Five Free Locks Most Families Have Never Turned On

I started in security on August 24, 1995, the day Windows 95 came out. For most of the thirty years since, my job has been keeping large organizations off the breach reports: Fortune 500 companies, governments, critical infrastructure. They have security teams, budgets and people like me on call.

Your family doesn't. Neither does the small business down the street. Those are exactly the people criminals now go after, because AI has made it cheap to scam millions of people at once. They don't need to fool everyone. They only need a tiny percentage of us to click, answer, send, pay, approve or believe.

I learned the hard way how little being careful protects you. I went to make a large purchase and got denied. The lender said I had never paid my PayPal credit card. I didn't have a PayPal credit card. Someone had opened one in my name and run up a $5,000 balance. I had never lost my wallet. I work in cybersecurity. It happened anyway.

That's why I'm starting Not an Easy Target. You can't control who targets you. You can make their job harder.

Each week I'll take one door criminals use to get into ordinary lives and show you how to close it, in plain language. If you're a parent, the adult child of aging parents, or someone running a business from the kitchen table, this is for you. We'll start with the doors that cost nothing to lock.

Five free locks most families have never turned on

Your personal information is almost certainly already out there. You can't pull it back. You can make it much less useful to the people holding it. These five locks do that, and every one is free.

1. Freeze your credit at all three bureaus

A credit freeze stops lenders from pulling your credit report, which makes it much harder for anyone to open new credit in your name, even if they have your Social Security number, your birthdate and your mother's maiden name.

Do it at Equifax, TransUnion and Experian. Freezing at one or two is like locking the front door and leaving the back door open. Plan on about thirty minutes online, roughly ten per bureau. The three questions everyone asks:

2. Then freeze the files nobody tells you about

Innovis is a fourth credit bureau, and it freezes for free the same way the big three do. Beyond credit, other agencies keep reports the big three never see. NCTUE covers phone, utility and pay-TV accounts. ChexSystems is what a bank checks before it lets someone open an account in your name. Each one will freeze your file if you ask. Start with the big three, then work down the list.

3. Freeze your children's credit, and help your parents with theirs

Criminals know something most parents don't: nobody is checking a seven-year-old's credit report. An account opened in a child's name can sit unnoticed for years and surface the day they apply for their first student loan or apartment.

Freeze your kids' files at all three bureaus and at Innovis. You'll need to prove you're the parent or guardian, and some bureaus want paperwork by mail, so set aside about an hour. It costs nothing.

Then call your parents. Same freezes, and if they still have a landline or a utility account in their own name, NCTUE too. If they ever need credit, you can help them lift it.

4. Get an IRS Identity Protection PIN

This is the one almost nobody knows exists. It's a free six-digit number from the IRS. Once you have one, an electronically filed return without the right PIN is rejected, so someone holding your Social Security number and birthdate can't simply file a fake return and collect your refund.

Why bother? The National Taxpayer Advocate's 2024 annual report described roughly twenty-two months to resolve certain IRS identity-theft cases. That's a tax-case delay, not the time it takes to recover a whole identity. It's still a long wait on your own refund.

Anyone with a Social Security number or an ITIN who can verify their identity can get one on the IRS website, victim or not. One catch: it expires. You get a new PIN every January, and filing with last year's number gets your return rejected. Set a calendar reminder the day you sign up.

5. Read the mail from your health insurer

Here's the gap a freeze can't cover. With your Social Security number and insurance details, someone can get medical care billed to you, and their diagnoses can end up in your medical file. Two habits help, and almost nobody does either. Read every explanation of benefits your insurer sends, because a claim for care you never received is the tell. And ask your insurer for a disclosure log, which shows who has been looking at your records.

The step-by-step instructions for every freeze, including the version for kids, are on the free credit freeze checklist. No email, no account.

Where this comes from

All five come from my new book, You're Already a Target: Stop AI Scams, Hackers, and Identity Theft Before They Happen, most of them from Chapter 2.

I wrote it for everyone outside the security industry: parents, grandparents, teenagers and small-business owners. It covers AI voice clones, phishing, passwords, your kids, your parents and running a business alone. Thirteen chapters, 263 doors, and every chapter ends with a checklist of concrete steps, so you finish with things done, not just things to worry about.

It's on Kindle pre-order now, out November 3. Pre-order the Kindle edition here.

Two asks

And hit reply: which of the five had you already done? My guess is the IRS PIN is the one most people have never heard of.