The best ways to protect your child from identity theft include freezing their credit, limiting exposure of personal information, monitoring for suspicious activity, securing family devices, and teaching safe online habits. Because children often don’t discover identity theft for years, taking preventive action early can help protect their credit, finances, and future opportunities.

Child identity theft is one of the fastest-growing forms of fraud, and many families don’t discover it until years after the damage is done. But child identity theft has surged in recent years, with 38% of U.S. survey participants reporting that a child or family member’s child had been victimized in 2025, jumping from 23% the year prior.

This guide explains how child identity theft happens, what warning signs to watch for, and the eight most effective ways to protect your child’s future.

Key Takeaways

• Children are prime targets because their Social Security numbers or national ID equivalents are a blank slate, allowing fraud to go undetected for years.
• Data breaches, phishing scams, social media oversharing, and AI-powered fraud are making child identity theft more common and harder to detect.
• In 2025, the FTC received 22,782 identity theft reports involving people 19 and under in the United States.
• AI-driven scams are making it faster and cheaper to target families and steal children’s data at scale.
• Freezing your child’s credit, monitoring for suspicious activity, and teaching safe online habits are among the most effective protective measures parents can take.

What is Child Identity Theft?

Child identity theft is a crime in which someone steals a minor’s personal information, most commonly the minor’s name, date of birth, and Social Security number (SSN) or equivalent national identifier, to commit fraud. The thief might open credit card accounts, take out loans, rent housing, file fraudulent tax returns, or claim government benefits, all in the child’s name. A 2021 Javelin Strategy study found that this crime affects one in every 50 children and costs U.S. families nearly $1 billion annually.

Why Child Identity Theft Is So Dangerous

The crime is made uniquely dangerous by the silence. Because children typically do not start applying for credit until they are 16 to 18, a thief can have more than a decade of undetected activity. As a result, by the time the victim becomes an adult, they may face:

• Damaged credit scores
• Debt collection notices
• Loan denials
• Difficulties renting housing

The crime is not confined to the United States, either. One documentary tells the story of Renata Furst Galvão, a native of Brazil, whose identity was stolen at age six and used to amass more than $400,000 in debt.

How Criminals Get Access to Children’s Information

To protect your child effectively, it helps to understand exactly who is targeting them, how they are getting in, and why the threat is accelerating. Even the most security-conscious household can be exposed through no fault of its own. In reality, information is often exposed through organizations that collect and store children’s data.

Common sources include:

1. Data breaches at retailers, healthcare providers, schools, and financial institutions could expose children’s information alongside adults’.
2. Social-engineering scams and phishing attacks may target parents directly to extract children’s details.
3. Social media profiles are prime targets for identity thieves to monitor, which is why a child posting their birthday, school name, and city in separate posts creates genuine risks. Minimize the personal details shared online and in photos.
4. Online games and apps that over-collect data, including a child’s full name, birthdate, and town, create additional opportunities for personal data exposure.

New Risks: AI Scams and Synthetic Identities

A December 2025 survey found that reports of ID theft rose from 43% in 2024 to 78% in 2025, a single-year spike that reflects how AI-powered tools have made it faster and cheaper for criminals to generate convincing phishing messages and fake identities at scale.

Synthetic identity fraud is particularly dangerous for children. It pairs a real Social Security number belonging to a minor unlikely to use it anytime soon with a fictitious name and address. The resulting fake identity can then build a credit history, take out loans, and disappear before anyone connects the dots.

Warning Signs Your Child’s Identity May Be Stolen

Catching this crime early makes the recovery process far less painful. Knowing what to look for means you will not dismiss the very clues that trigger a fast response.

Unexpected Mail, Bills and Collection Calls

The most common early indicators arrive in your mailbox or by phone, including:

• Pre-approved credit card offers in your child’s name
• Collection agencies calling to speak with your child
• Court notices or bills for accounts your child never opened

Any business mail addressed to a young child should trigger an immediate investigation.

Rejected Applications, Benefit Denials, Suspicious Debt

Many families first discover the theft during pivotal life moments. Examples include:

• A teen may be denied a learner’s permit due to fraudulent driving violations.
• A young adult may be denied an apartment because of unpaid debt on their credit report.
• Stolen Social Security numbers can interfere with access to government benefits.

Unexplained Credit Activity

Children typically should not have a credit history, so potential warning signs of identity theft include:

• A credit report exists under your child’s name
• Credit accounts appear that your family never opened
• Loan applications are associated with your child’s Social Security number
• Debt appears on your child’s credit file

If your child has a credit record before they are old enough to use credit, it may indicate identity theft.

The 8-Step Protection Plan for Parents

You can follow these steps while seeking guidance from financial educators, credit authorities, and consumer protection experts. Start small by choosing two or three today, then build from there.

Step 1: Check and Freeze Your Child’s Credit

A credit freeze is one of the most effective ways to protect your child from identity theft. If your child is under 16, request a free credit freeze from Equifax, Experian, and TransUnion. This prevents anyone from opening new financial accounts in your child’s name without your authorization. Once in place, the freeze remains active until you ask the credit bureau to temporarily lift or remove it.

Because minors typically don’t have established credit files, the process for placing a freeze differs from that for adults. Each of the three major credit bureaus provides specific instructions for parents and guardians. Follow the guidance from Experian, Equifax, and TransUnion to place a freeze on your child’s credit file.

Step 2: Enable Fraud Alerts and Social Security Reports

In addition to a credit freeze, it’s smart to watch for signs that someone is using your child’s identity. Ensure that you:

• File a fraud alert with each credit bureau to prompt verification checks if someone attempts to open an account in your child’s name.
• Request an earnings report from the Social Security Administration to confirm whether wages are being reported under your child’s SSN.
• Once your child is old enough to have a legitimate credit file, teach them to stagger their use of free credit reports from the AnnualCreditReport website, checking one bureau every four months.

Step 3: Educate Your Kids about Identity Theft & Private Information

In an honest, age-appropriate conversation, explain to them that personal information is the master key to their financial future and should not be shared with online strangers. Role-playing helps: ask your child what they would do if someone they met in a game asked for their full name and home address. Empowered kids are less likely to overshare and more likely to alert you when something feels off.

Step 4: Get Fierce about Protecting Your Child’s Data

Draw a very thick line around your child’s details. Reiterate that sharing them should be limited only when truly necessary, such as school enrollment or medical forms, and only with verified institutions. Ask why it is needed, how it will be stored, and if an alternative identifier is acceptable. Keep important documents in a locked safe and shred papers with your child’s information before disposal.

Step 5: Lock Down Devices, Accounts, and Online Habits

Talk with your kids about safe internet habits. Instruct them to stay skeptical of quizzes, free offers or apps, and unbelievable promos that request personal details. Set their social media accounts to private and limit follower or friend lists to people they know in real life. Use strong, unique passwords for family accounts and enable multifactor authentication on email, school portals, and social media apps used by older children.

Step 6: Monitor for Early Warning Signs

Regularly check your household mail for notices addressed to your child. If you spot anything suspicious, contact the company directly using the contact details on its official website. Do not call the number printed on the suspicious document, as it could redirect you to the thief who sent it. Consider using an identity monitoring service that scans for your child’s data in data breaches or on the dark web and alerts you when their information surfaces.

Step 7: Get Full-Device and Network Security

Many identity theft incidents start with a compromised family device. To reduce this risk, keep operating systems, browsers, and apps fully updated. Secure your home Wi-Fi with a strong password and WPA3 encryption to prevent data interception. Comprehensive security software, such as McAfee+ Family Plans, can help you block malware, keyloggers, and phishing sites that harvest personal data from every device in your home, including the tablets and phones your children use most.

Step 8: Act Quickly If Theft Happens

If you discover or suspect your child’s identity has been stolen, immediately contact the company where the fraudulent account was opened, close the account, and request written confirmation that your child bears no liability. Report the theft to IdentityTheft.gov, follow the personalized recovery plan, and file a police report to create an official record that will help resolve disputes with creditors.

Next, contact each credit bureau to cancel fraudulent accounts, inquiries, and collection notices linked to your child’s SSN. Keep detailed records of every call, letter, and case number throughout the process. Reporting the incident to the authorities helps your family recover and supports broader enforcement efforts that protect other families.

Final Thoughts

Child identity theft is a fast-growing, serious threat worldwide, but it is also one of the more preventable forms of fraud when families take proactive steps early. Start this week by spending 10 minutes to safely lock away your child’s physical documents, then call the major credit bureaus to request a freeze on your child’s credit. Build toward the full eight-step plan over the next month to close every door that leads to potential harm.

Beyond the 8-step sprint, add a recurring data safety day to your family calendar each year to recheck credit freezes and fraud alerts, review your children’s online accounts and platform settings, update devices and passwords, and discuss emerging threats. A family that combines strong protective habits with smart security tools is a much harder target for any kind of cybercrime.

The post 8 Steps to Protect Your Child From Identity Theft appeared first on McAfee Blog.

You post an opinion about a contentious issue on social media. Within hours, strangers have shared your home address, your employer’s phone number, and photos of your children’s school. Your inbox floods with threats. Someone calls your workplace demanding that you be fired. A crowd shows up outside your house. What started as online speech has become a safety crisis that follows you everywhere. You’ve been doxed.

If you’re looking for real answers about how to prevent doxxing before it happens or how to respond if you’re already facing harassment, this guide provides actionable strategies to lock down your digital footprint and protect your personal information. 

Key Takeaways

• Protect yourself from doxxing by reducing exposed data on social media, data broker sites, and public records
• Secure your accounts with strong passwords, multi-factor authentication, and privacy-focused security tools like a VPN or antivirus protection
• Platform-specific strategies help prevent doxxing on Discord, Twitter, and other high-risk spaces
• If you’ve been doxxed, act immediately to document everything, remove content, and involve authorities when threats escalate

What Is Doxing?

Doxxing (sometimes spelled doxing) is the act of publicly exposing someone’s personal information online without their consent. Doxxing is often intended to harass, intimidate, or cause real‑world harm. This information can include a home address, phone number, workplace, family details, or other identifying data.

For a foundational understanding of what doxxing is, why it’s escalating, real‑world examples, and how the law treats doxxing, see our full guide on what is doxxing.

How Do People Get Doxxed? 

Your digital footprint is a jigsaw puzzle spread across the internet, with each piece alone being harmless: a tagged photo here, a WHOIS domain record there, a mention of your hometown in an old forum post. Doxers piece together these fragments using open-source intelligence techniques like reverse image searches, username lookups, and metadata analysis.

Much of the information used in doxing also comes from data brokers, which aggregate public records and purchased data sets. Plus, there are information leaks from data breaches: billions of stolen email addresses, passwords, and personal details circulating on dark web forums.

That data can be cross-referenced with your online purchases, domain registrations, avatars, usernames, and even your writing style. Then there’s what you share and what others share about you on social media. In effect, you are leaving a trail of breadcrumbs every time you interact online. 

Taken together, all these pieces create a detailed profile that doxers weaponize. Once they have your information, they post it on social media, anonymous forums, or dedicated harassment sites along with inflammatory language urging others to contact you.

Campaigns are coordinated across platforms, escalating from online harassment to email and text message threats, and sometimes physical confrontations or swatting attempts that put you in immediate danger.

How to Protect Yourself From Doxing

You shouldn’t have to make yourself invisible online, but you can significantly reduce the information available to potential doxers and make yourself a harder target. Here’s what to do:

Lock Down Your Social Media Accounts

Starting with your social media accounts, go through your privacy settings on every platform you use and maximize protection:

Immediate actions:

• Set all accounts to private or restrict visibility to friends/followers only
• Hide your friend lists, location data, and tagged photos from public view
• Remove personal details like phone numbers, email addresses, birth dates, and hometown from your profile
• Disable location services and strip metadata from photos before posting
• Turn off check-ins and location tagging features

Audit Your Digital History:

• Search your own name and review what appears publicly
• Delete or edit old posts that mention your home address, children’s schools, or exact workplace
• Ask family and friends not to tag you in posts that reveal your location or personal details
• Review and untag yourself from photos that expose identifying information

Platform-Specific Settings:

• Facebook: Restrict who can see your friends list, past posts, and profile information; disable facial recognition; review tags before they appear on your profile
• Instagram: Make your account private, disable activity status, restrict comments, and carefully review follower requests before accepting
• Twitter/X: Protect your tweets, disable photo tagging, hide sensitive content behind warnings, and enable two-factor authentication on a separate device
• Discord: Use a unique username not tied to other accounts, disable DMs from non-friends, never share your Discord tag publicly, and avoid voice chat in public servers where your voice can be recorded

Remove Your Data from People-Finder Data Broker Sites

Data brokers are companies that mine the internet and public records for financial and credit reports, social media accounts, and more. They then sell that data to advertisers, companies, or individuals who may use it to doxx you.

You might be surprised by how much sensitive information is available to anyone who wants it. Data brokers often have contact information including real names, current and former addresses, birth dates, phone numbers, social media profiles, political affiliations, and other information most consider private.

There are two ways you can remove your personal information from data brokers or people-finder sites: manually or with an automated solution

The Manual Approach:

While you can remove your private information from many data broker sites, they tend to make the process tedious and frustrating. You’ll need to:

• Identify which sites have your information (search for yourself on sites like Whitepages, Spokeo, BeenVerified, PeopleFinder)
• Submit individual opt-out requests to each site
• Follow unique removal processes for each broker (some require email verification, others need physical mail)
• Re-check periodically as your information may reappear

The Automated Solution:

McAfee Personal Data Cleanup makes this process dramatically easier. Enter your name, date of birth, and home address, and we’ll scan it across high-risk data broker sites and help you remove it automatically.

If you plan to employ other automated data broker removal services, verify that they are reputable before handling over your information. 

Secure WHOIS Records and Domain Privacy

If you own a website, your WHOIS record publicly lists your name, address, phone number, and email unless you take action. Use WHOIS privacy protection (also called domain privacy) through your registrar to replace your personal details with the registrar’s contact information, keeping your personal data out of public domain records. Most registrars offer this service for free or a nominal fee.

Fortify Your Account Security

Anyone who gains access to your email or social media accounts through phishing or a data breach could expose your private conversations, documents, and personal details. Protect yourself with robust security measures: 

Use Strong, Unique Passwords:

• Use passwords with at least 12-16 characters. Avoid personal information like pet names, birthdates, or family members
• Never reuse passwords across accounts
• Use a password manager to generate and store complex passwords securely
• Change passwords immediately if a service you use reports a data breach

Use Multi-Factor Authentication (MFA):

• Enable MFA on all critical accounts (email, social media, banking, work accounts)
• Use app-based authenticators (Google Authenticator, Authy) rather than SMS when possible
• Store backup codes in a secure location separate from your primary device

Be Vigilant against Phishing:

• Be suspicious of unexpected emails, texts, or messages requesting login credentials
• Always verify the sender before clicking links or providing information
• Check URLs carefully. Phishing sites often use slight misspellings
• Never enter credentials on a site you reached via a link in an email

Secure Your Document Storage

Keep sensitive documents, such as tax records, passport scans, and financial statements, out of easily searchable email folders or cloud storage that might be compromised. If you store them digitally, use encrypted storage with strong access controls.

Use Privacy and Security Tools

No single tool can prevent all doxing, but layered protection makes a big difference. 

Identity Monitoring Services:

Consider using identity monitoring services that alert you when your personal information appears in new data breaches, on the dark web, or elsewhere it shouldn’t be. Early detection will allow you to act before the information is weaponized.

Comprehensive security suite:

A comprehensive security suite such as McAfee+ helps protect your devices from phishing attacks, malicious websites, and malware that could compromise your accounts. 

Virtual Private Network (VPN):

When browsing on public Wi-Fi networks, your data is at greater risk of being intercepted. A virtual private network gives you an additional layer of protection by hiding your IP address and browsing activities when you’re on an unsecured network.

Encrypted Messaging:

For sensitive conversations, use end-to-end encrypted messaging apps like Signal or WhatsApp rather than standard SMS or unencrypted email.

Educate Your Family, Friends, and Colleagues

You might take every precaution, but if your partner posts a photo of your new house with the address or your colleague tags you in a work event with the location, your efforts are undermined. 

Have honest conversations:

• Explain why you’re cautious about personal information online
• Share specific examples of what information should stay private
• Encourage those close to you to adopt similar privacy practices

Set Family Guidelines:

For the digitally active, younger adults and teens in your family who may not fully understand the risks of oversharing, set family guidelines about what can be posted publicly and what should remain offline. 

Workplace Training:

If you work in education, government, or a high-visibility field, suggest brief safety training sessions for staff to recognize and respond to doxing threats.

What to Do if You’ve Already Been Doxxed

If your information is already out there and you’re facing harassment, here’s how to respond quickly and effectively.

1. Assess the immediate situation

If you’re receiving threats, someone is showing up at your home with the intent to harm, or you believe you’re at risk of swatting, contact local law enforcement immediately. Your physical safety comes first. 

2. Document Everything Thoroughly

Create comprehensive evidence:

• Take screenshots of every post, message, and webpage that shares your information or threatens you. 
• Take note of URLs, usernames, timestamps, and platform names 
• Save original messages and emails. Don’t just screenshot; save the actual files.
• Record any phone calls if legally permitted in your jurisdiction
• Keep a detailed timeline of events

These pieces of evidence are essential for pursuing legal action, getting content removed from platforms, and demonstrating the severity of the harassment to law enforcement. 

3. Get Your Content Removed

Platform Reporting:

Use the reporting tools on every platform where your private information has been illegally shared. Platforms can be slow to act, but be persistent and keep submitting reports and escalating through support channels. Clearly cite violations of the platform’s terms of service (most prohibit doxxing), and invoke your legal right to have your personal details removed. 

Remove Data from Website Operators:

If your personal information appears on websites or forums, contact the site administrators directly and request removal. Many will comply, especially if the information was posted without your consent.

Remove Data from Search Results:

Google offers a removal request process for certain types of content:

• Doxing content (name, address, phone number)
• Non-consensual intimate images
• Financial information like bank account numbers
• Government identification numbers

Submit removal requests through Google’s removal request page.

4. File a Police Report

Consider involving authorities in cases involving:

• Explicit threats of violence
• Stalking (repeated, unwanted contact that causes fear)
• Swatting attempts
• Targeted campaigns that severely disrupt your life
• Hacking or unauthorized access to your accounts

Prepare for law enforcement:

• Bring all your documentation (screenshots, timelines, messages)
• Be prepared to explain what doxxing is and how it’s affecting you
• If local police aren’t responsive, reach out to specialized cybercrime units at the state or federal level
• Consider consulting a lawyer familiar with online harassment cases who can advocate on your behalf

5. Seek Support and Expert Guidance

Don’t face this alone. Seek support from your family, trusted friends, and professionals. Crisis communications organizations or reputation management professionals should be able to offer guidance or connect you with legal resources.

Platform-Specific Protection: Discord, X (Twitter), and Beyond

Different platforms present unique doxxing risks. Here’s how to protect yourself on high-risk spaces:

How to Avoid Getting Doxxed on Discord

Discord’s voice chat and community-focused structure create specific vulnerabilities:

Account Security:

• Use a unique username not connected to other social media accounts or your real name
• Enable two-factor authentication
• Never share your email address, phone number, or Discord tag publicly
• Use Discord’s privacy settings to limit who can DM you (friends only)

Voice Chat Precautions:

• Be aware that voice chat can be recorded without your knowledge in public servers
• Avoid discussing personal details, location information, or identifiable stories
• Consider using voice modulation software for high-risk conversations

Server Safety:

• Only join servers from trusted communities
• Be cautious about clicking links in Discord (they can lead to IP-grabbing sites)
• Report suspicious users immediately to server moderators

How to Prevent Doxxing on Twitter

Twitter’s public nature and engagement-driven algorithm make it a prime target for harassment campaigns:

Profile Protection:

• Protect your tweets (make account private) if you’re at high risk
• Remove location information from your profile and tweets
• Don’t use your full legal name as your display name
• Disable photo tagging to prevent being tagged in revealing photos

Engagement Strategies:

• Be cautious about what you share publicly, especially during controversial discussions
• Don’t share photos that reveal your location, workplace, or home
• Block aggressive users immediately—don’t engage
• Report coordinated harassment to Twitter’s support team

Advanced Privacy:

• Use a separate email address for your Twitter account that doesn’t contain your real name
• Turn on login verification (two-factor authentication)
• Regularly review connected apps and revoke access to any you don’t recognize or use

How to Avoid Getting Doxxed as a Creator or Public Profile (TikTok, YouTube, Twitch)

Creators and public‑facing accounts face unique risks because content, schedules, and personal details are often shared at scale:

Account & Identity Separation:

• Use creator accounts that are completely separate from personal email addresses and phone numbers
• Never link personal social media accounts in public bios or “about” sections
• Use business contact emails that don’t contain your real name
• Enable two‑factor authentication on all creator platforms and connected email accounts

Content & Filming Precautions:

• Be mindful of what appears in the background of photos and videos (windows, street signs, landmarks)
• Avoid showing mail, packages, or documents with identifying information
• Delay posting content shot in real‑time to prevent location tracking
• Disable automatic location tagging and metadata whenever possible

Livestream & Interaction Safety:

• Avoid sharing schedules, routines, or future travel plans publicly
• Use chat moderation tools and trusted moderators during live streams
• Immediately ban users who ask probing personal questions
• Be cautious with donation messages or alerts that may reveal personal information

Take Control of Your Digital Footprint Today

Doxxing has become an escalating threat in our increasingly connected digital world. But you’re not powerless. By taking proactive steps to reduce your exposed data, secure your accounts, and understand how to respond if targeted, you significantly reduce your risk and increase your ability to protect yourself and your loved ones.

Start with the basics: tighten your social media settings, remove your information from data broker sites, and secure your accounts with strong passwords and multi-factor authentication. Consider installing identity monitoring services, security software, and privacy features to detect threats early and give you time to respond. McAfee+ can help you stay one step ahead of anyone trying to weaponize your information.

If you’ve been doxxed, document everything, report to platforms persistently, and involve law enforcement when threats escalate. You don’t have to face this alone; support resources and professionals are available to help you through the process.

The post How to Protect Yourself from Doxxing and Lock Down Your Data appeared first on McAfee Blog.