How to Protect Yourself from Scams: The Complete Guide

I talk to someone every week who was recently scammed. They’re mad, embarrassed, and mentally drained. Recovering from identity theft is one of the worst experiences your finances and mental health will ever go through. Worse still, most of it was preventable. You don’t need expensive software or a paid monitoring service to protect yourself. In fact, about an hour of free, permanent steps is all it takes. Unfortunately, most Americans have never taken these steps and have left their identities open to potential theft.

What This Guide Will Teach You

If you want to know how to protect yourself from scams before they happen, or how to protect yourself against scams that may already be targeting someone in your family, this guide is for you.

I’ve broken it into six easy steps you can start tonight. Furthermore, each one builds on the action before it, beginning with the single most important thing you can do right now. You don’t need to do everything in this article today. In fact, you don’t even need to finish reading it today.

However, if you’re serious about learning how to protect yourself from scams, start with Step 1 tonight. It takes less than 15 minutes and costs nothing. Additionally, it’s the single most powerful identity protection tool available to Americans.

Waiting Isn’t Your Friend

Let’s start with a dirty little secret about scams. By the time you realize you’ve been scammed, it’s probably been happening for months, if not years.

How long identity theft goes undetected

According to the Federal Trade Commission, it takes identity theft victims six months to a year to realize their identity has been compromised. Imagine opening your wallet and seeing several credit cards you don’t remember applying for, then spending another six months before you noticed those cards were missing in the first place.

What scammers do with your information

That’s a long time for scammers to do damage. During that window, they can open new lines of credit, file fraudulent tax returns, apply for government benefits, and build an entire credit history in your name.

When you finally do figure it out, you’re suddenly on the phone with banks, credit bureaus, and law enforcement, trying to restore what was once your good credit while figuring out where all of it came from. On average, identity theft victims spend 200 hours getting their life back, plus hundreds or thousands of dollars in the process. That means countless hours making phone calls, writing letters, filing police reports, completing IRS forms, and managing months of cleanup. Ultimately, it’s the equivalent of five full weeks of work just to get your identity back.

Why a credit freeze changes everything

If you freeze your credit, which is Step 1 below, thieves can’t open new credit cards, take out personal loans, apply for apartment rentals, or poison your credit with unpaid bills in your name. Although a freeze doesn’t stop every type of fraud, it shuts down the most common and most damaging path scammers use, which is opening new credit in your name. Someone can still try to file a fraudulent tax return or take over an existing account. However, the Federal Trade Commission calls a credit freeze the single best way to protect yourself from new account identity theft.

Freezing your credit before anything happens also makes recovery dramatically faster if a thief ever does target you. According to the Identity Theft Resource Center, 30% of identity theft victims lose $100,000 or more, and 11% lose $1 million or more. Furthermore, recovery isn’t quick. The ITRC estimates it takes around 100 hours to recover from financial fraud, 120 hours for tax fraud, and up to 300 hours for criminal identity theft. As a result, protecting yourself from scams doesn’t just save you money. It saves you hundreds of hours of headache.

The emotional cost of being scammed

There’s a reason scams have such power over us. Imagine being scammed tomorrow. You’d react emotionally, because scams target you when you’re vulnerable. Often when you’re already upset or struggling financially. Scammers don’t care who you are. They only care about taking your money.

I want you to approach each of these steps calmly and with purpose. When you set up that first credit freeze tonight, remember that you’re taking matters into your own hands. That’s empowering, so give yourself the space to do it.

Ready? Let’s go.

Why this matters more than ever

A reality check on the odds. The National Public Data breach alone exposed 272 million unique Social Security numbers, roughly every adult in America. Add in Equifax and dozens of smaller breaches, and the odds are your SSN is already out there. Stop telling yourself “this hasn’t happened to me.” Assume your information is already being sold and take the steps below to protect it.

Step 1: Freeze Your Credit With All Four Credit Bureaus Tonight

Hands down, the most important thing you can do to protect yourself from scams is freeze your credit. If you only do one thing on this list, do this.

What is a credit freeze?

A credit freeze, also called a security freeze, locks down your credit file at each of the credit bureaus. When your credit is frozen, no creditor can access your report, which means no new accounts can be opened in your name. The Federal Trade Commission calls it the single best way to protect against new account identity theft.

It’s free, permanent until you lift it, and has zero impact on your credit score. Existing cards and accounts continue working normally. The freeze is completely invisible to your everyday finances.

A freeze is also the one protection scammers can’t get around, even if they already have your Social Security number. They might have your number, but if they can’t pull your credit report, they can’t open new accounts with it.

Most people know about the three big credit bureaus: Experian, TransUnion, and Equifax. What most people don’t know is that there’s a fourth bureau called Innovis. Skipping Innovis is one of the most common mistakes people make when locking down their credit, because scammers know it’s the bureau most consumers forget.

Don’t leave any door open. Freeze all four bureaus tonight:

• Equifax freeze
• Experian freeze
• TransUnion freeze
• Innovis freeze

Each freeze takes about 6 minutes per bureau. Innovis is the fastest at around 2 minutes. Start with Equifax and work your way down. You’ve got this.

After you freeze your credit

Save your confirmation numbers and PINs

Each credit bureau handles confirmation a little differently. Equifax, Experian, and TransUnion give you confirmation in your account dashboard right after the freeze is placed. Innovis sends your PIN by mail, which can take 5 to 7 business days to arrive. ChexSystems delivers your PIN as a downloadable PDF inside your account dashboard.

Whatever you receive, write it down or save it somewhere safe with your other important documents. You’ll need it if you ever want to lift your freeze to apply for new credit.

Watch out for paid membership upsells

Don’t forget the fifth bureau (ChexSystems)

Pro tip: Freeze your credit with ChexSystems as well. ChexSystems is a separate reporting agency that banks check when you apply for a new checking or savings account. Five minutes of work, and it stops scammers from opening bank accounts in your name. ChexSystems is also free.

Remember to lift your freeze when you need credit

Takeaway: Once your freezes are in place, scammers can’t open new credit cards, store accounts, or bank accounts in your name. Just remember to set calendar reminders to temporarily lift your freezes when you need to apply for new credit yourself. Forgetting this step has confused countless people, myself included, and you don’t want to get stuck mid-application wondering why you were denied.

Step 2: Secure Your Email and Accounts With Two-Factor Authentication

Why your email is the most important account to lock down

Your email account is the skeleton key to your entire digital life. If a scammer gets into your email, they can reset the password on almost every account you own. Bank accounts, investment accounts, your Social Security login, your IRS account, all of it. That’s why email is where you start.

Set up an authenticator app instead of SMS codes

If you use Gmail, enable 2-Step Verification right now. Then switch your second factor from text message verification to an authenticator app. Authenticator apps generate codes that only exist on your phone, which means they can’t be intercepted. Furthermore, text message codes can be stolen through a scam called SIM swapping, where a scammer convinces your wireless carrier to transfer your phone number to their device. The whole attack takes less than 30 minutes, and once it’s done, every text-based code you receive goes straight to the scammer.

Repeat this process for every financial account you own. Additionally, turn on transaction alerts for every dollar spent so your bank app becomes a real-time fraud monitor instead of something you check once a month.

Lock down your government accounts

Then move on to your government accounts. Set up your my Social Security account at SSA.gov if you haven’t already, then lock it down by enabling the electronic access block. As a result, scammers can’t change your benefits information online or through automated phone calls. After that, sign up for the IRS Identity Protection PIN program. You’ll get a six-digit code that must be entered any time a tax return is filed in your name. No PIN, no return.

Although these aren’t the most exciting steps in the world, they shut down some of the most common scams targeting bank accounts and tax refunds. The whole process takes less than an hour total.

Step 3: Password Protect Your Phone Number

Your phone number is the new Social Security number. Your bank uses it to verify your identity. So does the IRS. So does Social Security. It’s even required on your tax returns each year.

If a scammer gains access to your phone number, they can intercept every password reset and verification text before you ever see it. From there, they can change your passwords, lock you out of your accounts, and drain your bank balance, all in under an hour.

How to lock down your phone number

Contact your wireless carrier and add a PIN or passcode to your account. This is different from the PIN that unlocks your phone screen. This one protects the account itself, so nobody can call your carrier pretending to be you and transfer your number to a new device. That attack is called SIM swapping, and it’s one of the fastest-growing forms of identity theft.

Each carrier handles this a little differently. AT&T calls it a “wireless passcode.” Verizon calls it an “Account PIN.” T-Mobile uses “Account Takeover Protection.” US Cellular uses an Account Lock toggle instead of a PIN. The names change, but the protection is the same. Call your carrier today and ask how to enable it.

Block spam calls and texts

Once your account is locked down, turn on spam call filtering on your phone. Both iPhone and Android have built-in spam filters that cut down dramatically on the number of scam calls you receive each day.

Then register for the National Do Not Call Registry. It won’t stop scammers who already ignore the law, but it cuts down on legitimate robocalls enough that the scam ones become easier to spot.

Step 4: Opt Out of Data Brokers

Why data brokers are dangerous

Data brokers make money by collecting your personal information and selling it to anyone who’ll pay. Every time you fill out a form online, sign up for a loyalty program, or buy something from a store that asks for your zip code, there’s a good chance your information ends up in a broker’s database. Usually without your knowledge or consent.

What data brokers actually do

Sites like Spokeo, WhitePages, BeenVerified, and Intelius collect your name, address, phone number, family member names, employer, and dozens of other data points and sell them to anyone who pays. That includes employers running background checks, marketing companies, debt collectors, and yes, scammers building target lists.

How to opt out

Go through the major data brokers one by one and submit opt-out requests. It takes a couple of hours, but the payoff is real. The Electronic Frontier Foundation and Privacy Rights Clearinghouse maintain free guides with direct opt-out links for the major brokers.

Stop pre-screened credit offers

Head to OptOutPrescreen.com to stop credit card and insurance companies from sending you pre-screened offers by mail. This one is especially important if you live in an area with mail theft, because it stops thieves from grabbing those offers out of your mailbox and using them to open accounts in your name.

While you’re at it, sign up for USPS Informed Delivery. It’s a free service that emails you scanned images of the mail being delivered to your address each day. If a credit card or other sensitive piece of mail shows up in your inbox preview but never makes it to your mailbox, you’ll know immediately something’s wrong.

Step 5: Make Identity Theft Prevention a Family Affair

Protecting yourself from scams isn’t just about you. It’s about everyone in your household.

Scammers who can’t crack your defenses will pivot to your family members. That includes your spouse, your aging parents, and your teenage kids. Especially your young children, who often have spotless credit histories and no reason to monitor them.

There’s a reason young children show up in data broker searches. Scammers know a child’s Social Security number can sit unused for 18 years before anyone notices the damage.

There are two key steps every family should take.

Set up a family safe word

Pick a word together. Make sure every member of your household knows it. If anyone ever calls, texts, or video calls claiming to be a family member in distress and asking for money, ask for the safe word before doing anything else.

This is one of the most effective defenses against the AI voice cloning scams that have exploded in the last two years. A scammer can spoof your daughter’s voice using a 30-second sample from her Instagram. They can fake your spouse’s number on caller ID. But they can’t guess a word only your family knows.

Pick something that isn’t on social media, isn’t a pet’s name, and isn’t anything a scammer could find by searching your name. If you suspect the word has been compromised, change it that day.

Related: How to talk to your family about identity theft

Freeze your kids’ credit too

Children deserve credit freezes just as much as adults do. The process takes a little more legwork because you’ll need to provide birth certificates and proof of guardianship, but the FTC’s child credit freeze guide walks you through it for all three bureaus.

A frozen credit file means a scammer can’t open accounts in your child’s name even if they’ve had their Social Security number for years. It’s the single most powerful protection a parent can put in place.

Don’t forget your elderly parents

Older adults lose more money to scams than any other age group. If your parents are still managing their own finances, they need the same protections you’re putting in place for yourself. Our guide to protecting elderly parents from scams walks through exactly how to bring it up, what to set up first, and how to keep them protected without taking away their independence.

Step 6: Monitor, Monitor, Monitor

You don’t know where your data lives. Scammers do. Every piece of information you’ve ever handed to a business is sitting in a database somewhere, and scammers buy, sell, and trade it constantly.

Monitoring is how you catch problems early instead of months after the damage is done.

Pull your credit reports regularly

Visit AnnualCreditReport.com to view your credit reports from Equifax, Experian, and TransUnion. As of 2023, all three bureaus permanently offer free weekly reports, so there’s no excuse not to check.

Scan each report for accounts you don’t recognize, addresses that aren’t yours, and hard inquiries from lenders you never contacted. Any one of these is a sign your identity has been compromised and you need to act fast.

Set transaction alerts on every account

Set your bank and credit card alerts to notify you on every transaction over $1. This turns your bank app into a real-time fraud monitor instead of something you check once a month. The earlier you spot a fraudulent charge, the easier it is to reverse.

Check for breaches and Google yourself

Have I Been Pwned is a free tool that tells you if your email address has shown up in any known data breaches. Sign up for their free breach alerts while you’re there so you’ll know the moment a new breach exposes your information.

Then Google your name and home address. Seriously. Set up Google Alerts for both so you get an email any time new information about you appears online. You’ll be surprised what shows up.

Free Monitoring Tools Worth Setting Up Today

Set your bank transaction alerts to $1 so every transaction triggers a notification. This catches fraud in real time instead of weeks later when you’re scrolling through your statement. Visit Have I Been Pwned to check whether your email addresses appear in known data breaches and sign up for free breach alerts going forward. Then set Google Alerts for your full name and home address. This surfaces unauthorized real estate listings, fraudulent business registrations, and other identity misuse you’d otherwise never know about.

Bookmark these reporting sites before you need them

Bookmark these official reporting sites now, while you’re calm and have time to think:

• IdentityTheft.gov for FTC identity theft reports and personalized recovery plans
• IC3.gov for FBI Internet crime complaints
• ReportFraud.ftc.gov for general fraud reports

If you ever need these, you’ll want them in seconds, not after 20 minutes of panicked Googling. Don’t make the mistake I made. Be ready for them.

Your Complete Checklist to Protect Yourself from Scams

Everything below is free. Most items take under 15 minutes. Working through this list puts you well ahead of the average American, who has done none of it.

• Freeze credit at Equifax, Experian, TransUnion, Innovis, and ChexSystems
• Enable 2FA on your email using an authenticator app, not SMS
• Enable 2FA and transaction alerts on all banking accounts
• Create your SSA.gov account and enable the electronic access block
• Enroll in the IRS Identity Protection PIN program
• Add a PIN or passcode to your wireless carrier account
• Enable spam call filtering on your phone
• Register your number at DoNotCall.gov to reduce unwanted calls
• Opt out of pre-screened credit offers at OptOutPrescreen.com to reduce mail fraud
• Enroll in USPS Informed Delivery for daily mail previews
• Establish a family safe word with every household member
• Freeze your children’s credit files at all three bureaus
• Sign up for free breach alerts at Have I Been Pwned
• Set Google Alerts for your name and address
• Review all three credit reports quarterly at AnnualCreditReport.com for unfamiliar accounts

Take Action Against Scams Tonight

How to protect yourself from scams isn’t complicated. It’s about doing the right things once and letting them work permanently.

Scams are scary. Someone tried to ruin my life with one once, and until I learned how to protect myself, I worried every time I opened my bank app.

The steps in this guide won’t stop every scam out there. But they will prevent the overwhelming majority of them from ever touching you or your family.

The Identity Vault was built by someone who has personally walked through every freeze, documented every upsell trap, and lived through the recovery process when things went wrong. This guide is exactly what we built this platform to deliver. Come back to it. Share it with your family. The time you spend on these steps today is time you never have to spend recovering from fraud tomorrow.

Still worried your identity has already been stolen? Here’s our step-by-step guide to recovering from identity theft.

Start tonight. Scammers don’t rest, and your protection shouldn’t wait either.