How to Protect Your Identity Online: A Checklist

To protect your identity online, secure your email first, give every account its own long password in a password manager, turn on two-step verification or passkeys, freeze your credit if your country offers it, and treat unexpected messages as suspect until you have checked them yourself. None of this needs special skills, and most of it can be done in an afternoon. This guide walks through each layer, tells you what to do if your identity is used, and links to the official sources and to our more specific guides. We leave out statistics unless an official page gives them, and we do not recommend or rank any product.

One honest limit: credit-file rules, reporting agencies and legal protections differ by country. We give the US route in most detail because the FTC publishes clear guidance, and point to local bodies for the UK and Australia. Check your own national agency for current rules.

Do this now: the afternoon checklist

1. Secure your email first. The NCSC says to use a strong password for your email that you do not use anywhere else, because criminals can use your email to access many of your personal accounts. Reset links for other accounts land there, so it is the master key. If it was ever hacked, start with Gmail hacked? What to do in the first hour.
2. Use a password manager and a unique password everywhere. CISA advises passwords of at least 16 characters that are random, or a passphrase of four to seven unrelated words, and a different one for every account so one breach does not expose the others. CISA calls a password manager one of the easiest ways to protect your accounts, and notes some are free, such as those built into browsers. The NCSC suggests three random words as a way to build a password you can remember. Test a candidate in Password Strength or create one with the Password Generator.
3. Turn on two-step verification or passkeys. CISA recommends multifactor authentication, especially for email, social media and financial accounts, and the NCSC recommends 2-step verification for your online accounts. Where a service supports passkeys or an authenticator app, prefer them to text codes. Try the Passkey Lab to see how they work.
4. Freeze your credit (US). See the section below. It is free and takes a few minutes per bureau.
5. Lock your phone number. Ask your mobile carrier about a port-out PIN or number lock.
6. Update your devices and back up what matters. The NCSC says updates contain vital security fixes and advises keeping copies of your most important files, such as photos and key documents, on an external drive or cloud storage.
7. Look at what you have exposed. Run the Digital Footprint Check and review which old accounts you can close.

Credit freezes and fraud alerts

A criminal with your name and date of birth may try to open credit in your name. In the US, the FTC explains two tools. A credit freeze restricts access to your credit report. The FTC says there is no cost to place or lift a freeze, that it lasts until you lift it, that it does not affect your credit score and that you must contact all three bureaus: Equifax, Experian and TransUnion. A fraud alert is different: the FTC says it does not block lenders from seeing your report. An initial alert lasts one year and can be renewed, and you contact one bureau, which must notify the other two. An extended alert lasts seven years and needs an FTC identity theft report or a police report.

The trade-off: a freeze must be lifted when you apply for credit, a job check that uses credit or some rentals, so keep your bureau logins safe. UK and Australia: both countries have credit reporting bodies and fraud-reporting services, but the protections and names differ from the US. We do not describe them in detail here; start with your national fraud reporting agency (in Australia, Scamwatch and IDCARE) and ask what credit-file protection it recommends.

Phone number and SIM-swap protection

If a criminal moves your number to a SIM they control, text-message codes go to them. Ask your carrier what it offers, usually called a port-out PIN, number lock or account PIN, and set one. Names and steps differ by carrier, so use the carrier's own help page. Keep that PIN in your password manager, and do not give it to anyone who calls you. If your phone suddenly loses signal for no reason while you are not travelling, contact your carrier from another device. Our guide to how to know if your phone is hacked covers other signs.

Share less, and handle documents carefully

• Your birthday, home address and ID numbers are the raw material for identity theft. Share them only where a real reason exists, and leave them off public profiles. The Instagram, Facebook and TikTok checklists show how to limit what is public.
• Data brokers collect and sell personal details. Many offer opt-out forms, but rules and sites differ by country and the lists change, so we do not name a service. Opting out is slow and partial; do it for the biggest exposures, not as a weekly chore.
• Documents: CISA advises against writing passwords down or saving them in a file on your computer. The same instinct applies to scans of passports and tax papers: keep them out of email folders and shared drives, use an encrypted store where you can, and shred paper you no longer need. This is common-sense caution, not a rule from one agency.
• Old accounts: every forgotten account is a breach waiting to happen. Close what you do not use.

How to tell it is a phishing or impersonation attempt

Most identity theft starts with someone persuading you to hand over a detail: a link to a fake login page, a "bank" asking for a code, a "delivery" needing a fee. The habits are the same everywhere. Do not click links in unexpected messages. Contact the organisation on a number or site you already know. Never read out a one-time code to someone who contacted you. Treat urgency as a warning. Our guides on bank impersonation, Amazon scams and AI scams show what these look like, and the Voice Clone Fraud Defense Checklist helps families agree a way to verify each other.

Check breach exposure and watch your statements

Check whether your email address appears in known breaches, and change the password on any affected account (and anywhere you reused it). Then look at bank and card statements regularly and switch on transaction alerts, so a bad payment is seen in hours, not weeks. In the US, check your credit reports for accounts you do not recognise.

After a breach notice

1. Change the password for that service and anywhere it was reused.
2. Turn on two-step verification if it was off.
3. If the notice says financial or identity numbers were exposed, freeze your credit (US) and watch statements closely.
4. Expect follow-up phishing that uses the breach as bait. Go to the company through its official site, not through the message.

If your identity is used: recovery steps

1. Report it. US: the FTC points to IdentityTheft.gov to report and get a recovery plan. Australia: report scams to Scamwatch and contact IDCARE, which describes itself as offering personal identity-theft and scam recovery support with a response plan based on your situation. UK: report fraud through the police's national reporting service and tell your bank. Check your country's agency for current routes.
2. Freeze or place alerts on your credit file where your country allows it.
3. Contact the affected banks, lenders and services and ask them to close fraudulent accounts. Keep reference numbers.
4. Secure your own accounts: email first, then banking and anything sharing a password.
5. Keep records of dates, names, messages and screenshots.
6. Ignore "recovery" offers that ask for payment to get your money or identity back.

Trade-offs to weigh

• Password manager vs convenience: one master password guards everything, so make it long and turn on two-step verification for the manager.
• Passkeys vs text codes: passkeys and authenticator apps are generally harder to intercept, but not every service offers them and you need a recovery plan if you lose your phone.
• Freeze vs speed: a freeze blocks new credit but means lifting it before you apply for credit.
• Opt-outs vs effort: data-broker removal is partial and repeats, so aim at the largest exposures.

Prevent it next time: a checklist

• Email: unique long password plus two-step verification or a passkey.
• Password manager in use, with unique passwords for banking, shopping and social media.
• Credit frozen (US) or the local equivalent checked.
• Carrier port-out PIN set.
• Birthday and address kept off public profiles.
• Statement alerts on, and a monthly look at the account.
• A plan: you know where to report identity theft in your country.
• Rehearse it in the Identity Protection Lab.

Frequently asked questions

What is the first thing to do to protect my identity online?

Secure your email account. The NCSC says to use a strong password for your email that you do not use anywhere else, because criminals can use your email to reach many of your other accounts. Then turn on two-step verification there.

Is a credit freeze free, and does it hurt my credit score?

In the US, the FTC says there is no cost to place or lift a credit freeze, that it lasts until you lift it and that it does not affect your credit score. You contact each of the three bureaus: Equifax, Experian and TransUnion.

What is the difference between a freeze and a fraud alert?

The FTC says a fraud alert does not block lenders from seeing your report, unlike a freeze. An initial alert lasts one year and can be renewed; you contact one bureau and it must tell the other two. An extended alert lasts seven years and needs an FTC identity theft report or police report.

How do I protect myself from SIM swapping?

Ask your mobile carrier what protection it offers, such as a port-out PIN or number lock, and set one. Carriers differ, so check your carrier's own help page. Also prefer an authenticator app or passkey to text-message codes where a service offers it.

Where do I report identity theft?

In the US, the FTC points to IdentityTheft.gov. In Australia, Scamwatch takes scam reports and IDCARE offers identity-theft and scam recovery support. In the UK, report fraud through the police's reporting service and tell your bank. Check your national agency for current routes.

Do I need a paid identity-protection service?

The core steps here, such as a password manager, two-step verification and a credit freeze, do not require one. Whether a paid service adds value for you is a personal choice, and this post does not recommend any product.

Sources

• US Federal Trade Commission: What to know about credit freezes and fraud alerts
• US Federal Trade Commission: IdentityTheft.gov
• US CISA, Secure Our World: Use strong passwords (archived page; may not reflect current guidance)
• UK National Cyber Security Centre: Top tips for staying secure online
• Australia's Scamwatch (ACCC): report and learn about scams
• IDCARE: identity-theft and scam recovery support (Australia)

This is general guidance, not legal or financial advice. Credit-file rules, agencies and carrier features change and differ by country; follow the official pages above for current rules.