How to Protect Yourself From Identity Theft: A Practical 2026 Plan

The most effective way to protect yourself from identity theft is to freeze your credit at all three bureaus, lock down your important online accounts with unique passwords and multifactor authentication, and check your credit reports regularly so you catch problems early. In the U.S., the main tools for this, including credit freezes, fraud alerts, weekly credit reports, and the IRS Identity Protection PIN, are free.

Below is the order we’d actually do things in, plus what to do if someone has already used your information. Details are current as of October 2026, but government programs and bureau websites do change, so confirm on the official pages linked here.

Step 1: Freeze your credit at all three bureaus

A credit freeze blocks lenders from pulling your credit file, which makes it very hard for a thief to open new credit cards or loans in your name. Since a 2018 federal law, freezing and unfreezing your credit is free nationwide, according to the FTC’s announcement of the law.

1. Go to the official freeze page of each bureau: Equifax, Experian, and TransUnion. You have to do all three separately; a freeze at one does not carry over.
2. Create an account or note the PIN you are given. You’ll need it to unfreeze (lift) and refreeze later.
3. Store those credentials in a password manager, not in an email draft or a note on your phone.
4. When you apply for a loan, card, or new phone plan, lift the freeze temporarily at the bureau the lender uses, then let it re-lock.

A freeze stays in place until you remove it. You can still apply for jobs, rent an apartment, or buy insurance while frozen.

The big caveat: the FTC warns that many people assume a freeze stops all identity theft. It does not. It won’t stop someone from misusing a credit card or bank account you already have, which is why the next steps matter.

Step 2: Know when a fraud alert makes sense

A fraud alert is a lighter tool. Lenders can still see your file, but they’re asked to verify your identity before opening new credit.

A fraud alert is useful if you think your data was exposed (a lost wallet, a breach notice) and you want quick protection with one phone call or form. Many people use both: a freeze for strong protection and an alert as an extra flag. The one-year standard alert and seven-year extended alert come from the same 2018 law; before that, a standard alert lasted only 90 days, so older articles may still quote the shorter period.

Step 3: Check your credit reports, often

Freezes stop new accounts, but you still want to see what’s on your file. The three bureaus permanently extended free weekly credit reports in 2023, after starting the program during the pandemic in 2020, as noted by the New Hampshire Banking Department and the FTC.

• Use AnnualCreditReport.com, the official site. The FTC warns that look-alike sites may charge you or be set up to steal your personal information.
• Look for accounts you don’t recognize, addresses you’ve never lived at, and hard inquiries you didn’t authorize.
• If weekly feels like too much, a simple routine is to pull one bureau’s report every few months, rotating through all three.

Step 4: Get an IRS Identity Protection PIN

Tax identity theft happens when someone files a return with your Social Security number to grab a refund. A credit freeze does nothing about this. The IRS Identity Protection PIN is designed to block that: it’s a number known only to you and the IRS that verifies your identity when a return is filed under your SSN or ITIN.

1. Sign in to (or create) your IRS online account and verify your identity.
2. Request the IP PIN from your account’s Profile page.
3. Retrieve the new PIN each year. It’s valid for one calendar year, and if you enrolled online, the IRS won’t mail it to you.

Anyone with an SSN or ITIN can get one, including people living abroad. If online identity verification fails, the IRS offers alternatives such as Form 15227 or an in-person appointment at a Taxpayer Assistance Center. One timing note for right now: the IRS has typically taken the online IP PIN tool offline from mid-November until mid-January, so if you want to enroll before the next filing season, check the IRS page soon.

Step 5: Lock down your logins and devices

Much identity theft starts with a hijacked email account, since that’s where password resets go. The four basics in CISA’s Secure Our World campaign are a good checklist:

1. Use long, random, unique passwords for every account, generated and stored by a password manager.
2. Turn on multifactor authentication (MFA) everywhere it’s offered, starting with email, banking, and social media. MFA isn’t foolproof, but it stops most password-only attacks.
3. Recognize and report phishing. Be suspicious of unexpected messages or calls asking for personal information, and don’t click links or open attachments from senders you don’t know. Contact the company directly using a number or website you already trust.
4. Keep software updated. Turn on automatic updates so your phone, computer, and router get security patches.

A few habits round this out: shred documents with your SSN or account numbers, don’t give out your SSN unless there’s a real need, and be careful entering logins on public Wi-Fi.

What to do if your identity is stolen

Move quickly, and keep notes of every call, date, and reference number. The FTC’s recovery guidance, summarized in its Identity Theft: A Recovery Plan publication, centers on these steps:

1. Call the fraud departments of the companies where the fraud happened. Ask them to close or freeze the affected accounts and change your passwords and PINs.
2. Place a fraud alert with one credit bureau (it notifies the other two), and get your credit reports.
3. Report it at IdentityTheft.gov (or call 1-877-438-4338). The site builds an Identity Theft Report and a personalized recovery plan. Creating an account lets you track progress and pre-fill letters; if you skip the account, save your documents before you leave the page.
4. Use your Identity Theft Report to dispute fraudulent accounts and charges, request an extended seven-year fraud alert, and exercise rights the report gives you under federal law.
5. Consider a police report, especially if a business or creditor asks for one. Bring a copy of your FTC report.

IdentityTheft.gov also has separate guidance for tax, medical, and child identity theft, which each have their own extra steps.

Our take

If you only do three things this week: freeze your credit at all three bureaus, turn on MFA for your primary email, and get an IRS IP PIN before the online tool closes for the season. All three are free and take an evening at most. Paid identity protection services can add monitoring, but they don’t replace these official tools.