An identity protection checklist you can finish in one evening

Identity protection has a reputation for being an ongoing chore. Most of the real work is not ongoing at all: it is a set of one-off changes you make once and rarely touch again, plus a short routine you repeat a few times a year. This is the whole list, with the exact places to go. Everything on it is free.

Especially if a breach notice just arrived

Anyone who has not done these steps before, anyone who has just received a breach notification, and anyone helping an older relative or a child get set up. It is written for the United States, because that is where these specific free services exist.

If you are dealing with an active theft right now, skip the checklist and go straight to IdentityTheft.gov, which will build you a recovery plan for your situation.

The steps, in order of what they prevent

1. Place a credit freeze at all three nationwide bureaus: Equifax, Experian and TransUnion. Each is separate. It is free, it lasts until you lift it, and it does not affect your credit score.
2. Record how to lift each freeze somewhere you will find it later. You can lift at a single bureau if you know which one a lender will pull, and put the freeze back once the credit check is done.
3. Pull all three credit reports from AnnualCreditReport.com. That is the only authorised place for the free reports you are entitled to by law.
4. Opt out of prescreened credit and insurance offers at optoutprescreen.com or 1-888-5-OPT-OUT. Five years is done online or by phone; a permanent opt-out requires signing and returning the Permanent Opt-Out Election form.
5. Learn the four signs the FTC lists: a bill that stops arriving, charges for things you didn’t buy, withdrawals you didn’t make, and accounts in your name you don’t recognise.
6. Consider a fraud alert only as a supplement, not a substitute — it makes lenders verify your identity but does not block access to your credit report.
7. For a child, gather their birth certificate, a copy of their Social Security card, and your driver’s licence or other government-issued ID; those are what the prescreen opt-out requires for a minor.
8. Bookmark IdentityTheft.gov, ReportFraud.ftc.gov and IC3.gov now, so you are not searching for them under stress.
9. Save the phone routes too: 877-438-4338 for identity theft, 1-877-322-8228 for credit reports.

The one trap on the list

Only one step here can go wrong by taking you somewhere fraudulent, and it is the credit report. The FTC warns about lookalike sites that use terms like “free report” in their names, and about URLs that purposely misspell AnnualCreditReport.com.

The accompanying rule is worth memorising: AnnualCreditReport.com and the credit bureaus will not email you asking for your Social Security number or account information. Any message that does is not from them.

How often to redo it

• Freezes: once. They last until you lift them. Re-check after any occasion where you lifted one for a lender.
• Credit reports: you can now check each bureau weekly for free, so monthly or quarterly is realistic and no longer requires rationing.
• Prescreen opt-out: renew before the five years expire, or make it permanent with the signed form.
• Fraud alerts, if used: an initial alert lasts one year and can be renewed.
• Prescreened offers: expect them to keep arriving for several weeks. Requests are processed within five days but the mail takes longer to stop.

What this checklist does not cover

It covers credit-based identity theft, which is what the freeze blocks and the reports reveal. It does not cover a compromised email account, a stolen phone, or fraud on an existing card, and it will not remove your details from people-search sites — the FTC’s separate guidance on those notes that opt-outs are impermanent, incomplete and do not touch public records.

It also does not detect anything by itself. Detection is the reports; prevention is the freeze; recovery is IdentityTheft.gov. Keeping those three straight is most of what makes the subject manageable.

Nor does it cover the moment of attack. If a message asks you to confirm personal or financial details, the rule is CISA’s: look up another way to contact the company or person directly, rather than using any number or link the message supplies.

Sources: FTC — What to know about credit freezes and fraud alerts · FTC — Free credit reports · FTC — What to know about prescreened offers of credit and insurance · FTC — What to know about identity theft · FTC IdentityTheft.gov

Reviewed 27 August 2026 by the CyberArtical editorial team against primary guidance from the FTC. Security guidance changes over time; where our earlier version of this page said something different, we say so in the article rather than editing it out quietly.