7 effective steps to protect your identity during Cybersecurity Awareness Month

Cybercrime is on the rise. Americans lost $12.5 billion to online scams last year, according to the FBI. That’s a record amount and a 22% spike from 2022.

So how do you deal with these ongoing and ever-sophisticated threats? To celebrate Cybersecurity Awareness Month, Checkbook has a list of seven things you can do right now to fight back.

It’s important to realize that you are up against international organized crime rings. The hackers have breached so many databases in the past few years that you should assume your personal information has been stolen – and is for sale on the dark web. So, you need to respond accordingly.

Yes, you still must be careful when you go online or are asked to provide personal information. But you also need to take steps to put up barriers to thwart the identity thieves who could use your stolen information to open bank accounts or credit card accounts in your name.

Here are seven ways to do that:

Freeze Your Credit Reports

A credit freeze (also called a security freeze) locks your credit file, making it difficult for thieves to open new accounts in your name. Potential creditors won’t approve new credit card or loan applications submitted by bad guys, or allow them to open new bank accounts using your stolen identity info. Your current creditors will still be permitted to check your files, and initiating a freeze won’t impact your credit scores.

Place freezes with each of the three big credit bureaus—Equifax, Experian, and TransUnion. It’s free, and you can do it online quickly—certainly in less time than undoing the damage caused if you have your identity stolen.

“Freezing your credit is the most robust and proactive consumer protection step you can take to protect your identity. It stops the thieves in their tracks,” Velasquez told Checkbook. “Even if someone has all of the identity credentials necessary to impersonate you and attempt to open new accounts, they still can’t do it.”

Federal regulations require the credit bureaus to put your report on ice within one business day of receiving a request online or over the phone, and within three business days of getting a mailed-in request.

If you wish to apply for credit—including signing up for new cell phone or utility services, or trying to rent an apartment—you can temporarily lift the freeze by logging on to your accounts at each credit bureau’s website. Those bureaus must unlock your file within an hour.

Note: Credit bureaus will try to sell you monitoring services or other costly products. They’re useless (see the end of this article for more info).

Use Multi-Factor Authentication

You should use a strong and unique password for each of your financial accounts (see below). But because even the best password can be compromised (or stolen during a data breach), sign up for multi-factor authentication (MFA).

MFA means that to log into an account, you’ll enter both a password and use at least one other identifying factor (fingerprint, facial recognition, or entering a code from a text, email, phone call, or authentication app). It’s not foolproof, but MFA can stop most hackers from using stolen passwords. (If you receive an authentication code when you’re not trying to log into an account, it could mean a thief is trying to break into it. Better investigate.)

Regularly Check Your Credit Reports

Use AnnualCreditReport.com at least twice a year to obtain your reports with Equifax, Experian, and TransUnion. Other websites offer free credit reports, but AnnualCreditReport.com was set up by the federal government and is the only one you should use. And if you search the internet for “free credit report,” you might land on a scammer’s website.

Review your reports for warning signs of identity theft, such as accounts you didn’t open or a false history of late payments.

Set Up Alerts for Credit Card and Bank Accounts

The sooner you spot identity fraud the easier it is to undo the damage and prevent future problems. Use the security section for the websites of your credit cards and banks to set up account alerts that notify you of transactions in real time. For example, you can get a message any time there’s an ATM withdrawal, an online or phone transaction, a deposited check, a foreign transaction, or a wire transfer. To avoid getting a text or email every time your spouse orders a pizza, you can customize alerts. But know that even a small charge or deposit could be a criminal testing your credit card or debit card account with a stolen number.

Read your “explanation of benefits” statements

These reports from your health insurance provider list the medical purchases—prescription drugs, medical supplies, treatments, tests, procedures, and doctor visits—that have been billed to your health insurance policy.

Because this notice usually says “THIS IS NOT A BILL” at the top, it’s easy to ignore. It doesn’t take that long to read, and it could be your first indication that something is wrong.

Make sure you recognize the goods, services, and appointments listed. If you don’t, ask questions. Should you find a procedure that you didn’t have done, the purchase of prescription drugs that you don’t take, or a doctor visit that didn’t happen, a thief could have stolen your medical information.

More Info from Checkbook: Stay Alert for Medical Billing Fraud

Monitor Your Credit Scores

Credit scores are generated from the information in your credit files. Most banks and credit card companies now give customers access to free credit score information to help them guard against identity theft.

If you have good credit, and your score suddenly drops for no obvious reason (you didn’t max out your credit cards or make late payments), that could signal that an identity thief has opened accounts in your name and is racking up debt.

Respond to Data Breaches Notifications

If you receive a data breach notification, and it has anything to do with your username, password, or login credentials, you should immediately change that password. And change it to one you haven't used before. It's really important not to reuse the same easy password across multiple accounts.

The data breach notice will probably offer free credit monitoring for a few years. If it’s free, and you don’t already have it from a previous breach, there’s no harm in signing up.

What to Do If You’ve Been a Victim of Fraud

Immediately contact your credit card company, bank, or investment brokerage and report the crime. In most cases, it will return the stolen funds or remove fraudulent charges.

If you haven’t already frozen your credit files with Equifax, Experian, and TransUnion, do so. Then, instruct at least one of them to place a fraud alert on your account. That will require all the credit bureaus to notify other companies about the alert, and they then must take additional steps to verify your identity before opening new accounts or raising your credit limits.

File a report with your local police department. Chances are it doesn’t have the resources to investigate, but doing so will document that you took steps to prevent future criminal activity and possible financial losses.

Also file a report at IdentityTheft.gov, a website run by the Federal Trade Commission. It also provides info on any legal rights you have to help recover from the crime.

The nonprofit Identity Theft Resource Center (ITRC) provides free support and guidance to victims, or those who want to learn about protecting themselves. You can speak to a live advisor by calling 888-400-5530 or live chat with one by visiting its website.

More from Checkbook: Identity Theft and Fraud: How to Protect Yourself

Consumers’ Checkbook magazine and Checkbook.org is a nonprofit organization with a mission to help consumers get good service and low prices. It does this by providing unbiased ratings, advice, and price information. Checkbook is supported by consumers and takes no money from the service providers it evaluates. You can reach Herb at his website ConsumerMan.com.