Identity Theft Protection: What It Does and What You Can Do Free

Identity protection is sold as a subscription and largely achievable for free. That does not make paid services worthless — but it does mean you should do the free things first, because they are more effective than most of what you would be paying for.

The free measures, in order of effectiveness

1. Freeze your credit file with each major bureau in your country. A freeze prevents lenders from pulling your file, which prevents new accounts being opened in your name — the most damaging form of identity theft. It is free in most jurisdictions, it can be lifted temporarily when you genuinely apply for credit, and it does not affect your score. This single step blocks the category of fraud that monitoring can only report after the fact.
2. Turn on multi-factor authentication on email first, then banking, then everything else. Email is the master key: whoever controls it can reset most other accounts. Prefer an authenticator app or hardware key over SMS, because SIM-swap attacks defeat SMS codes.
3. Use a password manager and unique passwords everywhere. Credential reuse is the mechanism by which a breach at a trivial site becomes a compromise of your bank.
4. Check your credit reports directly. Free access is available in most markets, and reading the report yourself catches accounts and addresses you do not recognise.
5. Lock down your mobile account with a port-out PIN or equivalent. SIM hijacking is the attack that defeats otherwise good security.
6. File your tax return early where refund fraud is common, because the fraud depends on filing before you do.

Those six steps, done once, prevent more harm than any monitoring subscription detects.

What paid services actually provide

Credit monitoring alerts you when your file changes — a new enquiry, a new account, an address change. Useful, and often available free from banks and card issuers you already hold. If you have frozen your file, the marginal value drops considerably, because the events it would warn you about are already blocked.

Dark-web scanning searches breach dumps and criminal marketplaces for your details. It is genuinely informative the first time and repetitive afterwards, and it cannot remove anything. Free breach-notification services cover most of the same ground.

Identity restoration is the component with real value. If your identity is stolen, recovery involves a long sequence of disputes, affidavits, police reports and follow-ups with institutions that are not organised to help you. A service with dedicated case managers who make those calls on your behalf saves a substantial amount of time and stress. This is what you are actually buying.

Identity theft insurance reimburses recovery expenses — legal fees, lost wages, notarisation, sometimes direct losses. Read the schedule: limits are per policy rather than per incident, direct-loss reimbursement is usually narrowly defined, and losses your bank or card issuer would already refund are excluded. The headline million-currency-unit figure is an aggregate cap on expenses, not a payout.

Data-broker removal requests deletion of your details from people-search sites. It genuinely reduces your public footprint, needs continuous repetition because brokers re-acquire data, and is the one service that is tedious enough to be worth outsourcing.

When paying is reasonable

Three situations justify a subscription. If your data has already been exposed in a significant breach and you have seen attempted misuse, the restoration service is worth having in place before you need it. If you are in a role with elevated exposure — public profile, high net worth, a job that makes you a target — the combination of monitoring, broker removal and case management is proportionate. And if you are managing this for an elderly relative or someone who will not reliably do the free steps, a service that watches on their behalf has clear value.

For most people with a frozen credit file, multi-factor authentication, and unique passwords, the residual risk that a subscription addresses is small.

Comparing services without being sold to

Check how many bureaus are monitored, because single-bureau monitoring misses activity reported elsewhere. Check whether restoration is a genuine case manager who acts with limited power of attorney, or a call centre that reads you a checklist. Check whether family or child cover is included, since child identity theft often goes undetected for years. Check the insurance schedule for what it actually pays rather than the headline cap. And check the renewal price, because introductory rates in this category commonly double.

If it has already happened

Move quickly and in a fixed order. Freeze all credit files immediately. Change email passwords first, then financial accounts, from a device you trust. Contact each affected institution's fraud department directly rather than through general support. File a report with the relevant national fraud or identity-theft authority, because that report is the document institutions will ask for. Request fraud alerts on your files. Keep a written log of every call — date, time, name, reference number — because disputes take months and the log is what resolves them. And check your credit reports again after thirty days, since fraudulent accounts frequently surface later than the initial incident.

Phishing: still the way most of this starts

Almost every identity compromise begins with someone handing over a credential or a code, not with a technical breach. The defences are behavioural and dull. Never act on a link in an unexpected message about an account — navigate to the site yourself. Treat any inbound call claiming to be your bank as unverified and call back on the number printed on your card. Never read out a one-time code to anyone, since no legitimate institution will ask for one. And be sceptical of urgency, because artificial time pressure is the common feature of every version of this attack.

Children, and the exposure nobody checks

A child's identity is attractive to fraudsters precisely because nobody looks at it for eighteen years. Where your jurisdiction allows it, freeze minors' credit files as well — the process is more manual but the protection is the same. At minimum, check once whether a file exists for a child who has never applied for anything, because the existence of one is itself the alarm.

This is general information, not professional advice. Costs, cover, rates and rules vary by provider and location and change over time. Confirm current details directly with providers before deciding.