Defensive Protocols to Prevent Identity Theft

Securing your personally identifiable information (PII) is the primary defensive objective. A significant portion of your PII is highly accessible due to endemic third-party database breaches and public registry indexing.

Implement the following comprehensive prevention protocol:

• Enforce Cryptographic MFA: Secure all online logins with TOTP or physical keys. Avoid SMS authentication whenever possible to eliminate SIM-swapping risks. Use a dedicated password manager to generate and store unique, complex credentials.
• Proactive Taxpayer Protection: Establish an online account with the IRS to monitor tax transcripts. Proactively check your transcripts to verify no fraudulent income has been reported in your name. Request an Identity Protection PIN (IP PIN) to block unauthorized electronic tax filings.
• Social Security Administration Safeguards: Establish a secure online portal account, mySocialSecurity, with the Social Security Administration (Social Security Administration). This prevents threat actors from registering an account in your name to redirect benefits or falsify employment records, allows you to monitor contributions and income data, and verifies that no one is using your SSN to claim benefits or sign up for unauthorized work.
• USPS Informed Delivery: Register for the U.S. Postal Service’s Informed Delivery service. This provides daily digital previews of physical mail, allowing you to instantly detect unauthorized change-of-address requests or mail theft.
• Rigorous Financial Statement Auditing: Scrutinize banking and credit card statements regularly. Report discrepancies immediately. Both statutory dispute windows run 60 days from when the statement was transmitted, not when you opened it: Fair Credit Billing Act (FCBA) ( 15 U.S.C. §1666) for credit cards, Electronic Fund Transfer Act (EFTA) ( 15 U.S.C. §1693f) for debit and ACH. Miss the debit window and your liability becomes unlimited (section “Debit Cards: Structural Risk and Liability Exposure”), which is the entire argument for reading statements on a calendar schedule instead of waiting until something feels wrong.
• Retrieve Annual Credit Reports: Check your credit file annually via annualcreditreport.com at each of the major credit reporting agencies— Equifax, Experian, and TransUnion—as well as the specialty bureau Innovis, ensuring no unauthorized accounts have been opened under your name.
• Physical Document Security: Keep sensitive paper documents—such as your Social Security card, passport, and birth certificate—in a high-security home vault or a safe-deposit box. Note that safe-deposit box contents are not FDIC insured and are generally not covered by the bank against loss — the lease disclaims it — so anything irreplaceable or valuable inside needs a scheduled personal property rider on your homeowner’s policy (section “The Coverages the Standard Stack Misses”). Shred all documents containing personal or account numbers before disposing of them.
• Device and Network Defense: Install firewalls and reputable antivirus software on all devices. Regularly update these security features to protect your systems from emerging malware and exploits.
• Phishing Countermeasures: Be highly cautious of emails, text messages, or phone calls soliciting personal details or directing you to suspicious links. Legitimate financial institutions will never request sensitive data via unsecured channels. Report phone scams to the Federal Trade Commission (FTC) at ReportFraud.ftc.gov, and use the streamlined form at DoNotCall.gov if no money was lost. Review further guidance on FTC phone scams.
• Information Exposure Minimization: Be aware of to whom you disclose personal data, both online and offline. Never disclose unnecessary details on social networks, public profiles, or to unverified platforms.
• Encrypted Data Storage: Ensure all financial records are stored securely. Use strong, unique passwords and robust encryption for all sensitive personal spreadsheets, tax returns, and local financial data.

• Execute Credit Freezes: Place a permanent security freeze on your credit files. A freeze blocks new creditors from pulling your report, which is what stops a thief from opening an account in your name. Three things worth knowing, because the bureaus have an interest in your not knowing them:

  • Freezes are free, by statute, at every bureau, since the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 amended FCRA §605A. So is lifting one, and the bureau must act within one hour of an electronic request.
  • A “credit lock” is not a freeze. Locks are contractual products the bureaus market — sometimes bundled into paid monitoring — and they carry only whatever protection the terms of service promise, revocable at the bureau’s discretion. A freeze is a statutory right with statutory remedies. Take the free one.
  • You must freeze each bureau separately — Equifax, Experian, TransUnion, plus Innovis — and separately again at ChexSystems and NCTUE if you want deposit accounts and utility/telecom accounts covered.

  A freeze is strictly stronger than a fraud alert, which merely requires creditors to take reasonable steps to verify identity. Use the alert when you want one phone call and partial protection; use freezes when you want the door actually locked.

• ATM Skimming and Payment Defenses: Understand the mechanics of ATM skimming. Maximize the use of contactless, tokenized payment methods (such as Apple Pay or Google Pay) or physical EMV chip insertion; avoid swiping magnetic strips.