Financial Privacy: How to Protect Your Money and Identity

Your financial life generates a constant stream of data: account numbers, card details, purchase histories and identity documents. Each place that data is stored or shared is another way it can be misused, by fraudsters or by companies trading it for profit. This guide covers the habits and tools that reduce your exposure, how protections differ between countries, and what to do if something goes wrong.

Preventing identity theft

A leaked combination of your name, date of birth, address and government ID number can let someone open accounts in your name or take over existing ones. Sharing those details less often lowers your risk.

• Guard your national identifier. Treat your Social Security number (US), Social Insurance Number (Canada), National Insurance number (UK), Aadhaar or PAN (India) or Tax File Number (Australia) as sensitive. Ask why it is needed before providing it.
• Secure your mail and documents. Shred old statements and switch to electronic statements where practical.
• Use unique passwords. A password manager makes a different, long password for every financial account practical.
• Use strong sign-in protection. Prefer an authenticator app, passkey or hardware security key over text-message codes when your bank supports them.
• Set up alerts. Most banks can notify you of every transaction, new payee or login from a new device.

Credit freezes and locks

A credit freeze restricts access to your credit file so new lenders generally cannot check it, which makes it much harder for someone to open credit in your name. You can usually lift it temporarily when you apply for credit yourself.

A freeze does not stop fraud on existing accounts and does not affect your credit score. In the US, a two-adult household needs six freezes: one per person at each of the three bureaus.

Data brokers and your digital footprint

Data brokers collect personal information from public records, purchases, apps and online activity, then sell or license profiles that can include addresses, phone numbers, relatives and estimated income. Your options depend on where you live:

• UK and EU: data protection law gives rights to access, correct and request deletion of personal data.
• Canada, India and Australia: national privacy laws provide access and correction rights, with further rights in some provinces and under India's newer data protection law.
• United States: there is no comprehensive federal privacy law, but several states have their own, and many brokers offer voluntary opt-out forms.

Opting out may need repeating, because brokers can repopulate records from new sources.

Minimising data shared with apps

Budgeting, investing and payment apps can be useful, but each one connected to your bank adds a point of exposure.

• Audit connected apps. Most banks list the third parties with access to your accounts. Remove anything you no longer use.
• Prefer read-only access. Choose connections that let an app view transactions without moving money.
• Read the data policy. Check whether the app shares data with partners and whether you can delete your data.
• Limit phone permissions. A finance app rarely needs your contacts, microphone or constant location.

Secure banking habits

• Sign in by typing your bank's address or using its official app, never through links in messages.
• Keep your phone and computer updated, since many updates fix security flaws.
• Review statements monthly, including small charges, which fraudsters sometimes use to test a stolen card.
• Use credit cards rather than debit cards online where possible, so a dispute does not tie up money in your bank account.
• Keep a private list of your accounts and institutions. The net worth calculator is a convenient way to keep that inventory current and notice anything you did not open.

Defending against phishing and SIM swaps

Phishing

Phishing messages imitate banks, tax authorities, delivery companies or employers to trick you into sharing credentials or sending money. Warning signs include urgency, threats and requests for codes or passwords. Legitimate banks generally do not ask you to share one-time passcodes or move money to a "safe account". When in doubt, hang up and call a number you already trust.

SIM-swap attacks

In a SIM swap, a criminal convinces your carrier to move your number to their device, then intercepts text-message codes. Add a PIN and a number-transfer lock to your mobile account, move important logins to authenticator apps or passkeys, and treat a sudden loss of signal as a warning sign.

Worked example: why reporting speed matters

Consider a stolen debit card used for $1,200 in fraudulent withdrawals in the US:

Reporting on day one caps the loss at $50. Waiting months could expose the full $1,200 or more. Many banks also offer voluntary zero-liability policies, and US credit cards carry a federal liability cap of $50.

Rules elsewhere differ: UK regulations typically cap liability at a small amount unless there was gross negligence, Indian rules generally give zero liability for third-party fraud reported within a few working days, and Canada and Australia rely largely on industry codes. Everywhere, prompt reporting helps.

What to do if you are compromised

1. Contact your bank or card issuer immediately. Freeze or cancel affected cards and dispute unauthorised transactions.
2. Secure your email first. Change its password and sign-in method, since it is used to reset everything else.
3. Freeze or flag your credit files using the options available in your country.
4. Report the fraud to your national fraud or identity theft authority and, where appropriate, the police. Keep reference numbers.
5. Review your credit reports for accounts, inquiries or addresses you do not recognise, and dispute them.
6. Check your mobile and tax accounts to confirm no one has changed your number or filed in your name.
7. Keep records of dates, names and case numbers for every call and letter.

Common mistakes to avoid

• Reusing passwords across financial and email accounts.
• Sharing one-time passcodes with anyone who contacts you, even claiming to be your bank.
• Relying only on text-message codes for high-value accounts.
• Leaving unused finance apps connected to your bank.
• Waiting to see whether a suspicious charge disappears before reporting it.

Watch: a visual explainer

▶

Video by Khan Academy, embedded via YouTube. Private.Finance is not affiliated with the creator.

Frequently asked questions