Identity theft protection is more effective when treated as a routine maintenance task rather than a one-time response. This checklist helps you secure accounts, reduce unnecessary data exposure, monitor warning signs, and create a practical schedule for responding to suspected compromise.
Overview
Identity theft can begin with a stolen password, a leaked account number, an exposed identity document, or a convincing phishing message. You may not be able to prevent every breach, but you can reduce the damage by limiting access, strengthening authentication, and noticing unusual activity early.
A useful account security checklist has three parts: prevention, detection, and recovery. Prevention means using unique passwords, multifactor authentication, careful privacy settings, and secure document handling. Detection means reviewing account activity, credit information, login alerts, and breach notifications. Recovery means knowing which accounts to secure first and where to report suspicious activity.
This guide is designed to be revisited. Account settings change, old applications retain access, new data breaches occur, and unused accounts can remain exposed for years. Keep a private record of the checks you complete, but do not store passwords, security answers, or full account numbers in that record.
What to track
1. Passwords and account recovery
- Use a reputable password manager to create and store a different password for every important account.
- Prioritize your email, financial, cloud storage, government-service, work, and mobile-carrier accounts. Control of your primary email can make it easier for an attacker to reset other passwords.
- Review recovery email addresses and phone numbers. Remove details you no longer control.
- Replace reused passwords, especially if an account has appeared in a breach notification.
2. Multifactor authentication
Turn on multifactor authentication wherever it is available, beginning with email, banking, payment, password-manager, and administrator accounts. An authenticator app or hardware security key may provide stronger protection than text-message codes in some situations, but any supported second factor is generally better than relying on a password alone. Save recovery codes in a secure location that is separate from the account.
3. Financial and credit signals
Review bank, card, payment-app, and investment activity for unfamiliar transactions, new payees, changed contact details, or unexpected login alerts. Consider a credit freeze or fraud alert when your identity information may have been exposed. The exact process depends on your location and the relevant credit-reporting providers, so use official websites rather than links in unsolicited messages. A freeze can help restrict new credit applications, but it does not replace account monitoring.
4. Breach and identity monitoring
Track notifications from services you use and investigate them through the service's official app or website. Be cautious with messages offering paid identity monitoring after a breach; scammers may use a real incident as a pretext to collect payment details or personal information. Treat identity monitoring as an alerting tool, not a guarantee that all misuse will be found.
5. App permissions and connected services
Review which applications can access your email, contacts, files, location, camera, microphone, or calendar. Remove access for services you no longer use. Check connected accounts such as social sign-ins, browser extensions, smart-home platforms, and payment applications. A forgotten integration can retain access long after you stop using the original app.
6. Documents and personal information
Store identity documents securely and avoid sending full scans unless the recipient and transmission method are verified. When a form does not require a complete identifier, ask whether a partial value or alternative document is acceptable. Shred or securely destroy papers containing account numbers, addresses, or identity details. Limit public exposure of your birthday, phone number, home address, and answers to common security questions.
For additional privacy steps, see the personal privacy protection checklist. If a message asks you to confirm identity information, use the online scam checker workflow before responding.
Cadence and checkpoints
Monthly checks
- Review bank, card, payment, and email login activity.
- Check for new devices, sessions, forwarding rules, or unfamiliar recovery settings.
- Install security updates on phones, computers, browsers, and password managers.
- Remove unused apps and browser extensions.
Quarterly checks
- Review your password-manager report for reused, weak, or exposed passwords.
- Audit app permissions, third-party connections, and social-media privacy settings.
- Review credit information where available and look for unfamiliar accounts or inquiries.
- Confirm that recovery codes and trusted contact details are still accessible and current.
After a breach, lost device, or suspicious message
Act immediately rather than waiting for the next scheduled review. Contact the affected organization through a verified channel, change the exposed password from a trusted device, end active sessions, and enable or reset multifactor authentication. If a device is lost, use its official remote-lock or erase feature and contact the mobile carrier if the phone number may be at risk. For suspicious emails, texts, or calls, do not use the supplied links or phone numbers; the is-this-a-scam checklist can help you verify the contact independently.
How to interpret changes
Not every alert indicates identity theft. A login from an unfamiliar location may result from a travel connection, mobile network routing, or a new device. However, treat several related changes as a stronger warning: a password-reset notice you did not request, an unfamiliar recovery email, a new forwarding rule, an unexpected credit inquiry, or a payment you cannot explain.
When you find a suspicious change, preserve relevant details such as dates, sender addresses, transaction references, and screenshots. Do not forward malicious links to coworkers or friends. Verify the account using a known address or manually typed website, then secure the account before investigating further. If money, identity documents, or financial accounts are involved, contact the provider promptly and follow its fraud process. Keep a timeline of actions and case numbers.
Be especially careful after receiving a data-breach notice. Attackers may imitate the affected company with a follow-up phishing scam, fake support call, or request for a one-time code. A legitimate security response should not require you to disclose a password or authentication code to an unsolicited caller. For suspicious websites and stores, review the website verification checklist.
When to revisit
Put a monthly account review and a quarterly privacy audit on your calendar. Revisit this checklist sooner after changing your phone number, losing a device, opening a major financial account, joining a new online service, receiving a breach notification, or noticing an unexpected login or transaction.
Use the following quick action list during each review:
- Secure the primary email and password-manager accounts first.
- Check recent financial transactions and account-recovery changes.
- Update reused passwords and confirm multifactor authentication.
- Remove unnecessary app permissions and connected services.
- Review credit information and consider a credit freeze after credible exposure.
- Record unresolved warnings and set a follow-up date.
If you suspect active identity theft, prioritize containment over extended research: contact affected providers through official channels, report unauthorized activity, and seek qualified consumer or legal guidance when appropriate. A consistent review routine cannot eliminate risk, but it can reduce avoidable exposure and help you respond before a small warning becomes a larger account-security problem.
