Shrink what they can find

How they got your information explains where your details came from. This page is the other half: what to do about it.

None of this is urgent. Do one item a week and you'll be finished by the fall. The list runs in order of how much good each one does, so if you only ever do the first, you've done most of the work.

One thing to be clear about before you start. Locking your information down makes you harder to find and harder to open accounts against. It doesn't decide whether a scam works on you. That's still the three steps, and those work even against somebody who already knows your address, your bank, and your daughter's name.

1. Freeze your credit

This is the single best thing on the page. It stops somebody opening a loan, a card, or an account in your name, because lenders check your credit file first and a freeze means they can't see it.

It's free. Federal law says so, at all three bureaus, with no catch and no trial period. Anybody charging you for a freeze is selling you something else.

It doesn't hurt your credit score. It doesn't close anything you already have. Your cards keep working, your mortgage is untouched, your score doesn't move.

You can undo it in minutes. When you apply for a card or a car loan, you lift the freeze, do the thing, and put it back. Online that usually takes a few minutes, and the law gives the bureau up to an hour. Lenders are used to this and will tell you which bureau they use.

You have to do it three times, once at each bureau, because they don't talk to each other:

Equifax at equifax.com or 888-298-0045
Experian at experian.com or 888-397-3742
TransUnion at transunion.com or 800-916-8800

Each one will either give you a PIN or have you make an account. Write down whichever it is and put it where you keep your passport. Losing it isn't a catastrophe, but getting back in without it is a tedious afternoon.

If you want to be thorough, two smaller bureaus are worth doing too. Innovis works like the big three. NCTUE is the one utility and phone companies check, which is how somebody opens a cell account in your name. Both have freeze forms on their websites.

Twenty minutes for the main three. It's the best twenty minutes of housekeeping available to an adult in this country.

2. Lock down your email

Your email account can reset the password on nearly everything else you own. Somebody who gets into it doesn't need your banking password. They can just ask the bank to send a reset link, and then read it.

So it gets treated differently from your other accounts.

Give it a password you use nowhere else. If that one password leaks in a breach somewhere, it should open nothing but your email. That matters more than the password being complicated.

Turn on two-factor authentication. Your email provider will call it two-step verification or login verification. It means that after your password, the account wants one more thing, usually a code. Somebody with your password and nothing else is then stuck.

Use an app rather than text messages if you're offered the choice. Codes by text are much better than nothing, and most people should just use them. But a text can be stolen by moving your phone number onto somebody else's phone, which is a real thing that happens and has its own page. An authenticator app can't be taken that way.

Check two settings while you're in there. First, the recovery phone number and backup email. If either one is old, fix it, because that's how you get back in when something goes wrong. Second, look for anything called forwarding or rules. Somebody who got in quietly will often set your mail to copy itself to them and then leave. It's worth thirty seconds to look, and most people have never looked once.

3. Turn on two-factor at the bank

Same idea, and every bank offers it now. Find it under security settings, or call the number on your card and ask them to switch it on with you.

Prefer the app over text messages here too, if your bank offers both.

The important part isn't the setup. It's this: the code that arrives is for you to type, never to say. Your bank will never ring and ask you to read it back. Anybody who does is standing at the door trying to get you to hand over the key. This is the single most common way a careful person loses money, and you're now immune to it.

4. Get yourself off the people-search sites

These are the websites that publish your address, age, relatives, and old phone numbers to anybody who types your name. They're legal. They're also where a scammer does five minutes of homework before calling you, which is how they know your grandson's name.

Each one has an opt-out page. Each takes a few minutes and asks for an email to confirm. The big ones are an afternoon's work, and you can spread it out.

Start with these: Spokeo, Whitepages, BeenVerified, Intelius, Radaris, PeopleFinders, MyLife, TruePeopleSearch, FastPeopleSearch, and That's Them.

Two warnings. Your details will creep back over a year or two as the sites rebuild from public records, so this is something to redo occasionally rather than finish forever. And the paid services that do it for you genuinely work, but they're a subscription, not a cure, because they're fighting the same re-listing. Reasonable to buy. Not necessary.

Before you start, search your own name and see what comes up. It tells you which sites actually have you, and it shows you what a stranger sees.

5. Be stingy with your phone number

Your phone number has turned into a kind of identifier. It follows you between companies, and it's what ties a data broker's records together. Treat it a bit like your address.

Stop giving it out at checkout. Shops ask out of habit. You can say no, and nothing happens.

Register at donotcall.gov. Criminals ignore it completely, and that's fine. It quiets the legitimate marketing calls, and once the ordinary noise drops, a strange call stands out instead of blending in.

Turn on your carrier's spam filtering. AT&T, Verizon, and T-Mobile all offer it free, and for many people it's off by default. Call your carrier and ask them to switch on call filtering for your line.

Let unknown numbers go to voicemail. This is the cheapest habit on the page. A real caller leaves a message. You call back when you're ready, on a number you looked up, which is step two anyway.

6. Tidy up your mail

Paper still matters, because a stolen envelope can carry an account number and a name together.

Opt out of pre-approved credit offers at optoutprescreen.com or 888-567-8688. It's the same idea as the credit freeze but for the paper version, and it means fewer live credit applications sitting in your mailbox.

Shred anything with an account number on it. Statements, medical paperwork, insurance letters. A cheap crosscut shredder runs about thirty dollars and lasts years.

Don't leave outgoing mail in your own box with the flag up. That flag is visible from the street, and checks get stolen that way. Use a blue collection box or hand it to your carrier.

Claim your USPS Informed Delivery account at usps.com. It emails you a picture of what's arriving each day. You'll see what's on its way, so you notice when something goes missing.

What not to hand over

Short list, and it applies on the phone, at the door, and online.

Never: your Social Security number to somebody who rang you, a code that arrived by text, a password, remote access to your computer, or a photo of your ID sent to somebody you haven't met.

Careful with: your full date of birth, your mother's maiden name, the street you grew up on, your first pet. Those last few aren't trivia. They're the answers to security questions, and people post them publicly without noticing.

On social media: set your accounts to friends only. Take your birth year and phone number off any public profile. Think about vacation photos posted while you're away rather than after you get back.

And ask your grandchildren to lock their accounts down too. Public videos of them talking are where a cloned voice comes from, which is a real and growing problem.

If you do nothing else

Freeze your credit, and put a unique password with two-factor on your email. Those two take under an hour together, and they close the doors that matter most.

Everything after that is genuine improvement, but it's optional in a way the first two aren't.