Identity Protection

Identity protection is layers of small habits: make it harder to open accounts in your name, harder to take over the ones you have, and faster to notice trouble. This skill builds the preventive setup and a response plan for a breach or suspected theft. Availability of freezes, reporting bodies, and legal protection differs by country.

Input required

• Country, to look up current official guidance for freezes, reporting, and recovery.
• Key accounts: email, bank, phone carrier, government services, social media, shopping.
• Authentication in use: password habits, which accounts have multi-factor.
• Incident status: nothing yet, a breach notice, or suspected theft.

Questions to ask first

Ask in one batch of at most five questions, skipping any already answered:

1. Which country are you in?
2. Has anything happened (breach notice, odd charges, unknown accounts, unexpected password-reset emails)?
3. Which of email, bank, phone, and government accounts have multi-factor authentication turned on?
4. Do you reuse passwords, or use a password manager?
5. Who else (family, dependents) might be affected?

Method

1. Triage. If an incident is live, jump to the response section below first, then return here.
2. Lock the front door: email and phone. These reset everything else. Give the email account a unique password and the strongest multi-factor option offered, and add a PIN or port-out protection with the phone carrier if available, to resist SIM swaps.
3. Turn on multi-factor for money, email, and government accounts. Prefer an authenticator app or a hardware key over text messages where offered; keep backup codes offline, never in the chat.
4. Freeze credit where available. Ask the country's official source whether credit freezes or similar blocks exist, how to place and lift them, and whether they are free. Note temporary lifting before a loan application.
5. Set alerts. Enable notifications for sign-ins from new devices, transactions, and address or contact changes at banks and cards.
6. Build phishing habits. Do not act on urgency. Go to the organization by a typed address or its official app, not a link. Be suspicious of unexpected requests for codes, since a real provider will not ask for a one-time code. Verify a caller by hanging up and calling a number from the organization's site.
7. Reduce exposure. Share ID numbers rarely, shred sensitive paper, close unused accounts, and limit personal details on public profiles.
8. Schedule checks. Review statements monthly and credit reports on a schedule; see Credit Check System.

If a breach or theft is suspected

1. Change the password and multi-factor on the affected account, then on any account that reused it; see Password Manager.
2. Contact the affected bank or provider using official numbers.
3. Place a freeze or fraud alert where available.
4. Report to the relevant official body for the country, and keep a dated record of calls, reference numbers, and copies of documents.
5. Check reports for unknown accounts; dispute them.
6. Watch for follow-up scams that cite the breach.

Output format

• Risk snapshot: the three weakest points.
• Setup checklist in priority order, with a done box each.
• Response plan the user can print.
• Review calendar with dates.
• Official sources to verify, left for the user to fill in.

Ground rules

• Never ask for passwords, one-time codes, recovery codes, account numbers, or government ID numbers.
• Do not state laws, deadlines, liability limits, or agency names as fact unless certain; tell the user to check the current official source.
• Do not recommend paid monitoring products.
• If the user is in danger or facing coercion, suggest local emergency or support services.

Self-check before answering

• Did I protect email and phone first?
• Are freezes described as country-dependent, not assumed?
• Does the response plan include record-keeping?
• Did I avoid asking for any secrets?
• Is a review date set?

Common pitfalls

• Text-message codes only, which can be intercepted by SIM swaps.
• Weak email security, which undoes every other account.
• Clicking links in alarming messages.
• Forgetting to lift a freeze before a loan application.
• Reusing passwords after a breach.
• Giving details to a caller who contacted you first.

Example prompt

I got a data breach notice from a company I use. Walk me through what to do today and what to set up so I am harder to impersonate, for my country. I will not share any passwords or ID numbers.

Learn more

• Password Manager for unique passwords and safe backup codes.
• Credit Check System for catching new fraudulent accounts.
• Important Docs Vault for storing identity documents securely.