Freeze your credit at all three bureaus

A security freeze locks your credit file so no one — including you — can open new credit in your name until you lift it. It is the single most effective anti-fraud tool available to a consumer, and under Florida's § 501.005 and federal law it is free to place, lift, and remove. Do it at Equifax, Experian, and TransUnion separately; a freeze at one does not cover the others.

A freeze is not the same as a fraud alert or a credit lock. Fraud alerts only ask lenders to verify your identity. Locks are often bundled with a paid subscription product. The freeze is the one with statutory teeth.

Freeze your children's credit — and any adult you care for

Child identity theft is the quietest form of this crime. A stolen Social Security number belonging to a six-year-old can be used for a decade before anyone applies for a student loan and discovers the damage. Florida's § 501.0051 lets a parent or legal guardian place a freeze on the file of a minor under 16 — and if no credit file exists, the bureau must create one solely to freeze it.

The same statute extends to a guardian or advocate acting for an incapacitated, disabled, or protected person under Chapters 39, 393, 744, or 914. If you hold a guardianship or power of attorney for an aging parent, this is your tool.

Get an IRS Identity Protection PIN

Tax refund fraud is a Florida specialty. An IP PIN is a six-digit number the IRS issues to you each year; without it, no one can e-file a federal return using your Social Security number. It is free, available to anyone through the IRS website, and renewed annually. Do this before filing season, not during it.

While you are at it, create your my Social Security account at ssa.gov. If you do not claim it, someone else can.

Freeze the bureaus nobody tells you about

The big three are not the whole picture. Utilities and mobile carriers frequently pull from the NCTUE; banks screen new checking accounts through ChexSystems; insurers and landlords use LexisNexis; some lenders use Innovis. Each accepts a free freeze or file disclosure request. Closing these gaps is what stops a thief from opening a phone account or a bank account in your name after the main freeze blocks the credit card.

Lock down your phone number with your carrier

A SIM-swap or port-out attack moves your phone number to a criminal's device. Every text-message code you rely on then goes to them — including bank resets. Call your carrier and add a port-out PIN or account lock. Then move your two-factor authentication off SMS and onto an authenticator app or a passkey wherever the option exists.

Treat your Social Security number as the exception, not the default

Most businesses that ask for a full SSN do not legally need it. Doctors' offices, gyms, schools, and rental agents frequently request it out of habit. You can ask three questions: Why do you need it? What happens if I decline? How will you store it? Often the answer is that the last four digits, or another identifier entirely, will do.

Secure your mail — still the number one physical vector

Use a locking mailbox or a post office box. Never leave outgoing mail with checks in an unsecured box overnight. Claim your USPS Informed Delivery account before someone else claims it in your name, and put a hold on delivery when you travel. Check washing — stealing a mailed check and chemically altering the payee — has returned in force across Florida.

Opt out of pre-screened credit offers

Every pre-approved offer in your mailbox is a ready-made application waiting for a thief. You can opt out for five years, or permanently, through the industry's official opt-out service at 1-888-5-OPT-OUT. Separately, opt out of data broker listings that publish your address and relatives — those profiles are the raw material for the “grandparent scam.”

Shred anything with a number on it

Cross-cut shredder, not a strip shredder. Bank statements, insurance paperwork, prescription labels, boarding passes, and shipping labels all qualify. Many Florida sheriff's offices, county clerks, and AARP chapters hold free community shred events — a good option for a decade of boxed paperwork.

Use a password manager and stop reusing passwords

The most common way an account is compromised is not a targeted attack; it is a password stolen from one breached website and tried on fifty others. A password manager makes every password unique and long without requiring you to remember any of them. Add passkeys where offered — they cannot be phished because there is nothing to type.

Read your breach notices instead of deleting them

The Florida Information Protection Act (§ 501.171) requires covered businesses and government entities to notify affected individuals of a data breach within 30 days, with limited extensions. That letter tells you exactly which data element was exposed — SSN, driver license number, financial account, or health information — and each one calls for a different response. A driver license breach means watching for a synthetic identity; an SSN breach means freezing everything.

Protect the people who cannot protect themselves

Two groups are consistently overlooked. Older relatives, especially those living alone, who are targeted by phone and by mail — set up a family rule that no financial decision gets made on an inbound call. And recently deceased relatives, whose identities are harvested from obituaries. Notify the Social Security Administration, the three credit bureaus, and the Florida Department of Highway Safety and Motor Vehicles promptly, and keep the obituary free of a full date of birth, mother's maiden name, and street address.