Fraud defence has an unusually clear hierarchy. A small number of structural controls block whole categories of attack permanently; a large number of habits offer marginal improvement. The problem is that the marginal habits are what gets written about, because the structural controls can be described in a single afternoon and generate no recurring revenue.
The order that matters
- Secure the email account first.Unique password, app-based or hardware second factor, and recovery options reviewed. Every other account resets through here.
- Add a carrier port-out PIN.This blocks SIM swapping, which is how attackers defeat SMS codes. It takes one call and costs nothing.
- Freeze credit at every major bureau.Free, permanent until you lift it, and it stops new accounts being opened in your name. Include the lesser-known bureaus.
- Move second factors off SMS.An authenticator app is better; a hardware security key is best, particularly for email and primary banking.
- Use a password manager.The realistic failure mode is reuse — one breached site becoming every account. Unique credentials everywhere is only achievable with a manager.
- Know your liability by payment type before you need to. This is the difference between an inconvenience and a permanent loss.
Freeze, alert and monitoring are three different thingsA freeze prevents lenders pulling your file, so new credit cannot be opened — prevention. An alert asks lenders to take extra verification steps — a request, not a block. Monitoring tells you after something has happened — detection. They are frequently sold and discussed interchangeably. Only the first one actually stops the event.
Liability is not uniform
| Payment method | Typical protection if defrauded | Practical note |
|---|---|---|
| Credit card | Strongest — chargeback and dispute rights | Best instrument for anything unfamiliar |
| Debit card | Protected, but the money leaves first | Timely reporting matters; provisional credit can take time |
| Instant bank transfer you authorised | Often little or none | The dominant scam vector precisely for this reason |
| Unauthorised electronic transfer | Protected if reported promptly | "Authorised under deception" is treated differently from "unauthorised" |
| Wire transfer | Very limited once sent | Effectively irreversible; verify recipients out-of-band |
| Crypto transfer | None | No reversal mechanism exists at all |
Consumer protection rules, reporting deadlines and dispute rights differ by country and by institution, and are actively evolving for authorised-push-payment fraud. Confirm your own bank's stated policy and your local rules.
The one rule that prevents most modern scamsNobody legitimate will ever ask you to move money to protect it. Not your bank, not the police, not a fraud department. Every variant of this scam — the safe account, the verification transfer, the arrest warrant — depends on urgency plus an inbound contact. End the call and dial the number on your card yourself.
If it has already happened
- Report to the institution immediately and in writing. Protection frequently depends on reporting deadlines. Note the time, the reference and the name.
- Freeze credit at all bureaus. Even if the compromise looks limited to one account.
- Change email credentials and revoke sessions. Not just the password — revoke active sessions and review forwarding rules, which attackers add to intercept future messages.
- Check for changed contact details. A quietly altered phone number or address on an account is the setup for the next attempt.
- File the official report. Many recovery processes require a formal identity-theft report before they will act.
- Review the accounts you rarely open. Dormant accounts and old retirement accounts are targeted precisely because nobody looks — see the bank fee audit for a full account sweep.
Limits, errors and borders of the standard advice
Critical reviewConsumer security advice is shaped by two commercial interests: monitoring services selling subscriptions against fear, and institutions with an incentive to frame fraud as customer carelessness. Both produce advice that is outdated, overstated, or aimed at the wrong threat. Here is where it fails.
"Identity theft protection services will keep you safe."
The claimA paid monitoring subscription protects your identity and is worth the monthly cost.
Where it breaksThese services overwhelmingly detect rather than prevent, and they detect things you can be alerted to for free. The structural controls that actually block new-account fraud — bureau freezes — are free by law in many jurisdictions, and a subscription is not required to use them. The headline insurance figures are largely reimbursement for costs incurred during recovery, subject to exclusions, not a guarantee against loss. Several also monitor only one bureau while implying full coverage. Most tellingly, these products are frequently sold by the same bureaus whose data breaches created the exposure.
The borderThere is a real case for a paid service where the recovery-assistance component has genuine value: an elderly relative who will not manage this alone, someone already the victim of a complex theft, or a family wanting one coordinated dashboard. Buy it for the human help, not for protection you can obtain free — and only after the freezes are in place.
"Use two-factor authentication — SMS codes make you secure."
The claimAny second factor dramatically improves security, and SMS is the accessible option.
Where it breaksSMS is much better than nothing and much weaker than it is presented. It is defeated by SIM swapping, which requires social engineering of a carrier rather than any technical sophistication, and telephone messaging was never designed as a security channel. The advice also rarely mentions that adding a phone number to an account can reduce security by creating a new account-recovery path an attacker can attack instead of your password. Worse, many institutions still permit SMS-based recovery even when you have enabled a stronger factor, so the weakest method remains available to an attacker regardless of what you chose.
The borderSMS is acceptable for low-value accounts and much better than a password alone. For email, primary banking, brokerage and anything holding crypto, use an authenticator app or a hardware key, add a carrier port-out PIN, and check whether SMS recovery can be disabled entirely — if it cannot, treat that account as protected only to the strength of your phone number.
"Change your passwords every 90 days."
The claimRegular rotation limits the damage from an undetected compromise.
Where it breaksThis guidance has been formally retracted by the standards bodies that originally promoted it, and it persists mainly through corporate IT policy inertia. Forced frequent rotation reliably produces weaker passwords — predictable increments, minor substitutions, and reuse across sites — because humans respond to the requirement rather than its intent. It also does nothing against the actual modern compromise paths: credential stuffing from a breach, phishing, and session-token theft, none of which wait ninety days. Meanwhile it consumes the limited attention users have for security, spending it on the least effective control available.
The borderChange a password immediately when there is a reason: a breach notification, a shared credential, a suspicious login, a device you no longer control. Otherwise prefer long unique passwords held in a manager, and spend the saved effort on second factors — where the same attention buys far more protection.
"Your bank will always refund fraud — you're covered."
The claimConsumer protection rules mean fraud losses are ultimately reimbursed.
Where it breaksThe protection is strong for unauthorised transactions and frequently absent for transactions you authorised while being deceived — which is now how most consumer fraud money actually moves. Scams are engineered specifically to make the victim press the button, because that reclassifies the loss. Reimbursement also depends on reporting deadlines that people miss while trying to resolve things informally, and coverage varies enormously by payment rail: card disputes are robust, wires and instant transfers frequently are not, and crypto has no mechanism at all. The rules for authorised-push-payment fraud are shifting in some jurisdictions, which makes confident general claims unreliable in either direction.
The borderAssume strong protection on credit cards, decent protection on debit for genuinely unauthorised use if reported promptly, and effectively none once you have knowingly authorised a transfer. Route anything unfamiliar through a credit card, and verify any payment instruction using a number you looked up yourself.
"Freeze your credit and you're protected from identity theft."
The claimA credit freeze prevents identity theft.
Where it breaksA freeze is the highest-value single step and it addresses one category: new credit accounts opened in your name. It does nothing against takeover of accounts you already hold, tax or benefits fraud, medical identity fraud, employment fraud using your identifier, or fraudulent activity at institutions that do not pull a bureau file. It also does not cover every bureau unless you freeze each one individually, including the smaller specialist agencies most people have never heard of. Treating the freeze as completion produces a false sense of security exactly where the more common modern attack — takeover of an existing account through email and phone — is unaddressed.
The borderFreeze everywhere, always — it is free and it closes a whole category permanently. Then treat email security, the carrier PIN and payment-method discipline as separate, equally necessary work, because they defend against the attacks the freeze cannot see.
We name no specific bureaus, agencies, statutes or reporting deadlines, because these are jurisdiction-specific and change — which keeps the article durable but means you must look up the actual freeze links and reporting routes for your country yourself. The setup we recommend also assumes a level of technical comfort and administrative patience that a meaningful share of the people most targeted by fraud do not have; for them, the honest answer may well be the paid service with human support that we are otherwise sceptical of. And our liability table describes typical positions, not your bank's contract — which is the only document that governs your case.
Frequently asked questions
Does freezing credit hurt my credit score?
No. A freeze restricts access to your file; it is not a negative marker and does not affect scoring. Mechanics of what does affect it are in the credit score blueprint.
Do I need to unfreeze to apply for credit?
Yes — temporarily lift it before applying, then it re-freezes or you re-apply the freeze. Plan this into any application, including a refinance.
Should I freeze my children's credit?
Yes, where permitted. Child identity fraud goes undetected for years because nobody checks a minor's file. Related planning in the real cost of raising a child.
Which accounts deserve a hardware security key?
Email first, then primary banking and brokerage, then anything holding digital assets — see high-yield savings for how account sprawl increases the surface to defend.
Is a business exposed differently from an individual?
Yes — business accounts often carry weaker consumer protections and are targeted for payment-instruction fraud. See business banking setup.
The bottom line
Spend one afternoon on the structural controls: secure email with a strong second factor, add a carrier port-out PIN, freeze credit at every bureau, move second factors off SMS, and adopt a password manager. Then learn your liability by payment type, because the difference between a card dispute and an authorised transfer is the difference between an annoying week and a permanent loss.
Revision log. Aug 2026: added the critical review, the liability-by-payment-type table and the incident checklist. Protection rules vary by jurisdiction and are evolving; verify locally. Not legal advice.