We get them so often, it’s easy to mistake them for junk mail: Those “notice of data security incident” letters, ominously informing us that our personal information has been stolen from a company computer system.
Having your private information exposed is terrifying and can create financial havoc in your life. Even if you’re offered an identity theft protection service, you still have to be proactive in shielding yourself from exploitation.
According to the nonprofit Identity Theft Resource Center, there were 3,158 data compromises in 2024, resulting in more than 1.3 billion notices sent to individuals. That represents a 211 percent increase from the previous year.
When I recently opened a breach notification letter, it immediately triggered an exhausting cycle between fear of identity theft and anger over the relentless exposure of my financial data. Whether the leak was caused by a sophisticated hacker attack or corporate negligence, the reality is that the entire cleanup burden is unfairly shifted to us, the victims.
I wish I didn’t have to do this again, but here are some of the actions you should take if you get one of these notices.
Freeze out the identity thieves
Place a “security freeze” — also called a “credit freeze” — on your credit files. This will help thwart identity thieves from using your financial information to open credit cards or take out loans.
Establishing a security freeze provides more protection than placing a fraud alert on your credit report. With a fraud alert, a lender is supposed to verify your identity before it issues credit. But this doesn’t always happen, and you must renew the alert to keep it in place.
With a freeze, by contrast, the credit bureau can’t release any information in your file without your permission. For it to be truly effective, you need to request a freeze at each of the three bureaus by following these links: Equifax, Experian and TransUnion.
Just be sure to avoid links that may push you to sign up for a paid subscription that would include identity theft protection, or access to your credit scores and credit reports. If you’re asked to provide a credit card number, you’re not on the right link.
There is an inconvenient downside to a credit freeze: When you want to apply for a credit card or need someone to view your file for any other reason, you must unfreeze your credit report. Nonetheless, this is for now one of the strongest ways to stop unauthorized credit being established in your name. Both placing and lifting the freeze are free.
Be aware that a credit freeze still isn’t foolproof. Criminals might find other ways to steal your information — such as current or former home addresses, your bank account details, or your Social Security number — and use it to impersonate a government worker or law enforcement officer. By repeating your personal details to you, they can make it seem like they’re the police, FBI or IRS, tricking you into lowering your guard before they carry out their scam.
Many financial scam victims have said the scammer knew so much about them that they thought the person was legitimate.
Be super vigilant in checking your accounts
There are so many ways for hackers and identity thieves to circumvent security measures that you need to regularly check your financial accounts, going line by line and questioning every single charge or debit — no matter how small.
It’s not a matter of if your data will be compromised, but when.
Bookmark and use the government-authorized website AnnualCreditReport.com run by Equifax, Experian and TransUnion. By law, the agencies must give you a free copy of your file every 12 months. However, at the onset of the pandemic, the bureaus made it easier for consumers to view their credit history by offering free weekly credit reports. Although the offer was supposed to sunset last year, the bureaus permanently extended it.
Consider closing compromised accounts
It the breach involves a credit card, that’s easily replaced with a new card and number.
If your data incident notice says your bank account number has been exposed, call your financial institution to get advice on how to handle the exposure. Sometimes institutions will recommend closing the account; in other instances, the bank or credit union may suggest a wait-and-see strategy — because if there is fraud, you are protected.
By law, a financial institution must investigate and resolve an unauthorized electronic fund transfer within 10 business days of receiving notice. If the investigation cannot be completed in that time, the financial institution is legally required to provide provisional credit to the consumer’s account within the same 10-business-day period. You can find more information about your rights from the Federal Trade Commission.
If you can’t handle a long wait to get your money back, consider closing the account before there is any fraud to avoid worries about theft or an investigation.
Keeping the account open may also make sense if you’re reluctant to embark on a long journey untangling all the direct deposits and bill-paying attached to it. If you don’t close it, you have to be prepared to watch carefully for any unauthorized transactions.
Enable every security feature on all your accounts — every single one
The list of security measures recommended to us has become overwhelming.
We’re advised to create long and complex passwords for every account; use authenticator apps; set up multifactor authentication; and use biometric features, such as fingerprint scanning or facial recognition built into your device.
It’s a pain, but it’s what you need to do to protect yourself. Go through all the alerts that are made available and turn on every single one.
I’ve set up my accounts to get push notifications of any activity that’s made online, over the phone or through mail order. I’ll also get notified immediately if my cards are used at an ATM or outside of the United States, or for any recurring bill payment. And I get pinged when a new computer or mobile device signs in using my user ID, if there’s a request to change my address or reset my password, or if unusual debit card activity occurs.
Set your security alerts on your bank and credit card accounts to the minimum setting allowed by the institution. The lower, the better. It’s annoying because you’ll be pinged a lot, but those alerts will help catch fraud quickly. Many fraudsters attempt small charges — sometimes just a few cents — to verify if a card or bank account is valid. The amount is usually so tiny that it might not trigger a security alert or be noticeable to you.
Each corporate data breach forces us to undertake the tedious task of securing our accounts and constantly monitoring our credit and bank accounts. It’s unfair and frustrating. But we have to get used to protecting ourselves from the never-ending game of whack-a-mole that is identity theft.
The post Take these 4 steps now before your next data-breach notice appeared first on Washington Post.
