Shrink what they can find

How they got your information explains where your details came from. This page is the other half: what to do about it.

None of this is urgent. You can do one item a week and be finished by the fall. The list is in order of how much good each one does, so if you only ever do the first, you will have done most of the work.

One thing to be clear about before you start. Locking your information down makes you harder to find and harder to open accounts against. It does not decide whether a scam works on you. That is still the three steps, and those work even against somebody who already knows your address, your bank, and your daughter's name.

1. Freeze your credit

This is the single best thing on the page. It stops somebody opening a loan, a card, or an account in your name, because lenders check your credit file first and a freeze means they cannot see it.

It is free. Federal law says so, at all three bureaus, with no catch and no trial period. Anybody charging you for a freeze is selling you something else.

It does not hurt your credit score. It does not close anything you already have. Your cards keep working, your mortgage is untouched, your score does not move.

You can undo it in minutes. When you apply for a card or a car loan, you lift the freeze, do the thing, and put it back. Online it takes about a minute. Lenders are used to this and will tell you which bureau they use.

You have to do it three times, once at each bureau, because they do not talk to each other:

Equifax at equifax.com or 888-378-4329
Experian at experian.com or 888-397-3742
TransUnion at transunion.com or 800-916-8800

Each one will either give you a PIN or have you make an account. Write down whichever it is and put it where you keep your passport. Losing it is not a catastrophe, but getting back in without it is a tedious afternoon.

If you want to be thorough, two smaller bureaus are worth doing too. Innovis works like the big three. NCTUE is the one utility and phone companies check, which is how somebody opens a cell account in your name. Both have freeze forms on their websites.

Twenty minutes for the main three. Possibly the best twenty minutes of housekeeping available to an adult in this country.

2. Lock down your email

Your email account can reset the password on nearly everything else you own. Somebody who gets into it does not need your banking password. They can just ask the bank to send a reset link, and then read it.

So it gets treated differently from your other accounts.

Give it a password you use nowhere else. If that one password leaks in a breach somewhere, it should not open anything but your email. This matters more than the password being complicated.

Turn on two-factor authentication. Your email provider will call it two-step verification or login verification. It means that after your password, the account wants one more thing, usually a code. Somebody with your password and nothing else is then stuck.

Use an app rather than text messages if the choice is offered. Codes by text are much better than nothing, and most people should just use them. But a text can be stolen by moving your phone number to somebody else's phone, which is a real thing that happens and has its own page. An authenticator app cannot be taken that way.

Check two settings while you are in there. First, the recovery phone number and backup email. If either is old, fix it, because that is how you get back in when something goes wrong. Second, look for anything called forwarding or rules. Somebody who got in quietly will often set your mail to copy itself to them and then leave. It is worth thirty seconds to look, and most people have never looked once.

3. Turn on two-factor at the bank

Same idea, and every bank offers it now. Find it under security settings, or call the number on your card and ask them to switch it on with you.

Prefer the app over text messages here too, if your bank offers both.

The important part is not the setup. It is this: the code that arrives is for you to type, never to say. Your bank will never ring and ask you to read it back. Anybody who does is standing at the door trying to get you to hand over the key. This is the single most common way a careful person loses money, and you are now immune to it.

4. Get yourself off the people-search sites

These are the websites that publish your address, age, relatives, and old phone numbers to anybody who types your name. They are legal. They are also where a scammer does five minutes of homework before calling you, which is how they know your grandson's name.

Each one has an opt-out page. Each takes a few minutes and asks for an email to confirm. Doing the big ones is an afternoon, and you can spread it out.

Start with these: Spokeo, Whitepages, BeenVerified, Intelius, Radaris, PeopleFinders, MyLife, TruePeopleSearch, FastPeopleSearch, and That's Them.

Two honest warnings. Your details will creep back over a year or two as the sites rebuild from public records, so this is a thing to redo occasionally rather than finish forever. And the paid services that do it for you genuinely work, but they are a subscription, not a cure, because they are fighting the same re-listing. Reasonable to buy. Not necessary.

Before you start, search your own name and see what comes up. It tells you which sites actually have you, and it shows you what a stranger sees.

5. Be stingy with your phone number

Your phone number has become a kind of identifier. It follows you between companies and it is what ties a data broker's records together. Treat it a bit like your address.

Stop giving it out at checkout. Shops ask for it out of habit. You can say no, and nothing happens.

Register at donotcall.gov. Criminals ignore it completely. That is fine. It quiets the legitimate marketing calls, and once the ordinary noise drops, a strange call stands out instead of blending in.

Turn on your carrier's spam filtering. AT&T, Verizon, and T-Mobile all offer it free, and it is off by default for many people. Call your carrier and ask them to switch on call filtering for your line.

Let unknown numbers go to voicemail. This is the cheapest habit here and it costs you almost nothing. A real caller leaves a message. You call back when you are ready, on a number you looked up, which is step one anyway.

6. Tidy up your mail

Paper still matters, because a stolen envelope can contain an account number and a name together.

Opt out of pre-approved credit offers at optoutprescreen.com or 888-567-8688. This is the same idea as the credit freeze but for the paper version, and it means fewer live credit applications sitting in your mailbox.

Shred anything with an account number on it. Statements, medical paperwork, insurance letters. A cheap crosscut shredder is about thirty dollars and lasts years.

Do not leave outgoing mail in your own box with the flag up. That flag is visible from the street, and checks get stolen that way. Use a blue collection box or hand it to your carrier.

Claim your USPS Informed Delivery account at usps.com. It emails you a picture of what is arriving each day. The reason to claim it is that if you do not, somebody else can claim it in your name and watch your mail instead.

What not to hand over

Short list, and it applies on the phone, at the door, and online.

Never: your Social Security number to somebody who rang you, a code that arrived by text, a password, remote access to your computer, or a photo of your ID sent to somebody you have not met.

Careful with: your full date of birth, your mother's maiden name, the street you grew up on, your first pet. Those last few are not trivia. They are the answers to security questions, and people post them publicly without noticing.

On social media: set your accounts to friends only. Take your birth year and phone number off any public profile. Think about vacation photos posted while you are away rather than after you get back.

And ask your grandchildren to lock their accounts down too. Public videos of them talking are where a cloned voice comes from, which is a real and growing problem.

If you do nothing else

Freeze your credit and put a unique password with two-factor on your email. Those two take under an hour together and they close the doors that matter most.

Everything after that is genuine improvement, but it is optional in a way the first two are not.