What to Do if Your Information Is Found on the Dark Web - Experian (2024)

1. Change Your Passwords

One of the first things you can do is make sure someone can't use your stolen login information to access your accounts. A simple way to do this is to change any passwords associated with accounts that are reportedly on the dark web.

If you use the same password—or similar password variations—for multiple accounts, you may want to change the other accounts' passwords as well. Use a strong password that can't be easily guessed or hacked, or consider using a password manager to create complex passwords for you.

2. Add Multifactor Authentication to Your Accounts

Multifactor authentication (MFA) is when an account requires you to verify your identity using two or more authentication methods. For example, you might have to enter a code sent to your phone when you try to log in to your bank account. By confirming the code, you're verifying that you know the username and password and have control of the phone associated with the account.

Adding MFA can help keep others out of your account even if your username and password are leaked on the dark web. Some accounts automatically require MFA, but others offer it as an optional feature. Sometimes, it won't be an option even if you want to enable MFA.

When you can turn it on, you may be able to choose from different types of authentication, such as receiving a text message or email, using your fingerprint, or using a code or push notification from an authentication app. In general, text message and email MFA are the least secure options, but they're still better than nothing.

3. Try to Add SIM-Swapping Protection to Your Phone

SIM swapping is when someone temporarily takes over your phone line using the same SIM swapping procedure that you'd use to activate a new phone. Criminals do this by tricking or paying off mobile phone carriers' employees. They then can have your text message MFA codes sent to a phone they control so they can access your accounts.

Some mobile phone carriers have a security feature that keeps your number from being ported to a new phone until you contact the company to disable the security. However, you may need to contact your carrier to activate the feature.

4. Report the Theft of Your Personal and Account Information

You may find that your personal information is being sold or shared online, including your:

• Name and address
• Social Security number
• Driver's license and passport
• Medical records and account numbers
• Financial account numbers and details
• Emails, usernames and passwords

Criminals can use this information in a variety of ways, such as to impersonate you or create a fake identity using your Social Security number. They may even make a driver's license or medical insurance card using your information and then use the documents if they're arrested or want to get a medical procedure.

You can report the theft of this information to the Federal Trade Commission on IdentityTheft.gov. You'll then receive a personalized plan with the next steps you can take based on what was stolen.

5. Freeze Your Credit

Freezing your credit reports with all three major credit bureaus―Experian, TransUnion and Equifax―can help keep someone else from opening an account in your name. Once your reports are frozen, creditors can't access your credit report to make new lending decisions. However, your report can still be accessed for other reasons, such as if your current creditor wants to review your report or if you want to check your credit.

You have the right to freeze and unfreeze your credit for free and as often as you'd like, but you'll need to contact each credit bureau directly. Also, don't forget to unfreeze or temporarily "thaw" your reports when you apply for a new credit card or loan. If that seems like too much work, you can add a fraud alert to your credit report that asks lenders to verify your identity before approving credit in your name.

6. Stay Proactive

Having safety measures in place can help protect you from identity theft regardless of whether your information is on the dark web. Here's how:

• Use a password manager. A password manager can help you create, securely store and fill in unique and strong passwords for all your accounts.
• Learn how to detect social engineering. Many hacks and scams are successful because someone gets tricked into sharing their login or personal information with a fraudster. Detecting and avoiding phishing, smishing and vishing scams can be important for keeping your information and finances safe. One rule of thumb: Never click on a link or provide information in an email or text unless you have verified the sender's authenticity.
• Get identity theft monitoring. Monitoring services, such as Experian IdentityWorksSM, can alert you if your personal information is detected in a variety of databases and if there are suspicious changes in your credit report. It also includes identity theft insurance, which can help you cover costs associated with recovering your identity.