Set a timer for thirty minutes. This post is the checklist for those thirty minutes — the lockdown that makes the vast majority of identity theft attempts dead on arrival. No purchases required to do most of it, no expertise required, and every item is a step you can finish tonight. I’m writing it as a sequence with real timing, because “you should freeze your credit” advice has been said a thousand times without anyone telling you it takes about three minutes per bureau and zero dollars.
Quick disclosure: some links in this post are affiliate links, meaning I may earn a small commission if you sign up through them — at no extra cost to you. I only recommend what I actually use or would use. I’m not a financial advisor, and this is not financial advice.
Minutes 0–10: Freeze Your Credit at All Three Bureaus
This is the single highest-value move in the whole exercise, and it’s free. A credit freeze locks your credit file so nobody — including you — can open new credit in your name until you unfreeze. It does not affect your credit score, it’s free by federal law to place and to lift, and it stops the classic attack: someone applying for a credit card or loan in your name.
The three bureaus, each with its own portal:
- Equifax — online security freeze, identity-verification heavy but straightforward
- Experian — similar process, same result
- TransUnion — same
Budget three minutes each. You’ll set a PIN or manage the freeze through each account — store those credentials in your password manager the moment you create them, because a freeze you can’t unlock is its own problem when you legitimately need to finance a car. Expect some identity-verification friction (quiz questions about old addresses and loans); that friction is the point of the system, so don’t quit on minute four.
One honest limitation: a freeze stops new credit but doesn’t stop misuse of existing accounts, tax refund fraud, or medical identity theft. It’s the biggest wall, not the only one — which is why the timer keeps running after minute ten.
Minutes 10–15: Get Your IRS IP PIN
Tax refund fraud — someone filing a fake return in your name to grab your refund — is its own criminal industry, and the fix is an Identity Protection PIN from the IRS. It’s a six-digit code you give only to the IRS with your return; without it, a fraudulent return fails validation. Get it through the IRS’s online Identity Protection PIN tool, and note it renews annually (you get a new one each year, usually mailed or retrieved online). Five minutes now, annually renewed in under one. If you’ve been a victim of tax fraud before, this step isn’t optional anymore — it’s mandatory.
Minutes 15–25: Harden Your Money Accounts’ 2FA
Logins are the other front door. For your top five accounts — primary email, main bank, brokerage, payroll, and your password manager itself — do two things:
- Unique, strong passwords. If you reuse a password anywhere, a breach of that site hands attackers a working credential for everything else. The password manager post covers the full setup; tonight, just fix the five accounts that matter most.
- Upgrade 2FA from SMS where the service allows it. An authenticator app beats text codes because SIM-swap attacks — where someone ports your phone number to their device — defeat SMS specifically. Email comes first, since email is the recovery path to everything else.
This is also the honest place to mention a VPN, which is the one affiliate tool in this post: the one I use is here. It doesn’t stop identity theft by itself — nothing does — but it encrypts your traffic on hotel, coffee-shop, and airport Wi-Fi, which removes one convenient sniffing point from a layered attack. I use it mostly when traveling; treat it as one layer among several, not a force field.
Minutes 25–30: Opt Out of Prescreened Offers and Know Where to Look
Two quick finishing moves:
- Opt out of pre-screened credit offers at the official industry opt-out site or the 1-888-5-OPT-OUT number. Fewer pre-approved mailers means fewer documents sitting in your mailbox with enough information to exploit, and less mailbox theft surface.
- Know where your free credit reports live: annualcreditreport.com is the federally authorized source, and reports are available free weekly — not just annually — these days. Set a quarterly reminder to skim them for accounts you don’t recognize. This is also the place I’d steer you against paying monthly for most identity-protection subscriptions before doing the free work above; the honest guide on what’s worth paying for is here.
What This Lockdown Does and Doesn’t Stop
Being clear about scope keeps this from becoming security theater:
| Threat | Blocked by tonight’s work? |
|---|---|
| New credit opened in your name | Yes — the freeze is the wall |
| Fake tax return filed with your SSN | Yes — the IP PIN |
| Account takeover of existing accounts | Largely — unique passwords plus app-based 2FA |
| Phishing you into typing your own credentials | No tool fully stops this; skepticism does |
| Medical identity theft | Partially — review EOBs; no simple switch exists |
That last row is why the human layer matters more than any tool: no freeze helps if you hand your credentials to a convincing fake. When something “urgent” demands a login, don’t click the link — navigate to the site yourself.
After the Timer: The Maintenance Habit
The lockdown decays without maintenance, but it’s small: an annual IP PIN renewal, a quarterly skim of your credit reports, and updating credentials only when a breach announcement involves a site you use. That’s the whole ongoing load — maybe thirty minutes a year after tonight’s thirty. Compare that to the cost of untangling a fraudulent account, which typically runs months of paperwork and phone calls. The math is lopsided and it isn’t close.
If you want to go deeper on what protection services actually buy versus what’s free, the follow-on reading is the identity-theft-protection guide — it pairs with this one as the “why” to this “how.” And the related hardening step is the password manager setup, which is the natural week-two project.
Forward step: start the timer tonight and do the freezes first — bureaus, then IP PIN, then 2FA. And the related step that makes the whole thing stick: read the proactive security post and schedule the thirty-minute review on your calendar for next year.
