How to Prevent Identity Theft: Steps That Actually Help

You cannot make identity theft impossible, but a short list of habits removes most of the easy openings. Start with your email, then work outward.

By Siddharth ShankarUpdated October 11, 2026

Prevention is mostly about making yourself a harder target than the next person. Criminals prefer easy openings: a reused password, a public phone number linked to a bank account, a profile that answers every security question. This guide ranks the steps by impact, so you can do the most useful ones first.

It follows guidance from government security agencies such as the UK National Cyber Security Centre (NCSC), the US Cybersecurity and Infrastructure Security Agency (CISA) and the US Federal Trade Commission (FTC). If you want the background on what identity theft is, read our definition and examples first.

1. Secure your email before anything else

Your email address is the reset button for almost everything else. Anyone who controls your inbox can request password resets for your bank, shopping and social accounts. The NCSC lists a strong, separate password for your email as a core tip, together with turning on 2-step verification.

Give your email account a password you use nowhere else, and add a second step. If your email address has appeared in a leak, our guide on what to do when your email was in a data breach walks through the order of actions.

2. Use a password manager and stop reusing passwords

Attackers take passwords from one breach and try them against other sites, a technique called credential stuffing. OWASP describes it as the automated injection of stolen username and password pairs, and it works because many people reuse passwords. A password manager lets every account have a unique password without memorising any of them. Read credential stuffing explained for how a single leak spreads.

3. Prefer passkeys, then multi-factor authentication

The NCSC recommends passkeys over passwords wherever they are available, noting they resist phishing. CISA describes FIDO-based authentication as the only widely available phishing-resistant option. Where passkeys are not offered, keep strong passwords from a password manager and enable multi-factor authentication or 2-step verification.

4. Freeze your credit if you live where freezes exist

In the United States, a credit freeze stops lenders from seeing your report, which makes it difficult for a thief to open new accounts. The FTC says there is no cost to place or lift a freeze and that it does not affect your credit score. The freeze lasts until you lift it, and you must contact all three bureaus. Our guide to the credit freeze and when a fraud alert is enough has the details, plus notes for the UK and Canada.

5. Reduce what strangers can see

Public details help a thief pass identity checks and sound credible. Search for yourself, then work through the sources you can influence: old accounts, people-search listings and public profiles.

• Review what strangers can find about you online.
• Opt out of listings using our data broker opt-out guide.
• Close accounts you no longer use. Finding old accounts you forgot about shows how.

Removal is not permanent, because new records keep arriving, so treat it as maintenance rather than a one-off fix.

6. Treat messages as suspicious by default

Phishing is how many people hand over their own details. The FTC advises that legitimate companies do not email or text with a link to update your payment information. If a message creates urgency, do not click. Contact the organization using a website or phone number you already know is real.

7. Watch your accounts and credit reports

In the United States, you are entitled by law to a free report from each nationwide bureau every 12 months, and the bureaus have made free weekly checks permanent through AnnualCreditReport.com. Check bank and card statements for charges you do not recognize. Catching misuse early reduces the damage and the time it takes to fix.

8. Protect your tax and government accounts

In the United States, the IRS offers an Identity Protection PIN, a six-digit number that changes every year and helps stop someone filing a return in your name. Anyone with an SSN or ITIN can enroll. Other countries have similar protections, so check your tax authority's website.

A short priority list

1. Secure your email with a unique password and a second step. 2. Switch to a password manager and replace reused passwords. 3. Add passkeys or multi-factor authentication to important accounts. 4. Freeze your credit if it is available where you live. 5. Search for yourself and reduce unnecessary public exposure. 6. Review statements and credit reports on a regular schedule.