Immediate Response
Do these within 24–72 hours of discovering the fraud
What It Means When the IRS Contacts You
If the IRS notifies you that a return was already filed under your Social Security Number, someone has your SSN and likely other personal data. This is called tax identity theft. The fraudster files early in the season to collect a refund before you file. The IRS will not process your legitimate return until fraud is resolved — a process that can take months. Acting fast limits the damage.
Step 2 — Request your IP PIN: Once logged in, navigate to the IP PIN section. An IP PIN is a 6-digit number that must be included on any tax return filed under your SSN. Without it, the return is rejected — which stops fraudulent filings cold. → Get your IP PIN
Important — PINs change every year: The IRS issues a new IP PIN each January. Log in to your IRS account at the start of each tax season to retrieve your current PIN before filing. Your tax preparer or software will ask for it. Treat it like a password — keep it private.
Credit Freeze & IRS Protection
Lock your credit and shield your tax identity going forward
Credit Freeze vs. Fraud Alert
A credit freeze (also called a security freeze) restricts access to your credit report entirely. Lenders cannot pull your credit to open new accounts, stopping a fraudster from opening cards or loans in your name. A freeze is free at all three bureaus and can be lifted temporarily when you need to apply for credit yourself.
A fraud alert is weaker — it flags your file and asks lenders to verify your identity before extending credit, but it doesn't block the inquiry. Start with a freeze.
Passwords, Passkeys & Authentication
Upgrade how you authenticate — the right tools make a massive difference
Why You Need One Right Now
A password manager is an encrypted vault that generates and stores strong, unique passwords for every site you use. Humans cannot reliably remember dozens of strong passwords — so we reuse them, which is how one breach at a small website becomes a compromise of your email, bank, and everything else. A password manager solves this completely.
Reputable options: 1Password, Bitwarden (open source, free tier), Dashlane. Your device's built-in manager (Apple Keychain, Google Password Manager) is also a solid starting point.
Passkeys: The Future of Authentication
A passkey is a cryptographic credential that replaces your password entirely. Instead of typing a secret string, your device proves your identity using public-key cryptography — the same math that secures banks and governments. When you set up a passkey, your device creates a key pair: a private key stored securely on your device and a public key sent to the website. To log in, the site sends a challenge, your device signs it with your private key (unlocked by your face, fingerprint, or PIN), and the site verifies the signature. Your private key never leaves your device.
How to use one: When a supported site (Google, Apple, Microsoft, GitHub, PayPal) offers "Create a passkey," accept it. Your device prompts for Face ID, Touch ID, or your PIN. Next login, choose "Use passkey" instead of a password.
- Immune to phishing — key is domain-locked
- No password to steal in a breach
- Fast login with biometrics
- Works without cell service
- Blocks credential stuffing attacks
- Not all websites support them yet
- Tied to your device — losing it requires recovery
- Syncing across devices requires iCloud/Google/a password manager
- Learning curve for some users
2FA Methods Ranked by Security
Two-factor authentication requires a second proof of identity beyond your password. Not all 2FA is equal:
- Best — Hardware security key (YubiKey): Physical device, phishing-proof, gold standard
- Excellent — Passkey: Cryptographic, phishing-proof, device-bound
- Good — Authenticator app (Authy, Google Authenticator): Time-based codes, resistant to automated phishing
- Acceptable — SMS text code: Vulnerable to SIM-swapping, but far better than nothing
- Avoid — Email codes: If your email is compromised, this provides no protection
Account & Device Security
Harden the accounts and devices that hold your life
What Is a SIM Swap Attack?
A SIM swap is when a fraudster contacts your mobile carrier and tricks them into transferring your phone number to a SIM card the attacker controls. Once they have your number, they receive your SMS verification codes and can use "Forgot Password" to take over your email, then cascade into every account tied to it. Protect yourself by adding a PIN or passcode to your carrier account and requiring it for any number transfers.
Ongoing Monitoring
Build habits that catch fraud early — the sooner you know, the less damage done
What Is the Dark Web and Should You Worry?
The "dark web" refers to parts of the internet not indexed by search engines, often used for buying and selling stolen data. After a breach, your credentials may appear on dark web marketplaces within hours. You can't stop your data from being posted there, but monitoring services alert you when it appears so you can change affected passwords before attackers use them.
Free monitoring: Google One and Apple iCloud+ both include dark web monitoring. Many credit cards also include it at no cost. Paid services like Identity Guard or LifeLock offer broader SSN monitoring.