Another Darn Breach? How to Protect Your Personal Data

Visit the agencies online or call them to request a freeze that must be fulfilled within one business day. Agencies have three business days if you make the request by mail. 

If you’re about to buy a new home or car or otherwise need to apply for credit once a freeze is in place, agencies must comply with your request to lift the freeze within an hour. You can put it back once your transaction is complete. 

2. Add fraud alerts. If a fraud alert is on your credit file, businesses must verify your identity before extending new credit. 

3. Monitor your accounts. Examine your account statements and report anything that seems suspicious. 

4. Check free credit reports. Look for accounts or creditor inquiries you did not initiate. Make sure your home address, Social Security number and other data is accurate. 

If you see evidence of identity fraud, contact the credit report agency and the police. 

5. Avoid reusing passwords. Security experts urge people not to use the same or even similar passwords across their accounts. If a bad guy can snatch your password in one place, he probably can get past the logins elsewhere. 

The average smartphone user has about 100 different passwords to control, Lee says. 

6. Use a password manager. People often create weak passwords because they can’t remember more effective complex ones. A password manager can help.

These tools can generate a stronger password and remember it for you. 

Many people can get by with the password manager built into their web browser or smartphone or go with a free app. A premium password manager typically adds more robust security and extra features. 

7. Investigate passkeys. Still in their relatively early stages, passkeys are more secure than passwords and may replace them eventually. They have the backing of Apple, Google, Microsoft and other giant companies. 

In layman’s terms, you have a pair of hidden keys that need to match. One is a public key that is on a web server. The other is the randomly generated private key, unique to your device. 

So someone must be in possession of your computer, phone or tablet to log in. Passkeys communicate with a financial institution or other website you’re trying to access, which verifies the device before letting you in. 

8. Authorize multi-factor authentication. “If you can only do one thing, enable MFA,” says Christopher Budd, a director at the Sophos security firm. 

Multi-factor authentication, also known as two-factor authentication, provides an additional layer of protection beyond a password. After you’ve correctly entered your user credentials but before you log in, you must enter a one-time code sent to your phone, app or other device. 

9. Share less. Question more. When information — maybe a Social Security number — is requested on medical forms and other documents, does the person or business absolutely need that information? 

“We advise people to be a little more aggressive about asking, ‘What are you doing to protect my data? What are you doing to make sure my information is secure?’ And if it gets out, ‘What are you going to do to help me?’” Lee says.  

Budd of Sophos agrees: “Be willing to say, ‘No.’ ”