If you’ve placed a security freeze on your credit reports at Equifax, Experian, TransUnion, and Innovis, that will help prevent fraudsters from opening new credit accounts in your name.

Freezing your credit report or setting up a fraud alert at Equifax will also prevent crooks from registering as you at the government website, "my Social Security," and block them from attempting to steal your Social Security benefits.  The Social Security Administration (SSA) says it uses Equifax specifically to verify your identity when setting up this account.  

But taking these steps won't protect you against every identity fraud threat arising from the Equifax data breach.

With the information that hackers got, including access to Social Security numbers, birth dates, and an unspecified number of driver’s license numbers, you need to take other steps to help lock down your finances.

Here are three important ways you can protect yourself.

Tax Refunds

With your Social Security number, crooks can file false income tax returns in your name, take bogus deductions, and steal the resulting refund. More than 14,000 fraudulent 2016 tax returns, and $92 million in unwarranted refunds, were detected and stopped by the Internal Revenue Service as of last March.


Though you are generally not liable for such fraud, if a criminal manages to change your tax records and receive your refund, it can take months to straighten out the mess.

How to protect yourself. The best defense is to obtain an Identity Protection PIN from the IRS, which is a code that must be filed with your legitimate return for it to be accepted. An identity thief can’t file his fraudulent return without your PIN.

But you can get a PIN only if you receive a CP01A form (which is sent to identity theft victims), the IRS invites you to opt-in, or you live in Georgia, Florida, or Washington, D.C., areas with the highest rates of tax-related identity theft. You must temporarily lift your Equifax credit freeze for the IRS to issue the PIN.

The IRS would not say whether those affected by the Equifax breach would qualify for a PIN. Andrew Mattson, a tax partner at the Moss Adams tax firm in Silicon Valley, recommends that taxpayers who don't officially qualify for a PIN should file a Form 14039, Identity Theft Affidavit (PDF). “Your account would be flagged for additional monitoring for suspicious activity,” he says.

Mattson also recommends that you periodically view your IRS account information, which shows when returns were filed and which refund payments were made. Activity there—if it’s not yours—can be a sign of fraud. The balance updates every 24 hours, usually overnight, but there is a one- to three-week lag in the time it takes for payments to show up.

If you suspect fraud, you can contact the IRS online or find an office near you using the Taxpayer Assistance Center Office Locator.

Health Insurance

Data from the Equifax breach can be used to steal your benefits from private health insurance, Medicare, or Medicaid when the identity thief uses your coverage to pay for his own medical treatment and prescriptions.

Many health insurers have internal special investigation units and anti‐fraud personnel to root out medical identity fraud, and if suspicious activity is detected, they’ll send email alerts to the policyholder, says Cathryn Donaldson, a spokeswoman for America’s Health Insurance Plans, the trade association of health insurers.

How to protect yourself. Get copies of your medical records from providers to establish the baseline of your health before your records are compromised. Increasingly, online patient portals make this easy to do. Check back regularly to see whether providers you didn’t use are listed and whether you’ve been charged for treatments you never received.

In addition, review your free annual MIB Consumer File, which contains medical and personal information about you reported by health, life, disability, and other member insurers. Do the same for your Milliman Intelliscript report, which may have information on your prescription drug history.

The Federal Trade Commission also says consumers should ask each of their health plans and medical providers for the “accounting of disclosures” related to their medical records. That tells who got copies of your records from the provider. The law allows you to order one free copy from each medical provider every year.

If available, sign up for your insurer’s secure online portal, and regularly review the explanation of benefits, which shows which treatments you received when and from which providers. Some insurers offer the option to sign up for fraud alerts.

Regularly review your credit report for medical collection accounts that don’t belong to you.

Your Driver's License

Using your driver’s license number, identity thieves can create bogus driver’s licenses and hang their moving violations on you. With more work and information from phishing or further hacking, identity thieves can create bogus checks to pay a cashier, who “verifies” the shopper’s identity by writing your license number on the bad check.

If this happens to you, you may not discover how your license has been used until a police officer tells you, or perhaps, until a bank closes your account because of too many bounced checks.

How to protect yourself. Ask the motor vehicles department to give you a copy of your driving record; most states charge for this, usually about $10. To find out whether any bad checks are attributed to your accounts, request your free annual consumer report from major check verification companies, ChexSystems, Certegy, Early Warning Services, and TeleCheck.

If you find that your driver’s license is being used fraudulently, you can file a police report at your local police department and alert your state’s motor vehicles department.  Some will to flag your license number for the police if they stop someone using that number. You should also request a new driver’s license number.

If you’re arrested or find criminal charges on your record, go to the Identity Theft Resource Center for advice on clearing criminal identity theft; if you find fraudulent checks on your record, follow the ITRC for advice on resolving checking account fraud. You can also call the center at 888-400-5530 for free assistance.

Correction and Clarifications: The current version of this story has been edited and revised to correct factual errors and to make clarifications.

The previous version of this article said people needed to register at the government website “my Social Security” to protect their Social Security benefits from identity thieves. In fact, setting up a credit freeze or fraud alert at Equifax will block identity thieves from setting up a Social Security account online in your name. The previous version also incorrectly reported that Milliman IntelliScript tracks your prescription drug histories. While the organization does track histories, it may or may not have information on your history, and it does not necessarily track everyone who fills a prescription. The previous version of this story also didn't state that individuals requesting PINs from the Internal Revenue Service that can be used to verify the validity of tax returns must first unfreeze their credit at Equifax to get the numbers. The previous version also reported that there are three major check verification firms. There are four major companies, ChexSystems, Certegy, Early Warning Services and TeleCheck.