If you already prep, you think in physical threats — weather, power, supply. Identity theft is the odd one on the list. It can’t hurt your body, and no amount of stored food helps. But it belongs here because it’s a real risk you may face and it drains the one thing preppers guard hardest: time. And unlike almost everything else on the list, you can nearly shut this one down with a handful of steps that cost nothing but an afternoon.
Here’s the mental shift that does all the work: stop trying to keep your data from leaking. That fight is already lost. Your name, birthday, and Social Security number have almost certainly been exposed in some breach already. The 2017 Equifax breach alone exposed the Social Security numbers, birth dates, and addresses of roughly 147 million Americans — about half the adult population — from one company. So the goal isn’t secrecy. It’s making sure that when a criminal has your information, they still can’t do anything with it.
That’s not preparedness by secrecy; that’s preparedness by locking the door.
Why it earns a spot even though it won’t hurt you
On a scale that measures physical danger to your household, identity theft lands moderate — call it a 5. Nobody drowns, freezes, or goes hungry. You lose money you’ll mostly get back and time you won’t. The reason it’s still worth real effort is that the likelihood is real too. This is a genuine risk for an average person. Real odds times a recoverable-but-painful hit equals a threat you defend against precisely because the defense is so cheap next to the cleanup.
The pattern you’ve already lived
You don’t need a dramatic case study here; you’ve watched it happen. Over the last decade, “we regret to inform you that your information may have been exposed” has become routine mail. Retailers, credit bureaus, hospitals, and government agencies have all spilled personal data — Equifax lost 147 million records in 2017, and the FTC’s Consumer Sentinel Network still logs over a million identity-theft reports a year, its single largest complaint category. The lesson from every one of them is the same: the companies you trust to hold your information can’t reliably keep it. Any plan that depends on your data staying secret is built on sand.
The second thing worth knowing: stolen data doesn’t expire. A Social Security number is yours for life. Information leaked years ago can be used against you tomorrow — which is why “I haven’t had a problem yet” is not evidence that you’re safe.
Likelihood — real, and climbing
Rate this a 4. Plenty of adults will face at least one real fraud or breach event. The reasons are structural: more of life runs online, more companies hold your data, and the criminal market that buys and sells stolen identities is mature and efficient. It’s not a remote tail, but it’s not a sure thing either — a real risk you prepare for because the defense is so cheap.
But the consequence isn’t evenly spread. Whether an exposure turns into a costly ordeal depends almost entirely on the controls you set up before it happens. That’s the leverage.
Impact — the cleanup is measured in months
The direct hit is money, and most of it comes back through dispute processes. The real damage is what happens next:
- Your credit locks up right when you need it. Someone opens accounts in your name and tanks your score exactly when you’re trying for a mortgage, a car loan, or a lease.
- The cleanup drags. Fraud has to be disputed one company at a time, so it stretches over months. Each creditor starts by assuming the debt is real, and you carry the burden of proving it isn’t.
- One account unlocks the rest. If a criminal gets into your email, they can reset the password on everything tied to it — bank, brokerage, shopping. Your email is the master key. Treat it that way.
None of it is dangerous. All of it is genuinely disruptive — weeks of your life to undo something that took a criminal ten minutes.
What preparedness looks like — layer by layer
Build it in layers, hardest-hitting first.
Layer 1 — Freeze your credit at all three bureaus (Equifax, Experian, TransUnion). This is the single biggest move. A freeze blocks new credit checks, which blocks new accounts — the most damaging kind of fraud. A thief with all your information hits a locked door. It’s free by law, and you can lift it in minutes when you legitimately need to apply for something. If you do nothing else, do this. Then freeze your spouse’s and your kids’ files too — a child’s clean, unused credit file is a prime target precisely because nobody’s watching it.
Layer 2 — A password manager with a different password everywhere. The failure you’re closing here is reused passwords: one leaked password opening a dozen accounts. A password manager makes a long, unique password for every site and remembers them, so one breach stays trapped in one account. It quietly blocks phishing too, because the manager won’t fill in your password on a fake look-alike site — it knows the real address even when your eyes don’t. If you want to go a step further, use a unique e-mail address for every account as well. This is easy with services like Fastmail that let you create “alias” accounts as part of their service.
Layer 3 — Two-factor authentication, in the right order. Turn on 2FA everywhere it’s offered, and start where it matters: email first (the master key), then your bank and brokerage. Use an authenticator app over text-message codes where you can — text codes can be stolen by tricking your phone company into moving your number — but text-message 2FA still beats none at all.
Layer 4 — Alerts so you catch it fast. Turn on transaction alerts on every card and bank account so your phone buzzes the moment something happens. Read your statements. The cost of fraud scales with how long it runs unnoticed: caught in a day it’s a phone call; caught in six months it’s a project.
Layer 5 — Handle your paper and your proof. Shred anything with an account number or personal detail before it hits the trash. Then handle the other side — the records that prove you’re you. Keep your birth certificate, Social Security card, passport, and a current list of your accounts in one secure, organized place. The day you have to prove your real identity against a fraudster’s fake version, having those documents in hand turns weeks of scrambling into a same-day job.
Bottom Line
- Freeze all three credit files (and your family’s). Free, reversible, and it blocks the worst kind of fraud cold.
- Password manager plus a unique password everywhere to kill reused passwords; 2FA on email first, then money.
- Turn on real-time alerts so fraud is caught in hours, not months — how fast you catch it is the impact.
- Assume your data already leaked and defend what can be done with it, not the secret.
- Keep your identity documents organized and secure so proving who you are is fast when you have to.
You can’t stop your data from leaking. You can make it worthless to the person who leaked it — and a credit freeze does most of that work for free.
Store your account list and identity documents in the encrypted Digital Binder so a fraud incident is a checklist, not a scavenger hunt.