about an account you did not open.
• Bills or statements that stop arriving, which can mean post has been redirected.
• Small unfamiliar payments on your card, often used to test whether the card works.
• Being turned down for credit when you did not expect it.
• Calls or messages about a delivery, refund or bank problem that you were not expecting.
• Being locked out of an email or social media account you have used for years.

Your credit report lists the accounts and loans that exist in your name. It is the clearest place to spot an account that is not yours. Check it a few times a year rather than once, because problems are far cheaper to fix early.

• Read every account listed and confirm you recognise the company and the date it opened.
• Check that your address history is correct, since a strange address can mean post is being sent elsewhere.
• Look at recent searches or enquiries, which show who has checked your file.
• Dispute anything you do not recognise with the credit agency straight away.

In the United States you can request your reports from the three main agencies at annualcreditreport.com, the official site set up under federal law. In other countries the equivalent national credit agencies offer the same service, sometimes free and sometimes for a small fee.

A credit freeze, sometimes called a security freeze, stops lenders from seeing your credit file. If they cannot see it, they will not approve a new account, which blocks one of the most common forms of identity theft.

• A freeze is free to place and free to lift in the United States.
• It does not affect your existing cards, accounts or credit score.
• You can lift it temporarily when you genuinely apply for something.
• You must place it separately with each credit agency.

If you do not plan to apply for credit soon, a freeze is one of the strongest single steps available, and it costs nothing.

Two-factor login means that a password alone is not enough to get into your account. A second step is needed, usually a code from an app or a prompt on your phone. Even if someone learns your password, they are stopped at that second step.

• Start with your email account, because it can be used to reset every other password.
• Then add it to online banking, and to any shopping account that stores a card.
• Prefer an authenticator app or a prompt on your phone over codes by text message where the choice is offered.
• Use a different password for every important account, and let your phone or browser remember them for you.
• Never read a login code out loud to someone who calls you. No genuine bank will ever ask for one.

Phishing is a message designed to look like it comes from a company you trust. The goal is to get you to tap a link and type your details into a copied page. Modern examples are well written and can quote real details about you, so the old advice about spelling mistakes is no longer enough.

• Urgency is the strongest signal. Genuine organisations do not demand action within minutes.
• Be careful with anything unexpected, especially about a delivery, refund, fine or account problem.
• Hover over or long-press a link to see the real address before tapping it.
• Never move money to a 'safe account'. Banks do not ask this, and it is a standard fraud script.
• When in doubt, close the message and contact the company yourself using a number from your card or a statement.

Not all identity theft happens online. Paper still carries a great deal of personal information.

• Shred anything with your name, address, account numbers or signature before throwing it away.
• Redirect your post promptly when you move house.
• Keep passports, birth certificates and card statements somewhere secure at home.
• Do not send photos of documents through messaging apps or email unless you are certain who is receiving them.
• Tell your bank if statements stop arriving when you expect them.

Criminals often target older relatives, and the most common tactic is pressure. A caller says there is an emergency, that a grandchild is in trouble, or that money must be moved immediately.

• Agree a simple family rule: no money is ever moved because of a phone call, without speaking to one other family member first.
• Agree a family phrase that a real relative would know, in case of a distressing call.
• Make it clear that hanging up is always acceptable and never rude.
• Check in about unusual calls or messages regularly, so nobody feels embarrassed to mention one.

If you think your details have been used, acting quickly limits the damage. Many people recover money that was taken, and being a victim is nothing to feel ashamed of. These schemes are professionally run and they succeed against careful people every day.

• Call your bank immediately and ask them to freeze the affected cards or accounts.
• Change the password on your email first, then on any account that used the same password.
• Place a freeze or fraud alert on your credit file.
• Report it to your national fraud reporting service and get a reference number.
• Write down dates, amounts and who you spoke to, since you will be asked for this later.