Americans reported losing a record $15.9 billion to fraud in 2025 across 3 million reports, according to Federal Trade Commission testimony before Congress (PDF File). The FBI’s 2025 Internet Crime Report logged another $20.9 billion in cybercrime losses, up 26% from 2024. Behind those numbers are reused passwords, hijacked phone numbers, and Social Security numbers exposed in a data breach.

This checklist covers the ten steps that do the most to protect your bank accounts, credit, tax refund, and StudentAid.gov account. Most of them are free, and the first five take an afternoon. Start at the top and work down, because the early steps block the most expensive kinds of fraud.

1. Freeze Your Credit At Equifax, Experian, And TransUnion

A credit freeze is the single most effective free step against new-account fraud. It blocks most lenders from pulling your credit report, so a thief holding your Social Security number can’t open a credit card or car loan in your name. Freezes have been free by federal law since September 2018, and our walkthrough on how to freeze your credit and your child’s credit covers each bureau’s process.

You have to place the freeze at all three bureaus separately. A bureau must place a freeze within one business day when you request it online or by phone, and it must lift a freeze within one hour when you ask the same way. That one-hour rule means a freeze costs you very little when you apply for a mortgage, a new rewards credit card, or a private student loan.

A fraud alert and a paid credit lock are the two common alternatives. A fraud alert asks lenders to verify your identity but doesn’t block access, and a lock works like a freeze but runs on the bureau’s terms rather than federal law. The table below shows why a freeze is the right default for most readers. Parents can freeze a child’s file for free too, which keeps a clean credit history from being used for student loan identity theft.

2. Use A Password Manager And A Unique Password Everywhere

Every financial account needs its own long, random password, and a password manager is the only realistic way to do that. When one site gets breached, criminals try the same email and password on banks, brokerages, and email providers. A unique password for each login turns one breached account into one problem instead of twenty.

Good options include 1Password, Bitwarden, and Dashlane, plus the free managers built into Apple devices and Google Chrome. Let the manager generate passwords of 16 characters or more, and protect the manager itself with a long passphrase of four or more unrelated words.

The master password matters more than any other password you own. Vault backups stolen in the 2022 LastPass breach are still being cracked. Blockchain investigators linked about $35 million in crypto thefts through 2025 to that stolen vault data, with weak master passwords the common thread. Never store crypto recovery phrases in a password manager, and see our list of the best crypto wallets for safer storage.

3. Turn On Passkeys Or A Hardware Security Key

Passkeys and hardware security keys are the strongest login protection available to consumers in 2026. Both use cryptography tied to the real website, so a fake bank login page can’t capture anything useful. The FIDO Alliance estimates 5 billion passkeys are now in use, and you’ll find the option in the security settings of a growing list of banks and popular money apps.

A passkey lives on your phone or computer and unlocks with your face, fingerprint, or device PIN. A hardware security key is a small USB or NFC device, and Yubico’s entry-level Security Key C NFC launched at $29. Buy at least two keys and register both, so losing one doesn’t lock you out of your online bank or brokerage.

Where an account offers neither, use an authenticator app instead of text-message codes. Text codes are the weakest option because anyone who takes over your phone number receives them, which the table below lays out. Turn on two-factor login for email, cloud storage, social media, and your cell phone account too. A thief who controls any of them can reset your other passwords, the same chain reaction that follows a data breach.

4. Lock Down Your Email And Your Phone Number

Your email inbox and your phone number are the master keys to every financial account, because password resets go to one or both. Give your email account the strongest protection you have, ideally a passkey or security key, and a password you use nowhere else. Some readers go further and create a separate email address used only for banking and brokerage accounts, which keeps it out of marketing lists and breach dumps.

A SIM swap happens when a criminal convinces your carrier to move your number to a new SIM card, then receives your text-message codes. Turn on your carrier’s port-out and SIM protection: AT&T calls it Wireless Account Lock, T-Mobile offers SIM Protection, and Verizon offers Number Lock. A sudden “No Service” message on your phone is a warning sign. Call your carrier from another line, then check for new activity with a credit monitoring service.

5. Get A Free IRS Identity Protection PIN

An IRS Identity Protection PIN (IP PIN) is a six-digit number that must appear on your federal tax return, so a thief with your Social Security number can’t file a fake return and collect your refund. Anyone with an SSN or ITIN can request a free IP PIN, and the fastest route is the IP PIN option in your IRS online account. Tax-related identity theft can hold up a refund for months, and our article on IRS reference number 9001 covers one notice tied to identity reviews.

You get a new IP PIN every year, and you can look it up anytime in your IRS account. Parents can get IP PINs for dependents too, which blocks someone from claiming your child on a fraudulent return. The IRS will never call, email, or text to ask for your IP PIN. Treat any message that does as a scam, like the fake offers in our list of common college scams.

6. Claim Your Government Accounts Before A Scammer Does

Create your own online accounts at the Social Security Administration, the IRS, and StudentAid.gov, because an account you haven’t claimed is one a thief can claim with your stolen details. The Social Security Administration recommends opening a my Social Security account (PDF File) for exactly this reason. Once your accounts exist and use two-factor login, a fraudster can’t easily register them to redirect benefits, refunds, or federal student loan information.

StudentAid.gov already requires two-step verification, and an authenticator app is a stronger choice than email or text codes. Write down the backup code when it appears, since it won’t display again. Our step-by-step on how to create an FSA ID covers setup for students and parents, and anyone who asks for your FSA ID password is running one of the top student loan scams.

If you know your Social Security information is compromised and you don’t need online access, you can ask SSA to block electronic access to your record by calling 1-800-772-1213. That block stops everyone, including you, from viewing or changing the record online or through SSA’s automated phone line. It’s a strong move for older relatives who never plan to log in, and it pairs well with a credit freeze.

7. Check Your Credit Reports And Accounts Every Week

You can’t prevent every fraud, but catching it within days limits the damage and makes cleanup easier. The three bureaus made free weekly credit reports permanent in 2023 through AnnualCreditReport.com. Our article on getting a free credit report every week shows how to request them without paying for a bureau upsell.

A free monitoring app sends alerts in between. Credit Karma watches your TransUnion and Equifax reports and flags new accounts and hard inquiries, and our Credit Karma review covers what it does and doesn’t track. Capital One’s free CreditWise tool is another option that doesn’t require a Capital One account.

Turn on transaction alerts at every bank and card issuer so you get a text or push notice for any charge, transfer, or login. An account aggregator puts every balance on one screen, which makes an unfamiliar withdrawal easier to spot. Empower, formerly Personal Capital, offers a free dashboard. Our Empower review and Kubera review compare the two.

Linked apps are only as safe as the connections behind them. Most aggregators connect through Plaid or a similar service, and you can see and revoke those connections in one place using the Plaid Portal. Remove any app you no longer use.

8. Never Share Codes Or Account Numbers With Someone Who Contacts You

Imposter scams were the most-reported type of fraud in 2025, with more than 1 million reports and $3.5 billion in losses, according to the FTC testimony (PDF File). The callers pose as your bank, the IRS, Social Security, or your student loan servicer. Our list of student loan scams shows how polished those calls and emails have become.

The rule that stops nearly all of them is simple: never give a one-time code, password, account number, or Social Security number to anyone who contacted you first. Hang up and call the number on the back of your card or on the company’s official website. Real banks won’t ask you to move money to a “safe account.” Payments sent through Zelle or Cash App are also hard to reverse, as our comparison of Cash App, Venmo, Zelle, and PayPal explains.

When an employer, landlord, or school asks for your Social Security number, ask why they need it and how they’ll store it. Hand it over in person or through a secure portal rather than plain email. College students should be extra careful with housing deposits, and our rundown of roommate scams shows the patterns to watch for.

9. Send Documents Through Secure Portals And Shred Paper Copies

Don’t email tax returns, bank statements, or pay stubs, even to your accountant, financial advisor, or lender. Email copies sit in sent folders and inboxes for years, and a single breached inbox exposes everything in it. Ask every professional for their secure client upload portal, a step that matters most when you’re buying a home and sending dozens of documents.

Switch to paperless statements where you can, and shred any paper statement, credit card offer, or tax document once you’ve reviewed it. A cross-cut shredder is a one-time purchase that keeps account numbers out of the trash. Keep the originals you truly need, such as birth certificates and Social Security cards, in a locked fireproof box or a safe deposit box.

10. Keep Your Phone, Computer, And Apps Updated

Install operating system and app updates as soon as they’re released, because those updates fix security flaws that attackers can use against you. Turn on automatic updates for your phone, computer, browser, and router. An outdated device can leak saved passwords and session cookies no matter how strong your password manager setup is.

On your phone, use your bank’s official app downloaded from the Apple App Store or Google Play rather than a link from a text or email. Fake banking sites and apps are a common phishing tool, and typing your bank’s address by hand or using its app avoids them. If a bank or fintech app stops getting updates, move your money somewhere that still maintains its software.

When Do You Need Extra Security?

Four situations raise the stakes enough to justify extra steps beyond the ten above: buying a home, holding cryptocurrency, traveling abroad, and sharing a household with someone you don’t fully trust. Each carries a specific risk the basic checklist doesn’t fully cover, starting with the large transfers involved in buying your first home.

Buying A Home Or Wiring Money

Wire fraud targets home buyers because closing funds move in large, fast, irreversible transfers. Business email compromise, the FBI category that covers fake closing instructions, cost victims $3 billion in 2025 according to its Internet Crime Report. Confirm wiring instructions by phone with your title company, using a number you found yourself. Treat any last-minute change to earnest money or closing instructions as a red flag.

Holding Cryptocurrency

Bank deposits carry FDIC insurance up to $250,000 per depositor, per bank, per ownership category. Crypto held in a wallet has no such backstop if it’s stolen. Our overview of FDIC insurance limits explains what is and isn’t covered. Keep larger crypto balances on a hardware wallet and store the recovery phrase offline in a fireproof safe.

Traveling Abroad

Public Wi-Fi in airports and hotels is a common place for thieves to intercept logins. Use your phone’s cellular data or a personal hotspot for anything financial, and carry a credit card instead of a debit card so a skimmed number can’t drain your checking account. A card with no foreign transaction fees saves money too, and our list of travel rewards credit cards includes several.

Living With Someone You Don’t Fully Trust

People with physical access to your mail, devices, and documents can steal your identity without hacking anything. Lock your phone and computer, and keep sensitive papers in a locked box. A credit freeze also stops a household member from opening accounts in your name. Parents dealing with a forged signature on a federal student loan application can find steps in our article on what to do if your child forges your name on a Parent PLUS loan.

What Should You Do If Your Information Is Stolen?

Report it at IdentityTheft.gov, the FTC’s official recovery site. It builds a personalized recovery plan and an identity theft report you can use with creditors. Then freeze your credit at all three bureaus and change the passwords on your email and financial accounts, starting with any account that shares a password with the breached one. Our checklist on protecting yourself after a data breach walks through each call in order.

Identity theft victims can place an extended fraud alert that lasts seven years instead of one, according to the FTC. Request an IRS IP PIN if you haven’t already, and contact any bank or lender where a fraudulent account appeared. If someone took out student loans in your name, follow the separate process in our article on student loan identity theft.

Keep a written log of every call, including the date, the person you spoke with, and any reference number. Disputes can take several rounds, and a record speeds up each one. If a bank or card issuer won’t fix a fraudulent charge, you can escalate by filing a complaint against your bank with its federal regulator.

Frequently Asked Questions

Does Freezing Your Credit Hurt Your Credit Score?

No. A credit freeze doesn’t change your credit score, and your existing cards and accounts keep working normally. You’ll just need to lift the freeze before applying for new credit, which our credit freeze walkthrough shows how to do in minutes.

Is It Safe To Link Bank Accounts To Apps Like Empower Or Credit Karma?

Linking for tracking gives the app access to view balances and transactions, and reputable apps encrypt that data. The bigger risk is forgotten connections, so review and revoke old ones in the Plaid Portal once or twice a year.

Should You Pay For Identity Theft Protection?

Most people can get the core protections free: a credit freeze, weekly credit reports, an IRS IP PIN, and a free monitoring app. Paid services add wider monitoring, recovery help, and insurance. Our ranking of the best credit monitoring services compares free and paid options.

What Is The Safest Two-Factor Authentication Method?

A hardware security key or a passkey is the safest choice because neither can be phished or intercepted through a SIM swap. An authenticator app is the next best option, and text-message codes are the weakest. Set up the strongest method each account offers, starting with email and your online bank.

How Do I Protect My FSA ID And StudentAid.gov Account?

Use a unique password and choose an authenticator app for two-step verification. Store your backup code somewhere safe. Never share your FSA ID with a company that offers to help with your student loans, because the Department of Education’s tools are free. Our article on how to create an FSA ID covers setup for students and parents.

The post How To Secure Your Financial Information: 10 Steps To Protect Yourself appeared first on The College Investor.