How to protect yourself from identity theft

3 min read · 9 steps · Updated 3 October 2026

Identity theft means that someone uses your personal or financial details without your permission: to shop with your card, open accounts and contracts in your name, claim a tax refund or benefits, or get medical care. The damage often shows up months later as debts you never made. Most of it can be prevented with a few habits, described by the US consumer protection agency FTC.

This is general information, not financial or legal advice. Rules and services differ from country to country.

Step by step

1. Know what thieves want

   Your full name with date of birth and address, your ID, passport, tax or social security number, bank account and card numbers, and the logins for your email and bank. Email is the most valuable, because it resets every other password.

   Done

2. Lock down your accounts

   Use a long, different password for every important account, kept in a password manager, and switch on two-step sign-in, first for email and banking. See how to make strong passwords you can actually remember.

   Done

3. Do not hand out data when someone contacts you

   Banks, authorities and delivery firms do not ask for passwords, PINs or codes by phone, text or email. If you are unsure, end the contact and call the organisation on a number you look up yourself.

   Done

4. Ask why a number is needed

   When a form or a shop asks for your ID or tax number, ask why, how it is stored and whether something else will do. Send copies of ID documents only when really necessary, and write the purpose and date across the copy.

   Done

5. Protect paper and post

   Keep documents at home in one safe place. Shred letters with account or personal numbers before they go into the bin. Empty the letterbox promptly, and have post redirected when you move.

   Done

6. Watch for the warning signs

   Bills that stop arriving, charges or withdrawals you do not recognise, letters about accounts, contracts or debts you never took out, a declined card for no reason, or a credit report that lists unknown accounts.

   Done

7. Check statements and your credit report

   Read your bank and card statements every month. Request your credit report at least once a year. In Germany the Schufa data copy is free: Schufa in Germany.

   Done

8. Use a freeze or alert where it exists

   In the United States you can freeze your credit file for free at the three credit bureaus, so nobody can open credit in your name, or place a one-year fraud alert. Other countries have similar notes or warnings on the credit file. Ask your credit agency.

   Done

9. If it happens

   Tell your bank and block cards at once, change the passwords of email and affected accounts, report it to the police, and tell the credit agency. In the United States, IdentityTheft.gov builds a recovery plan step by step. Keep copies of everything.

   Done

Good to know

After a data breach at a company you use, change that password everywhere you used it, and be alert for calls and emails that suddenly know details about you.

Be careful with public posts: date of birth, address, the name of your first pet and your school are the classic answers to security questions.

Before you sell or give away a device, wipe it: what to do before you sell or give away an iPhone.

Related: how to spot a scam, what to do if you were scammed and what are passkeys.

In short: Strong separate passwords with two-step sign-in, no data to people who contact you, shred papers, read statements monthly, check your credit report yearly, act at once on anything unknown.