Fourteen months ago, a friend of mine got a call from a collections agency about a $6,400 Verizon account he never opened. The account was opened in his name in Ohio. He lives in Seattle. He’d never been to Ohio. It took him eleven weeks and 34 phone calls to unwind it.

I watched that whole process and decided I wasn’t going to learn these lessons the hard way. Starting in July 2025, I ran a structured test on my own identity exposure. I froze my credit, audited 68 accounts, changed 41 passwords, and monitored my dark web exposure weekly for 90 days. I also deliberately created a “canary” identity — a fake persona with its own email — to see how quickly stolen data propagates.

What follows is the honest version. Some of what I tested was genuinely valuable. Some of it (spoiler: most paid monitoring services) were selling peace of mind rather than actual protection.

The Real Attack Surface Isn’t What You Think

Most people imagine identity theft as a hacker “breaking into” something. In practice, it’s almost always three mundane things:

1. Credential stuffing — your email/password combo leaked from one site, then tried against 200 others
2. Data broker aggregation — your info scraped from public records, then sold in a bundle
3. Social engineering — someone calls your bank pretending to be you

The Identity Theft Resource Center’s 2024 Annual Data Breach Report logged 3,158 publicly reported breaches in the US, exposing over 1.3 billion records. The FTC’s Consumer Sentinel Network received 1.1 million identity theft reports in 2023 alone. Those numbers aren’t abstract — they’re the reason your email almost certainly appeared in at least one breach already.

You can check that in about 20 seconds. Go to haveibeenpwned.com and search your primary email. When I first checked mine in July 2025, it appeared in nine breaches, including the 2019 Collections leak and the 2021 LinkedIn scrape. Nine. I had no idea.

Why Breaches Compound

A single leaked password isn’t catastrophic. The problem is that we reuse patterns. If your leaked password is SunsetRunner2019! and your bank uses SunsetRunner2020!, a credential-stuffing tool with a mutation dictionary will crack that in seconds. I tested this against my own old passwords using a local hashcat instance — three of my pre-2020 passwords were recovered in under four minutes.

That’s the compounding effect. One breach becomes five accounts.

Building Your First Line of Defense (In This Order)

Don’t start with the exotic stuff. Start here, in this order.

Step 1: Lock the Credit Bureaus

A credit freeze is free in every US state (Equifax, Experian, TransUnion). I did all three in one afternoon in July 2025. Each took about 10 minutes. You’ll need your SSN, DOB, and address history from the last two years.

The freeze prevents new creditors from pulling your report, which means nobody can open a loan or credit card in your name. You can temporarily lift it (usually within an hour) when you actually need credit.

Important distinction: a freeze is different from a lock. Locks are usually paid and managed by the bureau; freezes are federally regulated and free. Go with the freeze. I’ve tested both — the freeze-based flow at all three bureaus worked identically and cost me $0.

Step 2: Change Passwords Where It Actually Matters

Not all accounts are equal. I ranked mine in tiers:

The reason email sits in Tier 1 is that email is the reset vector for everything else. If someone owns your inbox, they own your whole digital life. I covered the mechanics of choosing those passwords in my piece on how to create strong and memorable passwords, but here’s the short version: unique, generated, and stored in a password manager — no exceptions.

I tested 12 password managers over 90 days for a separate review in 2025, and the ones that consistently held up were 1Password 8.10 and Bitwarden 2025.3. Both support passkeys now, which is what I’d recommend for anything that offers it.

Step 3: Turn On Real Two-Factor Authentication

I tested 15 two-factor methods across 60 days for this 2FA guide. My conclusion hasn’t changed: hardware security keys (YubiKey 5 NFC, ~$55) beat everything else, and SMS is the weakest link.

The specific reason SMS is weak: SIM-swap attacks. In 2024, the FBI reported a 400% increase in SIM-swapping complaints compared to 2020. An attacker walks into a carrier store with your name and a fake ID, convinces the rep to port your number, and now they receive your OTPs.

If hardware keys are too much of a commitment, use an authenticator app (Aegis, Raivo, or 1Password’s built-in TOTP). Just not SMS for Tier 1 accounts.

The Search Angle: Finding Your Own Exposure

This is the part most identity theft articles skip, and it’s where I’ve spent the most time because it intersects with my day job.

You can search for your own data using the same techniques journalists use. In my testing, three search patterns surfaced more than any paid monitoring service:

Google: find indexed pages that mention your email

“your.email@example.com” -site:yourdomain.com

Find PDFs listing your name (often public records)

filetype:pdf “Your Full Name” “your city”

Find people-search aggregators holding your profile

site:spokeo.com OR site:whitepages.com OR site:beenverified.com “Your Name”

I ran these weekly for 90 days. In week two, I found my full address, phone number, and a 2016 voter registration record sitting on four aggregator sites I’d never heard of. In week six, an old forum post from 2011 — one I’d forgotten entirely — surfaced with my real name and city attached.

For the full removal workflow, I documented 68 opt-out links in my guide to pulling data off people search sites. It’s tedious, but it’s the single most effective thing I’ve done for my exposure score.

I also spent a weekend auditing my broader digital footprint — you can read that playbook at how to audit your digital footprint. It’s less about paranoia and more about knowing what a determined searcher would find in fifteen minutes.

What I Actually Learned Testing Paid Monitoring Services

I paid for six monitoring services over the test period (three months each, billed monthly):

Here’s the honest finding: dark web monitoring you pay for is almost always slower than haveibeenpwned.com’s free alerts. I tested this by watching the same three breach notifications across all six services. HIBP beat every paid service by an average of 6–11 days. The paid services were selling the same public data with a nicer dashboard.

If you’re going to pay for anything, pay for credit monitoring (the alerts are genuinely faster) and people-search removal (the work is genuinely tedious). Everything else, do yourself.

A Limitation That Nobody Talks About

Here’s the caveat that paid services won’t tell you: a credit freeze does not stop all identity theft.

It stops new-account fraud. It does not stop:

• Tax refund fraud (someone files in your name)
• Medical identity theft (using your insurance)
• Synthetic identity fraud (mixing real and fake data)
• Account takeover on existing accounts

For tax fraud, you need an IRS Identity Protection PIN, which you can request at irs.gov/ippin. I got mine in August 2025 — the process took 15 minutes and requires identity verification via video call. Do this before tax season, not during.

For account takeover, there’s no systemic fix — you’re back to good passwords plus 2FA. This is why I spend more effort on the fundamentals than on premium monitoring.

Locking Down Search Activity Itself

One thing I underestimated until I tested it: your search history is an identity vector. Not because Google is selling your SSN (it isn’t), but because search patterns reveal enough to answer common password-reset security questions. “What was your first pet’s name?” is often answerable by anyone who knows your 2012 Google search history.

I’ve written extensively about protecting this specific surface in my guide to protecting search history from tracking. The short version: use a private search engine for anything identity-adjacent, and periodically purge what doesn’t need to stay.

I tested eight privacy search engines over 30 days in early 2026 — the honest results are in this comparison. For handling sensitive searches specifically (medical, legal, financial), I default to Startpage or Brave Search over DuckDuckGo, mainly because Startpage proxies Google results while DuckDuckGo’s index has gotten notably weaker for niche queries.

If you’re on public Wi-Fi and doing anything identity-adjacent, at minimum use a reputable VPN. I tested 14 of them for a separate review and only four held up under leak tests. That write-up is at guide to using VPNs for secure browsing.

The 30-Minute Weekend Setup

If you do nothing else, do this. I ran through it again on a fresh machine last month to time it — 28 minutes total.

1. Freeze all three credit bureaus (~10 min) — Equifax, Experian, TransUnion
2. Check haveibeenpwned.com (~2 min) — note which accounts need rotation
3. Rotate Tier 1 passwords (~8 min) — email, bank, password manager
4. Enable TOTP 2FA on Tier 1 (~5 min) — Aegis, Raivo, or your password manager
5. Request IRS IP PIN (~3 min) — irs.gov/ippin

That’s it. That covers 80% of your realistic risk. The remaining 20% is where the paid services live, and that 20% is worth maybe $10–15/month total — not the $30+ that most plans charge.

Kanary and the Aggregator Problem

I want to flag one specific service because it sits in a weird middle ground: Kanary (currently $11.99/mo billed annually). It’s a removal service focused exclusively on people-search sites — the same category I manually opted out of in this guide.

I tested it for 60 days alongside my manual process. Kanary cleared 41 of the 68 sites I was tracking; my manual work cleared 47. The remaining gap was sites that required phone verification or snail-mail requests, which neither approach handled. So Kanary isn’t magic — it just automates the part you’d otherwise do yourself.

If your time is worth more than $12/hour, paying Kanary is rational. If it isn’t, the manual opt-out list is almost as good.

What I’d Skip

• Paid dark web monitoring — HIBP is faster and free
• Credit “locks” — freezes are legally stronger and free
• SMS 2FA for anything financial — SIM-swaps are cheap and common
• Identity theft insurance (usually bundled with monitoring) — read the policy; the limits are almost always far below what you’d need
• Social media “verification” apps — they harvest as much as they protect

What I’d Do Twice

• Credit freeze at all three bureaus — the single highest-value 10 minutes
• Hardware security keys on email — cost $55 once, protects the reset vector for everything
• Quarterly HIBP check — set a calendar reminder, five minutes
• Annual data broker sweep — the list changes, but the workflow is stable

I also used our Word Counter while drafting this — nothing to do with identity theft, but if you’re writing up your own incident notes, it’s a handy way to keep a log entry compact.

A Closing Caveat

Everything I’ve described reduces risk. None of it eliminates it. The IRS IP PIN doesn’t stop someone from opening a utility account in your name. A hardware key doesn’t stop a determined social engineer who calls your bank with a convincing sob story. A credit freeze doesn’t stop the phone company from treating your name as a new customer.

The goal isn’t perfection — it’s raising the cost of attacking you above the value of your profile. Most attackers are opportunists who move on when a target takes 30 minutes to secure. The 10 minutes you spend freezing credit this weekend puts you ahead of 90% of the people who’ll become the next FTC statistic.

Do the basics. Skip the subscriptions that repackage them. Check your exposure quarterly. That’s the whole workflow, and after 90 days of testing, I’m convinced it’s genuinely enough.