How to protect your personal information online.

To protect your personal information online, start with the two things that unlock everything else: your email account and your phone number. Secure those with a passkey or app-based two-step verification and a PIN with your mobile carrier, freeze your credit, then shrink what strangers can find by opting out of people-search sites and tightening your social profiles. Protecting your identity online isn’t about vanishing. It’s about making sure a leaked detail can’t be turned into access to your money or your accounts.

Below you’ll find the order to work in, a plan sized to the time you have, and what to do if something has already gone wrong.

The checklist, in priority order

Work from the top. The first items stop account takeovers and new credit in your name, the costliest problems to fix; the later ones cut down what strangers can see.

• Secure your main email account with a passkey or app-based two-step verification, and check its recovery phone and email.
• Lock your phone number with a carrier PIN, passcode or number lock.
• Give every account its own password, kept in a password manager.
• Freeze your credit at Equifax, Experian and TransUnion.
• Get an IRS Identity Protection PIN so no one else can file a tax return with your Social Security number.
• Check your email addresses for breaches and change any password that leaked or that you reused.
• Opt out of people-search sites and data brokers, or use California’s DROP if you live there.
• View your social profiles as a stranger would and hide your birthday, phone number and hometown.
• Protect your kids’ information, including a free credit freeze for children under 16.
• Repeat the checks every few months, because listings and old logins drift back.

Your time budget: 15 minutes, one hour, then ongoing

You don’t have to do everything today. Here’s what fits into the time you have, and what each step protects.

Lock down your email and phone first

Your email inbox is where password resets land, and your phone number is where many login codes go. Whoever controls either one can usually get into your bank, shopping and social accounts, so protect them before anything else.

Use passkeys or app-based codes

A passkey signs you in with your phone’s or computer’s screen lock instead of a password, and it won’t work on a look-alike login page. Turn passkeys on wherever your email provider, bank and other important accounts offer them. Where they don’t, use two-step verification and pick the strongest option available. The FTC’s guide to two-factor authentication calls security keys the strongest method and says an authenticator app is safer than codes sent by text, because a SIM swap can redirect texts.

Give every account its own password

A breach at one site turns into a breach everywhere you reused that password. A password manager makes unique passwords painless. For the few you have to remember, the FTC suggests at least 15 characters, or a passphrase made of random words; see its advice on protecting your information from hackers and scammers.

Fix your recovery details

Many takeovers go through “forgot password,” not through the password itself. Remove old phone numbers and email addresses from your recovery settings, choose security answers a stranger couldn’t look up, and sign out any device you don’t recognize. Never read a login code to someone who calls or texts asking for it; our guide to text message scams shows the usual scripts.

Protect your phone number from SIM swaps

In a SIM swap, a criminal talks your carrier into moving your number to their phone and then collects the codes sent to it. The FBI’s warning on SIM swapping advises strong authentication such as physical security keys or standalone authenticator apps, never giving your account PIN to someone who calls asking for it, and keeping your phone number off public posts.

• Ask your carrier for a PIN or passcode on your account, and turn on any number lock or port-out protection it offers.
• Move important accounts from text-message codes to a passkey or an authenticator app where you can.
• Use a second email address or number for store sign-ups, giveaways and marketplace listings.
• If your phone suddenly loses service, or you get a notice about a SIM change you didn’t make, call your carrier from another phone right away.

Freeze your credit and guard your Social Security number

A credit freeze stops lenders from pulling your credit file, which blocks most new accounts in your name. According to the FTC’s guide to credit freezes and fraud alerts, it’s free to place and lift, it doesn’t affect your credit score, and you place it separately with Equifax, Experian and TransUnion. The CFPB adds that bureaus must place a freeze within one business day of an online or phone request and lift it within an hour, so it’s easy to thaw when you apply for credit.

A fraud alert is the lighter option: businesses have to check with you before opening new credit in your name, and an initial alert lasts one year.

Two more free protections are worth the time:

• An IRS Identity Protection PIN is a six-digit number that prevents someone else from filing a tax return with your Social Security number. A new one is issued each year, and you retrieve it from your IRS online account.
• You can check your credit report from each bureau once a week for free at AnnualCreditReport.com, a program the bureaus have permanently extended.

Keep your Social Security card at home, and ask why the number is needed before you give it to a business.

Find out what’s already exposed

Check your email against known breaches

Recordwell’s free breach check shows a result only after you confirm, through a link sent to that inbox, that the address is yours. It tells you which breached services list the address and, where that’s known, what kinds of data were exposed; it doesn’t display passwords. If a service shows up, change that password and every place you reused it, then turn on two-step verification. A clean result can’t prove an address was never exposed, because new incidents take time to come to light.

See what a stranger finds under your name

Search your name, with and without your city, in a private browser window so the results aren’t shaped by your own history. Then check yourself on Recordwell: it shows what a stranger would see under your name, and it doesn’t create a public profile.

Remove your details from people-search sites and data brokers

People-search sites and data brokers gather addresses, phone numbers, ages and relatives into profiles that anyone can buy. The FTC’s guide to people-search sites that sell your information says you can opt out yourself for free, but that your details can reappear when your records change, and may still show up in a relative’s or neighbor’s report.

1. Find your listings. Search your name on the large people-search sites and note each listing’s web address.
2. Use each site’s opt-out. It’s usually linked at the bottom of the page under privacy. A separate email address keeps the confirmation emails in one place.
3. Give only what the form needs. Some sites ask you to verify your identity; never send an ID document to a site you can’t verify. Recordwell’s removal asks only for your full name, state and email, confirmed by a link, with no account, Social Security number or ID.
4. Keep a list and recheck. Note the site and the date of each request, and search again every few months.

Our removal playbook covers which sites to start with.

California residents: one request through DROP

California’s Delete Request and Opt-out Platform, or DROP, lets state residents send one free request asking every data broker registered in California to delete their information and stop selling it. It opened in January 2026, registered brokers began processing requests on August 1, 2026, and they must check for new requests at least every 45 days. The state says status updates can take up to 90 days to appear. DROP reaches only registered brokers, so keep using individual opt-outs for other sites.

Search results: Google’s Results about you

Google’s Results about you finds search results that show your phone number, home address or email address and lets you request their removal from Google Search. The page itself stays online, so pair the request with the website’s own opt-out.

What stays public

Court filings, property deeds, business registrations and professional licenses generally stay open at the offices that keep them, and people-search listings are often rebuilt from them. That’s why removal is maintenance rather than a one-time job. Our guide to what you can find in public records explains what’s open and what isn’t.

Share less on social media and apps

• Look at your profile as a stranger would. Sign out, or open a private window, and see what’s visible.
• Hide your birthday, phone number, hometown and school. Together they answer common security questions and make it easier to impersonate you.
• Turn off location sharing you don’t need, and skip photos that show your house number or license plate.
• Pass on quizzes about your first car, first street or first pet. Those are security answers.
• Review connected apps and remove the ones you no longer use.
• Delete accounts you’ve abandoned. A forgotten account can still be breached.

For a fuller review of old accounts, usernames and photos, follow our guide to checking your digital footprint.

Protect your kids and family

Children make attractive targets because no one checks their credit for years. The FTC’s guide to protecting a child from identity theft suggests asking why a school, doctor or program needs your child’s Social Security number and whether the last four digits will do. It also notes that children under 18 generally shouldn’t have credit reports, and that you can request a free credit freeze for a child under 16.

With teens, agree on what stays off public profiles: a full name together with a school, a schedule or a location. And set a family rule that any urgent request for money gets a call back on a number you already have, whoever it seems to come from.

Signs someone is using your identity

• Password-reset emails or login codes you didn’t ask for
• A phone that suddenly has no service
• Bills, collection calls or credit inquiries you don’t recognize
• An IRS notice about a tax return you didn’t file
• Mail or statements that stop arriving

If any of these happen, go to IdentityTheft.gov for a personal recovery plan, freeze your credit if you haven’t already, change the affected passwords and contact the companies involved. Our guide to what to do if your identity is stolen covers each step.

See what a stranger can find about you