Learn Dark Web

Online Privacy

How to Protect Your Identity Online

Your identity is the set of facts that prove you are you: your name, your birthday, your address, your account logins. Protecting it is not a product you buy — it is a short list of free habits, done in the right order. This is that list, with nothing for sale.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

Try the tool: Privacy Risk Assessment

How identity theft actually happens

Identity theft rarely starts with a hacker breaking into your computer. It starts with information. A data breach leaks your email and password; a phishing message tricks you into typing your login into a fake page; a scam call talks you into reading out a code; an old social media post gives away your birthday, your mother's maiden name, or your first pet — the answers to security questions. The thief then tries the obvious: log in to your email, reset your other passwords, open accounts in your name, or sell the details on. The damage is rarely instant — it often surfaces months later as a bill, a refused loan, or a letter about an account you never opened.

That is why the defence is layered. No single step stops identity theft, but each step removes one ingredient the thief needs. Our guide to what identity theft is explains the types in depth; this page is the practical checklist. Our guide to your digital footprint shows how to see what is already out there about you.

The free checklist, in order of impact

1. Unique passwords, managed properly

The single highest-impact step. Use a different password for every account, stored in a password manager, so one breach cannot unlock everything. Start with email — your email account resets the passwords of everything else. Our password security fundamentals guide explains how to build strong passwords, and our guide to checking if your password was leaked safely explains how breach checking works without handing your real password to a stranger.

2. Two-factor authentication, everywhere it is offered

Turn it on for email first, then banking, then social media. Even if a password leaks, a second factor — an authenticator app or a hardware key — stops most account takeovers. Avoid SMS codes where an app is available: they are better than nothing, but weaker than app-based codes.

3. Keep devices updated

Most successful attacks use known flaws that already have a fix. Update your operating system, browser and apps promptly, and turn on automatic updates where you can.

4. Limit what you share

Your full name plus your birthday plus your town is enough to start impersonating you. Do not post your birthday, your children's school, your address, your holiday dates, or photos of documents. Check your social media privacy settings and review old posts — including what others posted about you.

5. Shred, freeze and watch

Shred paper that carries account numbers before throwing it away. Where your country offers it, consider a credit freeze: it stops anyone opening new credit in your name until you lift it, and it is free in the US. Check your bank and card statements monthly, and review your credit report regularly — unfamiliar accounts and enquiries are the earliest warning.

6. Learn the scam shapes

Identity theft is usually delivered by a scam: a fake bank message asking you to "verify" your account, a parcel-delivery text with a link, a call from "support" asking for a code. The shape is always the same — unexpected contact, urgency, a request for details or money. Learn the shape in our avoid online scams guide and our how to spot phishing emails guide.

Signs your identity may have been stolen

  • Accounts, charges or withdrawals you do not recognise
  • Bills or letters about things you never bought or applied for
  • Being refused credit, a loan or a phone contract for no reason
  • Tax or benefit letters about income or claims you never made
  • Password reset emails you did not request
  • Debt collectors contacting you about debts that are not yours

Any one of these is worth checking the same day. Do not wait for a second sign — the earlier you act, the smaller the damage.

What to do if your identity is stolen

  1. Contact your bank and card issuers immediately. Freeze cards, dispute charges, and ask what fraud protections apply. Banks deal with this daily.
  2. Change passwords on every affected account, and on any account that shared the same password. Turn on two-factor authentication.
  3. Report it. In the US, file a report at IdentityTheft.gov — the FTC builds you a personalised recovery plan and an official report that banks and credit bureaus recognise. In the UK, tell your bank and report to Action Fraud (now Report Fraud); verify the current reporting route on the official site before filing, as the service changed in 2026. Last checked: 14 November 2026.
  4. Place a fraud alert or freeze with the credit bureaus, so no new credit can be opened in your name.
  5. Keep everything. Reference numbers, letters, screenshots, dates and names. You will need them repeatedly, and a paper trail is your evidence.
  6. Watch for follow-on scams. Thieves often follow up a theft with a fake "refund" or "recovery" scam targeting the same victim.

This checklist is not a monitoring service. Nothing here watches your data for you, and no page on this site will ever ask for your personal details to "check" you. Free habits stop most identity theft; paid monitoring can alert you after the fact, but it cannot prevent it. If a service promises to keep you safe, ask exactly what it monitors and what it cannot do.

Sources

Last checked: 14 November 2026.

Frequently asked questions

What is identity theft?

When someone uses your personal information — your name, date of birth, address, or account details — to pretend to be you: opening accounts, taking loans, filing tax returns, or buying things in your name. It usually starts with information that leaked in a breach or was given away in a scam.

How do I protect my identity online for free?

Use unique passwords with a password manager, turn on two-factor authentication (email first), keep devices updated, limit what you post, and check whether your details were in a breach. Every step is free. No paid monitoring product is needed for the basics.

Should I pay for identity theft protection?

It is optional, not essential. Paid services mostly watch for your details appearing in places and alert you — useful, but they cannot prevent theft, and the free steps in this guide stop most attacks. If you buy one, understand exactly what it monitors and what it cannot do.

What should I do if my identity is stolen?

Act fast: contact your bank and card issuers, change passwords on affected accounts, and report it — in the US, to the FTC at IdentityTheft.gov, which builds a recovery plan; in the UK, to your bank and Action Fraud / Report Fraud. Keep every reference number and letter.

How do I check if my identity was stolen?

Look for the signs: accounts or charges you do not recognise, bills for things you did not buy, being refused credit for no reason, or tax and benefit letters about things you never did. Check your bank and card statements monthly and review your credit report regularly.