Build a Do It Yourself Identity Theft Protection System

Are you concerned about identity theft? If you aren’t, you should be.

Data from the Federal Trade Commission showed that consumers lost more than $12.5 billion due to fraud in 2024 – a 25% increase over the previous year.

• 3,322 data compromises in 2025 – the highest ever recorded (Source: ITRC).
• In 2024, the FTC received more than 1.1 million complaints of identity theft and 2.6 million complaints of related fraud.
• 847,000 imposter scams – that’s where a thief pretends to be a trusted organization like a bank, government agency, or similar to trick you into sending them money.
• Account takeover scams increased by 250% in 2025.
• 31% of Americans reported being victim of a scam in 2024.
• There were 3,322 “data compromise events” (AKA data breaches) in 2025, a 5% increase from 2024.

Haywood Talcove, CEO of government at LexisNexis Risk Solutions, warns that “Everyone’s identity has already been stolen. The only question is, has it been used?”

Companies will sell you identity theft protection for $15 a month, which is a pretty good deal, but what if you want protection but don’t want to spend $180 a year to get it?

Here’s how to build your DIY identity theft protection system for free:

Table of Contents

1. 1. How to Improve Data Hygiene
1. 🪪 Never Carry Your Social Security Card
2. 🔒 “Lock” Your Social Security Number
3. 📫 Secure Your Physical Mail
2. 2. How to Improve Account & Device Security
1. 👤 Don’t Answer Unknown Callers
2. 🫸 Turn On Carrier-Level Spam Blocking
3. 🤓 Be Smart About Passwords
4. 💻 Secure Your Internet Traffic
5. 📧 Secure Your Email
3. 3. How to Monitor & Secure Your Credit
1. 🧊 Freeze Your Credit Report
2. 🔎 Review Your Credit Reports
3. ⚠️ Set Up Fraud Alerts
4. 🎦 Sign Up for Free Monitoring
5. 🔢 Monitor Your Credit Scores
4. 4. How to Check for Strange Activity
1. 👷 Register for Equifax Work Number
2. 💳 Set Credit Card Transaction Alerts
3. 🧹 Remove Personal Information From Data Brokers
4. 📵 “Number Lock” Your Phone Number
5. 5. Are Identity Theft Protection Services Worth It?
1. What These Services Offer
2. Are They Worth It?

1. How to Improve Data Hygiene

If you’re too casual with your personal data, then thieves will be able to take advantage. Here’s what you should do to improve your data hygiene.

🪪 Never Carry Your Social Security Card

Unless there’s a specific reason, never carry your social security card!

It’s a flimsy piece of paper and there are zero cases you need your physical card. Knowing your number is enough, no one will every ask you to produce your card. If they say they need your card, it’s because they don’t trust that you remembered it correctly, they never need the card itself.

And if you ever lose your wallet, the thief now has everything they need. Your name and address will be on your driver’s license and the holy grail of identity thieves, your social security number, is right next to it.

Please leave the Social Security Card at home.

🔒 “Lock” Your Social Security Number

First, create a mySocialSecurity account as soon as possible. This prevents someone else from creating one with your information.

Next, there are two ways to lock your Social Security Number:

1. “Self Lock” E-Verify – You’ll need to create a myE-Verify account and then go through the Self Lock process. This stops anyone from trying to get a job and putting your SSN. When the employer runs your SSN through E-Verify, it’ll come up as a “mismatch” and stop the hiring process. The lock lasts for a year and you will need to renew it or it expires.
2. Social Security Administration “Block Electronic Access” – This is the nuclear option and most people won’t need this, but you can block all electronic access to your account – this includes you too. To activate and deactivate this, you have to contact the Social Security Administration. Call or visit a local SSA office – it can’t be done online.

📫 Secure Your Physical Mail

One of the attack vectors will be through your postal mail. Here’s how to protect yourself.

Sign up for Informed Delivery

Informed Delivery is a free USPS service that emails you a summary of your mail each morning. By signing up, you will know what you’re supposed to get each day and double check no one else took it. Verifying your identity can be a bit clunky (at least it was when I signed up a few years ago) but it’s worth it the added effort.

You will also get notifications of packages too, including expected date of arrival.

Watch for a “Move Validation Letter”

Especially if you haven’t moved!

A thief may try to change your address… fortunately the USPS will send a Mail Validation Letter to the new and old address. If you get one of these but never requested a change, call the 800 number immediately. This is a sign you’re under attack.

If you are going to be away from your mailbox, request a hold. The hold can be for 3 to 30 days and is free.

Some monitoring companies subscribe to the National Change of Address Linkage (NCOALink) service, which contains all the change of address records. They can offer to monitor any change of addresses because they get access to that database for a fee. It’s not feasible for an individual to do.

Consider Using a P.O. Box

Your mailbox is probably just a box with a lid. If it doesn’t have a lock, it’s completely insecure. And since your mail is often delivered during the day and you are probably working during the day, it’s just sitting there.

A thief could open it, steal your mail, and just walk away. No one would ever know!

While I think the risk of this is low, if it’s ever happened to you then you know how much of a headache it can be.

The defense against this is to use a PO Box for your financial correspondence. This means all financial accounts so if you do get pre-approved offers of credit, they all go to a secure and locked box at the post office.

Stop Getting Junk Mail

OptOutPrescreen.com is your friend. By registering on the site, you can prevent unsolicited offers of credit or insurance, which is one of the easiest ways for someone to steal your credit. Your mailbox is probably insecure so someone could just reach in, steal an application, and get themselves a credit card in your name pretty easily. This website makes it so that you don’t get firm offers for five years (or permanently if you mail a form you print from the site).

If you have an existing relationship with a company, this will not stop those offers. If you have an American Express card, AMEX can still send offers of credit because there’s a pre-existing relationship. To stop that, you’ll need to call them.

(If you want to stop other junk mail, Catalog Choice is a great resource for catalogs and DMAChoice is good for all other direct mail)

2. How to Improve Account & Device Security

👤 Don’t Answer Unknown Callers

Most phone scams start with someone calling you and you picking up. You can stop that by not picking up. It’s almost never really your bank or brokerage, it’s not the police, it’s just a scammer.

Here’s how to deal with unsolicited scam & fraud calls if you cannot resist the urge to send them to voicemail.

If you are uncomfortable letting unknown callers go to voicemail, at least set up Call Screening:

• For Android phones
• For iPhones

🫸 Turn On Carrier-Level Spam Blocking

Many carriers offer call filtering that flags known scam numbers, automatically silences high-risk calls, and learns from the network so it continues to get better:

• Verizon Call Filter
• T-Mobile Scam Shield
• AT&T ActiveArmor
• U.S. Cellular Call Guardian
• FCC list of Call Blocking Tools & Resources

🤓 Be Smart About Passwords

We know we shouldn’t use insecure passwords. We know we shouldn’t reuse passwords. We know we shouldn’t write them down. (you can check if a password has been revealed in a data breach)

But we all do it. I do it too. It’s too many to remember.

The best solution is to use a password manager that remembers for you and is secure.

If you need one, check out 1Password. It’s extremely cheap and can solve this problem for good.

💻 Secure Your Internet Traffic

When you log into your accounts online, there’s a really good chance it is already encrypted because of HTTPS. Most websites on the internet use HTTPS, the S stands for Secure, and all financial institutions use it. Your traffic is encrypted and secure.

If you want an extra level of “protection,” you can use a VPN, or virtual private network. This is when you log into another server and route all of your traffic through that server. This gives you an extra layer of protection, as the websites your visiting won’t know your real IP address (though there are ways for law enforcement to figure it out).

You probably don’t need a VPN. But if you want one and don’t want to pay, Wirecutter recommends Proton VPN as the best free VPN. If you want to pick your servers and get greater control, you can pay for a VPN like NordVPN.

📧 Secure Your Email

I use a secure “classified” email address for my financial accounts. I never log into it outside of my home, I never use it for anything other than financial services, and I keep it separate from everything else.

The goal here is to never reveal it to anyone except banks, brokers, etc. You want it 100% segregated so it never appears in any databases so you don’t get phishing emails.

3. How to Monitor & Secure Your Credit

When identity theft occurs, it will involve your credit reports.

🧊 Freeze Your Credit Report

This is the best option way to protect your credit – put a freeze on your credit report. A freeze restricts access to your credit report, which means creditors will not be able to see it and be willing to extend you any credit. This, in turn, makes it harder for thieves to steal.

Freezing your credit report is free. Congress amended the Fair Credit Reporting Act to require credit bureaus to offer a credit freezes for free.

Here are the links to how to freeze your report at each of the three major bureaus:

• Placing an Equifax Credit Freeze
• Placing a TransUnion Credit Freeze
• Placing an Experian Credit Freeze

You can freeze and unfreeze online or through an app, it’s that easy.

🔎 Review Your Credit Reports

The Fair Credit Reporting Act gave you the right to see your credit reports once every 12 months. I used the Waterfall Method and stagger my requests so I see a credit report every 4 months.

But as a result of the pandemic, the bureaus now let you get your credit report every single week. That’s way too often but it’s nice to have that flexibility. Go to AnnualCreditReport.com to get your free reports.

⚠️ Set Up Fraud Alerts

Each of the credit bureaus will let you set up 90-day fraud alerts on your account. There are typically two types of fraud alerts, an “initial” alert, and an “extended” alert. The initial alert is for people who are worried they could be a victim of ID theft – that’s you. If you are already a victim, you want an extended fraud alert, which is active for 7 years. The extended request is much more involved and will require you to prove you were a victim of ID theft.

If you set up a fraud alert at one bureau, it will notify the other two, so pick the one you like best:

• TransUnion Fraud Alert
• Experian Fraud Alert
• Equifax Fraud Alert

🎦 Sign Up for Free Monitoring

Did you know that all of the credit bureaus offer free monitoring?

Experian and TransUnion always had programs but the recent Equifax hack pushed Equifax to offer theirs for free too.

• Experian Creditworks Basic – No credit card required, free, and they will email you if your account gets an inquiry.
• Transunion TrueIdentity Free – No credit card required, free, and you can lock your credit report for free plus text notifications of suspicious activity.
• Equifax Trusted ID Premier – Most recent one, as a result of the Equifax hack, and you can lock your Equifax report through this system too.

🔢 Monitor Your Credit Scores

There are several “credit scores” out there, the most “official” one is the FICO credit score.

For identity theft monitoring purposes, you don’t need to see your FICO score. Get any score that is based on a Big Three credit reporting bureau (Equifax, Experian, TransUnion) report.

If something changes on your report, the credit score will be affected. That’s your canary in the coal mine warning that something is happening.

I like to use Credit Sesame or Credit Karma. Credit Sesame uses TransUnion reports and Credit Karma uses Equifax & TransUnion reports. Both are free.

Some credit cards offer a credit score monitor as a credit card perk. For example, CapitalOne calls it CreditWise and it uses TransUnion for their VantageScore 3.0 (the same as Credit Sesame).

4. How to Check for Strange Activity

Finally, this collection of tasks is for “everything else” that can happen in a theft (or things you can do to help prevent it).

👷 Register for Equifax Work Number

Equifax, most well known for credit reporting, also keeps track of your work history with The Work Number. The Work Number includes all of your employment and income data – who you worked for, when, and your pay. It’s typically used by credit card companies to verify income (such as when you request to increase a credit limit), landlords when you rent, or other companies you want to work for who are verifying the details of your resume.

Some people suggest you freeze this report. I think that’s largely unnecessary unless there think there is a good reason to be fearful.

I do think you should register your account before someone else does. Someone with enough information could potentially do this and registering is free and quick.

💳 Set Credit Card Transaction Alerts

I set transaction alerts on all my credit cards for the minimum amount.

Some cards let you set that limit at $0, others say $1 or more, but they all have this as an option. I get email notifications.

The notifications come instantly and have already paid dividends because within a week of doing it (coincidence, I assure you) I was notified of two fraudulent transactions!

🧹 Remove Personal Information From Data Brokers

There’s a tremendous amount of publicly available information and plenty of websites who compile that information so they can sell it to private individuals.

By law, they’re required to remove it if you ask but it’s a bit like playing Whack A Mole – there’s always another website out there listing your information.

It’s still important to try to remove that information whenever possible.

To do it manually, just search for yourself and go to each website that lists your information and follow their policy for removal. Here’s a list of the top data brokers with links to removing yourself from their lists.

You can also sign up for a service like DeleteMe and pay to have them do it (get 20% off with coupon code PARTNER20).

Google, as the most popular search engine, has a policy for removing personal information from their search results as well as a form you can fill out to remove it.

Through that form, you can remove:

• Confidential government identification (ID) numbers, like US Social Security Number, Argentine Single Tax Identification Number, Brazil Cadastro de pessoas Físicas, Korea Resident Registration Number, or China Resident Identity Card
• Bank account numbers
• Credit card numbers
• Images of handwritten signatures
• Images of ID docs
• Highly personal, restricted, and official records, like medical records
• Personal contact info (physical addresses, phone numbers, and email addresses)
• Confidential login credentials

📵 “Number Lock” Your Phone Number

If you turn on two-factor authorization, the code is usually sent to your phone number. That makes your phone a very enticing target, so turn on “Number Lock” (that’s what Verizon, my carrier, calls it). This ensures that the phone number cannot be ported or transferred without your authorization.

Here is Verizon’s FAQ answer on how it works:

This is not typically turned on by default.

What is a Number Lock?
If a scammer gets your personal information, they could transfer your mobile number to another carrier. This may be referred to as an unauthorized port out. Then, they could get your calls and texts to take control of other accounts, like banking and social media.

You can set up a Number Lock for free to protect your mobile number from an unauthorized transfer. Once a lock is set up for a number, that number cannot be ported to another line/carrier unless you remove the lock. You can set up a Number Lock with the My Verizon website and app or by calling Customer Service at *611.

Here are instructions for how to number lock (and sim lock) various service providers.

5. Are Identity Theft Protection Services Worth It?

Every year, there seems to be some massive credit card hack at a retailer. One of the biggest in recent memory was when thieves stole data on 37 million customers of T-Mobile in 2023.

In each case, affected customers were given free identity theft protection services from one of the big companies – NordProtect, Lifelock, Identity Guard, or Identity Force.

While it feels good to get something free after you’ve had your information stolen, is it really worth it?

What These Services Offer

There’s no way to protect you from having your identity stolen.

What they offer is “constant” monitoring of your credit reports so they can catch the symptoms of identity theft as early as possible. They look for suspicious activity like unauthorized credit pulls that might indicate someone is opening up a credit card in your name, and alert you.

By catching issues as early as possible, repairing them becomes much easier and faster.

A few years ago, something suspicious happened to me and my credit report. Someone had used a similar social security number to mine to get a cell phone. There wasn’t any identity theft but it was curious because a second Social Security Number, a new address, and a credit pull appeared on my credit report. I didn’t detect it until much later but an identity theft protection service would’ve seen these (as anyone looking would) as being strange and alerted me.

Are They Worth It?

We took a closer look at the LifeLock service as well as Identity Guard. We realized that those companies offer identity theft monitoring capabilities you can do yourself (as I’ve outlined above). You can get a very close approximation by using the Waterfall Method in requesting your credit reports.

The one thing that cannot be done for free is the, typically $1 million dollar insurance plan. With Lifelock, for example, you get a laundry list of benefits if you’re the victim of identity theft:

You can’t DIY those reimbursements (stolen handbag, purse or wallet insurance!?) and they could be significant in some cases, though there are limits to the insurance coverage. The often quoted dollar amount, like $1,000,000, usually refers to the last two line items – remediation services and case management services. Those will be the most expensive anyway.

That’s why I consider the identity theft protection services as more of an insurance policy that has a bonus monitoring service, and not the other way around.

One other consideration, and I’m not entirely convinced about the frequency, but many of these programs also offer child protection as a monthly add-on. Child identity theft is especially hard to detect because we often aren’t looking for it. I’ve never requested a credit report or my kids, though technically they’re each permitted a free report from each bureau every year!

(finally, there’s always the issue of mail theft or package theft, which no monitoring service can prevent)

Do you use an identity theft protection service like Lifelock, Identity Guard, or Identity Force? (there are easily a dozen of these types of companies, I just listed some of the more popular ones)