How to protect yourself from identity theft — and what to do if it happens

Identity theft is when someone uses your personal information — your name, Social Security number or account details — to open accounts, file a tax return or make purchases in your name. You can't make it impossible, but a few free steps make it much harder, and knowing the recovery steps makes it faster to fix.

Free steps that make identity theft harder

• Freeze your credit. A freeze stops anyone from opening a new credit account in your name. It's free to place and to lift, doesn't affect your credit score and stays on until you lift it — but you have to contact each of the three bureaus: Equifax, Experian and TransUnion.
• Check your credit reports. The three bureaus have permanently extended free weekly reports. Order them only at AnnualCreditReport.com or by calling 1-877-322-8228: imposter sites purposely misspell the address, and the official site won't email you asking for your Social Security number.
• Get an IRS Identity Protection PIN. It's a six-digit number, new every calendar year, that helps stop someone else from filing a tax return with your Social Security number. Anyone with an SSN or ITIN who can verify their identity can get one in their IRS online account — and the IRS will never ask you for it by phone, email or text.
• Question requests for your Social Security number. Organizations that already have it won't call, email or text you to ask for it, the FTC says.
• Shred documents with personal information and collect your mail promptly.
• Turn on two-factor authentication for your email, bank and credit card accounts.

Credit freeze or fraud alert?

A fraud alert tells businesses to verify your identity before opening credit in your name. An initial alert lasts one year and can be renewed; identity theft victims can get an extended alert that lasts seven years, and service members a one-year active-duty alert. Unlike a freeze, you only contact one bureau — it must tell the other two. A freeze is the stronger block on new accounts. Neither stops someone misusing an account you already have, so keep an eye on your statements too.

Warning signs of identity theft

• Accounts or charges on your credit report that you don't recognize.
• Bills, statements or other mail that stop arriving.
• Debt collectors calling about debts that aren't yours.
• Medical bills for care you didn't receive.
• A notice from the IRS that more than one tax return was filed in your name, a rejected e-filed return, or W-2 forms from employers you never worked for. The IRS notes these don't always mean identity theft — but they're worth checking.

If your identity is stolen: the first steps

1. Call the companies where the fraud happened — the bank, card issuer or store — and ask them to close or freeze the accounts.
2. Place a fraud alert with one credit bureau, and get your free credit reports.
3. Report it to the FTC at IdentityTheft.gov. You'll get a personal recovery plan; if you create an account, the site tracks your progress and pre-fills the letters you send to businesses and credit bureaus.
4. Close new accounts opened in your name, ask the credit bureaus to remove fraudulent information, and consider a credit freeze or an extended fraud alert.
5. You can also file a report with your local police department. IdentityTheft.gov presents it as an option, not a requirement.

Is identity theft protection worth paying for?

Paid services watch your credit and personal information, alert you to changes and — on some plans — give you recovery help from case managers and limited insurance. They don't prevent identity theft, and the FTC points out the gaps: credit monitoring won't flag withdrawals from your bank account or a fraudulent tax return, and identity theft insurance generally won't reimburse money scammers stole. Everything in the free steps above you can do yourself.

Where a paid plan earns its place is convenience and help: one place that watches many kinds of information, and a person to call if something goes wrong. In the US, some antivirus suites sell it as an add-on tier — Norton 360 with LifeLock, and McAfee+ Advanced and Ultimate, for example. Compare what each tier monitors and what its reimbursement terms say before you pay.

A credit freeze costs nothing and stops new credit accounts being opened in your name. Do the free steps first; pay for convenience, not for protection you could switch on yourself.