---
name: identity-protection
description: Use when someone wants to reduce the risk of identity theft or fraud, or has had a data breach or suspected theft, covering credit freezes where available, account alerts, multi-factor authentication, phishing habits, and the steps to take afterwards. Rules vary by country. Related to [[password-manager]] (unique passwords), [[credit-check-system]] (checking reports for signs of fraud), and [[important-docs-vault]] (safe storage of identity documents).
---

# Identity Protection

Identity protection is layers of small habits: make it harder to open
accounts in your name, harder to take over the ones you have, and
faster to notice trouble. This skill builds the preventive setup and a
response plan for a breach or suspected theft. Availability of freezes,
reporting bodies, and legal protection differs by country.

## Input required

- **Country**, to look up current official guidance for freezes,
  reporting, and recovery.
- **Key accounts**: email, bank, phone carrier, government services,
  social media, shopping.
- **Authentication in use**: password habits, which accounts have
  multi-factor.
- **Incident status**: nothing yet, a breach notice, or suspected theft.

## Questions to ask first

Ask in **one batch of at most five questions**, skipping any already
answered:

1. Which country are you in?
2. Has anything happened (breach notice, odd charges, unknown accounts,
   unexpected password-reset emails)?
3. Which of email, bank, phone, and government accounts have
   multi-factor authentication turned on?
4. Do you reuse passwords, or use a password manager?
5. Who else (family, dependents) might be affected?

## Method

1. **Triage.** If an incident is live, jump to the response section
   below first, then return here.
2. **Lock the front door: email and phone.** These reset everything
   else. Give the email account a unique password and the strongest
   multi-factor option offered, and add a PIN or port-out protection
   with the phone carrier if available, to resist SIM swaps.
3. **Turn on multi-factor** for money, email, and government accounts.
   Prefer an authenticator app or a hardware key over text messages
   where offered; keep backup codes offline, never in the chat.
4. **Freeze credit where available.** Ask the country's official source
   whether credit freezes or similar blocks exist, how to place and
   lift them, and whether they are free. Note temporary lifting before
   a loan application.
5. **Set alerts.** Enable notifications for sign-ins from new devices,
   transactions, and address or contact changes at banks and cards.
6. **Build phishing habits.** Do not act on urgency. Go to the
   organization by a typed address or its official app, not a link.
   Be suspicious of unexpected requests for codes, since a real
   provider will not ask for a one-time code. Verify a caller by
   hanging up and calling a number from the organization's site.
7. **Reduce exposure.** Share ID numbers rarely, shred sensitive paper,
   close unused accounts, and limit personal details on public profiles.
8. **Schedule checks.** Review statements monthly and credit reports on
   a schedule; see [[credit-check-system]].

### If a breach or theft is suspected

1. Change the password and multi-factor on the affected account, then
   on any account that reused it; see [[password-manager]].
2. Contact the affected bank or provider using official numbers.
3. Place a freeze or fraud alert where available.
4. Report to the relevant official body for the country, and keep a
   dated record of calls, reference numbers, and copies of documents.
5. Check reports for unknown accounts; dispute them.
6. Watch for follow-up scams that cite the breach.

## Output format

- **Risk snapshot**: the three weakest points.
- **Setup checklist** in priority order, with a done box each.
- **Response plan** the user can print.
- **Review calendar** with dates.
- **Official sources to verify**, left for the user to fill in.

## Ground rules

- Never ask for passwords, one-time codes, recovery codes, account
  numbers, or government ID numbers.
- Do not state laws, deadlines, liability limits, or agency names as
  fact unless certain; tell the user to check the current official
  source.
- Do not recommend paid monitoring products.
- If the user is in danger or facing coercion, suggest local
  emergency or support services.

## Self-check before answering

- Did I protect email and phone first?
- Are freezes described as country-dependent, not assumed?
- Does the response plan include record-keeping?
- Did I avoid asking for any secrets?
- Is a review date set?

## Common pitfalls

- **Text-message codes only**, which can be intercepted by SIM swaps.
- **Weak email security**, which undoes every other account.
- **Clicking links** in alarming messages.
- **Forgetting to lift a freeze** before a loan application.
- **Reusing passwords** after a breach.
- **Giving details to a caller** who contacted you first.

## Example prompt

> I got a data breach notice from a company I use. Walk me through what
> to do today and what to set up so I am harder to impersonate, for my
> country. I will not share any passwords or ID numbers.

## Learn more

- [[password-manager]] for unique passwords and safe backup codes.
- [[credit-check-system]] for catching new fraudulent accounts.
- [[important-docs-vault]] for storing identity documents securely.