Practical U.S. household privacy

Free Privacy Checklist for U.S. Households

You do not need to be technical, and you do not need to buy expensive software. Start with free steps that cut the biggest risks from spam calls, telemarketers, scammers, and identity theft. Check each box as you go.

By Doc Compton. Reviewed September 1, 2026. Last updated: October 2, 2026.

At a glance

U.S. educational guide. This guide is for people in the United States. It is general educational information, not legal, financial, tax, medical, or emergency advice.

Independent tools, your risk. We list third-party services we have found useful for U.S. households. BlockTheCalls does not partner with, operate, or control them. Their products, policies, and practices can change without notice. Review each service’s current privacy policy, terms, and data practices before you submit information, and use them at your own risk. Open a privacy/data chip for our dated notes, policy links, a copyable AI review prompt, and a way to report problems to privacy@blockthecalls.com.

A simple way to think about privacy

Prevention

Freeze or lock the accounts criminals can monetize before anything happens.

Exposure discovery

Find breach records, public profiles, reused usernames, and information already visible online.

Removal

Ask the original publisher or broker to remove eligible information, then clean up search results.

Monitoring

Use breach, bank, credit, login, and mail alerts to catch changes early.

Recovery

Move quickly, use contacts you verify yourself, preserve evidence, and report through official channels.

Should I freeze my credit? For most U.S. adults, a free security freeze at Equifax, Experian, and TransUnion is one of the strongest ways to reduce new-account credit fraud. You can lift it when you need to apply for credit. If you place or lift a freeze online or by phone, the bureau must place it within one business day and lift it within one hour (FTC). Federal law makes freezes free, and a freeze does not change your credit score. See the CFPB explanation.

Tool	What it does	What it does not do
Security freeze	Restricts access to a consumer report for many new applications; free.	Does not stop fraud on an existing account.
Credit lock	A bureau product that may offer app-based access controls.	Is not a reason to pay when a free statutory freeze meets the need.
Credit monitoring	Helps detect some report changes.	Usually alerts after activity; it is not a substitute for a freeze.
Fraud alert	Tells creditors to take extra identity-verification steps.	Does not restrict report access like a freeze.

Freeze the specialty files that fit your risk

ChexSystems is commonly used for checking and savings account decisions.
NCTUE covers information used by some telecom, pay-TV, security, internet, and utility providers. The freeze is free; place it through the NCTUE consumer portal or at 1-866-349-5355. Equifax manages NCTUE data on NCTUE’s behalf, but this is a separate file, so place the NCTUE freeze even if your Equifax credit report is already frozen.
Innovis provides a separate consumer freeze.
LexisNexis / SageStream provides another separate consumer freeze process.

Parents and guardians can also request a child credit freeze. The FTC child identity theft guide explains how a protected consumer record can be created and frozen and what documents may be needed.

Protect taxes, existing accounts, and prescreened mail

Get an IRS Identity Protection PIN. A new IP PIN is generated each calendar year. If you enrolled online, retrieve it from your IRS Online Account each year; if you chose one-time enrollment, you are opted out at the end of the calendar year. The IRS will never ask for your IP PIN, and calls, emails, or texts asking for it are scams.
Review reports through AnnualCreditReport.com, the official federally authorized site.
Use OptOutPrescreen, the consumer credit reporting industry’s official opt-out mechanism for prescreened credit and insurance offers.

Optional advanced employment protection

myE-Verify Self Lock remains available and can lock a Social Security number against new E-Verify and Self Check use. This adds friction: unlock it before a legitimate employer runs E-Verify. It is not a credit freeze.

Most scam calls and texts now come from someone pretending to be a bank, government agency, well-known company, or relative. They invent a problem or prize, push you to act fast, and ask for payment that is hard to undo, like gift cards, wire transfers, crypto, or a payment app. These are the FTC’s four signs of a scam.

How big is the problem?

In 2025, people filed 3 million fraud reports with the FTC and reported losing $15.9 billion, up from more than $12 billion in 2024. Investment scams caused the largest losses, $7.9 billion (FTC, March 25, 2026).
Impostor scams were the most-reported type of fraud for the ninth year in a row: more than 1 million reports and $3.5 billion lost in 2025. Reports of government impostor scams rose 40%, partly because of fake toll texts (FTC, May 7, 2026).
The FBI’s Internet Crime Complaint Center (IC3) received more than 1 million complaints, with $20.9 billion in losses, in 2025. That is a 26% increase from 2024. Cryptocurrency investment fraud was the largest source of losses, at $7.2 billion (FBI 2025 IC3 Report).
People 60 and older reported $7.75 billion in losses to IC3 in 2025, up 59% from 2024 (FBI 2025 IC3 Report).
IC3 received more than 22,000 complaints in 2025 that involved artificial intelligence, with losses over $893 million (FBI 2025 IC3 Report).
People reported losing $470 million to scams that started with a text in 2024, more than five times the 2020 amount (FTC Data Spotlight, April 2025).

These are only reported losses. The FTC notes that most frauds are never reported, so the real totals are likely higher.

Common scam calls and texts, and what to do (sources checked Oct 2, 2026)

Government, bank, or company impersonation
How it starts
A call or text says you owe money, your account was hacked, or your benefits or license will be suspended. Some tell you to move money to keep it safe.
What to do
Hang up or don’t reply. Contact the organization using a number or website you find yourself. Government agencies will never call, email, or text to ask for money or personal information, and a request to move your money to protect it is a scam sign (FTC).
Tech support
How it starts
A pop-up warning tells you to call a phone number, or someone calls or texts claiming to be a technician from a well-known company.
What to do
Don’t call the number. Legitimate tech companies won’t contact you to say there is a problem, and real security warnings never ask you to call a phone number.
AI voice “family emergency”
How it starts
A call that sounds like a relative or friend in trouble. It is urgent and may ask you to keep it secret. Scammers can clone a voice from a short audio clip.
What to do
Hang up and call the person back at a number you know. Check with another family member, even if told not to. Ask for your family code word (FTC; FBI).
Toll or package text (smishing)
How it starts
A text about an unpaid toll or a delivery problem, with a link to pay a small fee. The goal is your card number or identity.
What to do
Don’t tap the link. Contact the toll agency or the U.S. Postal Service using a website or number you know is real. Forward the text to 7726, then delete it (FTC).
Job or “task” scam
How it starts
An unexpected text offers easy work, like rating products or apps. Later you are told to send money to finish tasks or withdraw your earnings.
What to do
Stop and don’t pay. Honest employers will never ask you to pay to get a job.
“Wrong number” text that leads to investing or crypto
How it starts
A friendly text meant for someone else turns into a friendship, often romantic. The new friend then offers investing tips and a trading platform.
What to do
Don’t reply to strangers, and don’t send money to someone you’ve never met in person. People report losing everything they “invest” on these fake platforms (FTC).
Prize, sweepstakes, or lottery
How it starts
A call or text says you won, but you must first pay a fee, taxes, or shipping.
What to do
Don’t pay. If you have to pay to get your prize, it’s a scam. It is also illegal for U.S. citizens to play a foreign lottery.
Fake debt or car warranty
How it starts
A caller says you owe a debt and threatens arrest, or a call, text, or letter warns that your car warranty is about to expire.
What to do
For a debt you don’t recognize, ask for validation information, which real debt collectors must give you. For warranty calls, don’t engage and report them.

If you already paid or shared information, see the recovery steps later in this guide and report it at ReportFraud.ftc.gov.

What is a family code word? A family code word is a secret word or phrase your family agrees on to confirm who is really calling. The FBI recommends one because scammers can use AI to copy a relative’s voice. If a caller cannot give the word, hang up and call the person back at a number you already know. See the FBI public service announcement (Dec 3, 2024). Pick a word that has never appeared online, such as in a social media post.

What to do with spam texts

Don’t tap links or reply to texts you weren’t expecting. If a message might be real, contact the company using a number or website you know is real, not the information in the text (FTC).
Forward the text to 7726 (SPAM). This helps your wireless provider spot and block similar messages. You can also use your messaging app’s report junk option and report the text at ReportFraud.ftc.gov (FTC).
Reply STOP only to senders you trust. Under FCC rules adopted in 2024, replying “stop” is a valid way to opt out of texts from a legitimate business, which must honor it within 10 business days. For texts you think are scams, don’t reply at all; forward them to 7726 instead.

How do I report a scam text? Don’t tap any links or reply. Forward the text to 7726 (SPAM), use your messaging app’s report junk option, and report it to the FTC at ReportFraud.ftc.gov. Then delete it.

Should I reply STOP to a spam text? Only to senders you recognize and signed up with, such as your pharmacy or bank. Legitimate senders must honor a STOP reply within 10 business days. Don’t reply to texts you think are scams; forward them to 7726 instead.

Built-in phone protections

Apple and Google include free scam and theft protections. They are worth checking, but no filter is perfect, and the warning in How do I protect my phone number from SIM swaps and spam calls? about missing important callers applies here too. Availability and menu names vary by device, operating system version, carrier, and country. We list these for information only; this is not an endorsement.

iPhone call screening: In Settings, tap Apps, then Phone. Under Screen Unknown Callers, choose Never, Ask Reason for Calling (the caller is asked why they are calling before your phone rings), or Silence (calls go to voicemail). Add your doctor, pharmacy, and school to Contacts so their calls always come through (Apple: Screen Unknown Callers).
iPhone text filtering: In Messages, tap Filters, then Manage Filtering, then Unknown Senders, to keep texts from unknown numbers in a separate list (Apple: filter unknown senders).
iPhone Stolen Device Protection (iOS 17.3 or later): away from familiar places, your iPhone requires Face ID or Touch ID, with no passcode fallback, for things like saved passwords and cards. It also adds a one-hour delay before some changes, such as your Apple Account password. It may already be on. Check under Settings, then Face ID & Passcode (Apple: Stolen Device Protection).
Android Scam Detection for calls: on supported Pixel phones (Pixel 6 and later in the U.S.), the Phone by Google app can warn you about a likely scam during a call. It is off by default, runs on the device, and Google says it is not 100% accurate (Google Phone app Help).
Google Messages spam protection: In Messages settings, open Protection & Safety, then Spam protection. It is only shown if your device supports it (Google Messages Help).
Android theft protection (Android 10 and up; some features need Android 15): go to Settings, then Google, then All services, then Theft protection. Features include Theft Detection Lock, Offline Device Lock, and Identity Check. Support varies by phone, and it is not available on tablets or Android Go devices (Android Help).

BlockTheCalls is a prelaunch U.S. call-screening service. The built-in tools above are free and available now.

Short answer: Add your carrier’s free account PIN and SIM or port-out lock to stop SIM swaps. Keep spam warnings on, and use automatic blocking with care so you do not miss a doctor or other important caller. Scammers often pose as a bank or business: people told the FTC they lost nearly $1 billion to business impostors in 2025 (FTC, June 15, 2026).

Apple, Google, and the carriers have made useful attempts to reduce unwanted calls. They help, but nothing is 100%: no reputation or automatic-blocking system can perfectly distinguish a scammer from an important caller you have not met yet.

Healthcare and other large organizations may use rotating outbound numbers, centralized scheduling systems, PBXs or contact centers, automated reminders, and high calling volume. A call can come from a number that is not in Contacts, while carrier reputation databases may treat legitimate high-volume patterns as suspicious.

STIR/SHAKEN authenticates information about the calling number; it does not prove that the caller is trustworthy. When the framework rolled out, the FCC noted that better caller ID information “does not mean the call itself is legitimate.” An “A” (full) attestation is the signing provider’s own statement. It says the provider knows the customer and has verified the customer’s right to use the number, as the FCC’s Lingo Telecom consent decree explains. It is not an independent guarantee that the number was not spoofed. In 2024 the FCC settled with Lingo Telecom for a $1 million civil penalty after the company applied A-level attestations to spoofed AI robocalls while relying on a customer’s certification rather than verifying the number itself (Consent Decree DA-24-790).

Caller → originating carrier → STIR/SHAKEN → terminating carrier → reputation analytics → carrier filtering product → Apple/Google screening → third-party apps → user

When you cannot miss an unfamiliar call

Keep spam and caller-ID warnings on, but use automatic blocking cautiously.
Consider manual screening and live voicemail where appropriate.
Temporarily reduce aggressive filtering when expecting a doctor, hospital, government agency, school, or recruiter.
After changing a setting, test from an unsaved number and inspect recent calls, voicemail, and carrier filter lists.

Use our detailed Apple, Google, and carrier call-screening guide with the current official instructions for Apple spam and unknown-call controls and Google Call Screen. Carrier resources include AT&T ActiveArmor and robocall controls, T-Mobile ScamShield, and Verizon Call Filter.

Protect the carrier account too

Use a strong account PIN, enable carrier MFA, add the carrier’s available SIM or port lock, account lock, and port-out protection, secure voicemail with a PIN, and remove people who should no longer be authorized users. Under FCC rules adopted in 2023 (FCC 23-95), wireless carriers must offer every customer a free option to lock their account against SIM changes and number ports. Carriers must also notify customers of SIM-change and port-out requests. Check your carrier’s account settings for its lock.

Does the Do Not Call Registry stop scam calls? No. Registration is free and restricts many legitimate telemarketers that follow the law, but it does not block calls and scammers may ignore it. The FTC explains the exemptions and limits.

The FTC guide to blocking unwanted calls explains the difference between call-blocking services, carrier tools, and reporting.

Your state may offer additional protection

Start with the free National Do Not Call Registry Policies checked Sep 1, 2026. Separately, the states below run their own Do Not Call / No-Call list or enforce state-specific telemarketing rules. In Connecticut, the National Registry is the sign-up path, and in Louisiana and Massachusetts, numbers on the National Registry are included in the state program automatically. Where a state keeps a separate list, registering on both is often worthwhile. Eligibility, update schedules, and exemptions differ, and scammers may ignore every list.

State	Program	What to know	Privacy/data
Colorado	Colorado No-Call List	Register residential, wireless, or fax numbers; Colorado PUC oversees the list and the AG enforces.	Policies checked Sep 1, 2026
Connecticut	Connecticut Do Not Call (DCP)	No separate state sign-up list. Connecticut’s Department of Consumer Protection directs residents to register with the National Do Not Call Registry (online, or by calling 1-888-382-1222 from the phone you want to register) and to file Do Not Call complaints there.	Policies checked Oct 2, 2026
Florida	Florida Do Not Call	Florida Department of Agriculture and Consumer Services consumer No-Call program.	Policies checked Sep 1, 2026
Indiana	Indiana Telephone Privacy / Do Not Call list	Indiana AG Consumer Protection Division; free for residents (also 1-888-834-9969). Overview: in.gov/attorneygeneral/2445.htm.	Policies checked Sep 1, 2026
Louisiana	Louisiana Do Not Call	Run by the Louisiana Public Service Commission (LPSC). Free for residential lines; register with the LPSC online form or call 1-800-256-2397. Registering on the National Do Not Call Registry automatically enrolls you in the Louisiana program. The list updates quarterly, so it can take 30 to 120 days to take effect.	Policies checked Oct 2, 2026
Massachusetts	Massachusetts Do Not Call Registry	Run by the Office of Consumer Affairs and Business Regulation. State rules include numbers enrolled on the National Do Not Call Registry in the Massachusetts registry, and Massachusetts enforces its own telemarketing rules.	Policies checked Sep 1, 2026
Missouri	Missouri No-Call	Missouri Attorney General No-Call program.	Policies checked Sep 1, 2026
Oklahoma	Oklahoma Telemarketer Restriction Act Consumer Registry	Run by the Oklahoma Attorney General. Free; register online, by mail, or at 1-405-521-3921. The list is updated quarterly, and telemarketers get 30 days to remove registered numbers. State law also limits call frequency under the Telephone Solicitation Act.	Policies checked Oct 2, 2026
Pennsylvania	Pennsylvania Do Not Call list	Pennsylvania Office of Attorney General oversees the list (free permanent registration for consumers).	Policies checked Sep 1, 2026
Tennessee	Tennessee Do Not Call/Text Program	Run by the Tennessee Public Utility Commission (TPUC), not the Department of Commerce & Insurance. Free for residential lines and for cell phones used for non-commercial purposes; register online through TPUC. Covers telemarketing calls and texts. Your number stays on the list until you ask TPUC to remove it or the line is disconnected.	Policies checked Oct 2, 2026
Texas	Texas No Call list	Officially administered Texas No Call program (separate from the National Registry).	Policies checked Sep 1, 2026
Wyoming	Wyoming Do-Not-Call Law (Telephone Preference Service list)	Not a Secretary of State program. Wyoming uses the Telephone Preference Service list run by the ANA’s DMAchoice (formerly the DMA); register online through DMAchoice or with the mail-in form linked from the Wyoming Attorney General’s page. The Attorney General enforces the law and takes complaints. Protection applies once your number has been on the list for 60 days. This list is separate from the National Registry, so register on both.	Policies checked Oct 2, 2026

Additional protections (most states): file unwanted-call complaints with your state attorney general, use carrier spam tools, and report illegal robocalls to the FCC and FTC. Prefer official .gov pages over third-party “we’ll register you” services.

Why BlockTheCalls exists

Selective screening you control, not another opaque filter

Apple, Google, and carrier tools help, and newer versions can ask unknown callers who they are and why they are calling, such as the iPhone’s “Ask Reason for Calling” setting and Google’s Call Screen. Even so, many households still end up choosing between missing important unfamiliar calls and putting up with more spam. Nothing will ever be 100%.

BlockTheCalls is building selective screening. It is designed to let you customize how calls get through. Screened callers will be asked who they are and why they are calling before you decide, so real people still have a clear path while you fight back against abuse.

Stronger together. As people report new numbers and problems, we plan to build tools that help the rest of the community respond faster. Unlike silent blocklists alone, we aim to empower you, not hide the fight from you.

Our goal: block more bad calls while giving real callers a clear path through.

Short answer: Check your email address at Have I Been Pwned and turn on its free alerts. If you get a breach notice letter, confirm it by contacting the company through its official website, not a link or phone number in the message. Then change that password and any place you reused it, turn on MFA or a passkey, and freeze your credit if your Social Security number or other identity data was exposed.

“Dark web monitoring” is often a marketing term. Normal users do not need to browse Tor forums, criminal markets, or stolen databases. Use a reputable service to check your own identifiers safely, or follow our privacy self-audit tools guide for manual checks. A link is an action for you to take, not evidence that BlockTheCalls ran that search.

Resource	Use it for	Important limit	Privacy/data
Have I Been Pwned (email search, notifications, and Pwned Passwords)	Check whether an email appeared in known breach datasets, turn on free notifications, and optionally check whether a password appears in known breach data (prefer a password manager; the passwords API uses privacy-preserving k-anonymity so the full hash is not sent).	A hit is exposure evidence, not proof that someone currently controls the account.	Policies checked Sep 1, 2026
Mozilla Monitor	A consumer-friendly dashboard and free breach alerts. Mozilla’s paid data-broker removal add-on, Monitor Plus, shut down on December 17, 2025; the free breach alerts continue.	It uses HIBP breach data, so it is not a wholly independent corpus.	Policies checked Sep 1, 2026
XposedOrNot	An optional independent second breach search.	Using it shares the email address you enter with another operator. No corpus sees every exposure, so prioritize HIBP and use additional searches only when the extra disclosure is worth it to you.	Policies checked Sep 1, 2026

Other breach-search products change quickly. SpyCloud’s current free check is aimed at business-domain exposure rather than household self-checks. DataBreach.com and smaller services can require additional identifier disclosure and are not recommended here without further privacy and provenance review.

What should I do after a breach hit?

Determine what information and which service were exposed.
Change every reused password, beginning with the primary email account.
Turn on MFA or passkeys and review active sessions and devices.
Watch for targeted phishing that uses exposed details.
Freeze credit if identity data was exposed and it is not already frozen.
If infostealer or session-cookie exposure is suspected, treat the device as potentially compromised, not just one password.

Short answer: Use a password manager so every account has a unique password, turn on multi-factor authentication, and protect your primary email first. A passkey is a sign-in method saved on your phone, computer, or password manager that replaces a password and resists phishing because it works only on the real website or app.

Every important account needs a unique password. A password manager such as Bitwarden Policies checked Sep 1, 2026 or Proton Pass Policies checked Sep 1, 2026 can generate and store them. Use passkeys where available. Turn on multi-factor authentication. For critical accounts, an authenticator app or security key is preferable to SMS when supported, but SMS MFA remains much better than no MFA.

Protect the primary email account most strongly because it can reset other accounts. When a service permits arbitrary security-question answers, do not answer them truthfully: treat each answer as another password and store it in the manager.

Stop Giving Every Company the Same Email and Phone Number

Private email: Banks, taxes, government, healthcare, and account recovery. Never publish it.
Normal email: Personal correspondence and ordinary accounts.
Aliases: Shopping, newsletters, trials, retailers, and questionable signups. Options include SimpleLogin Policies checked Sep 1, 2026 / Proton Pass, Apple Hide My Email Policies checked Sep 1, 2026, and Firefox Relay Policies checked Sep 1, 2026.

Aliases reduce correlation, show which address leaked or was sold, and can be disabled. A secondary public phone number can help with noncritical signups. Do not use a temporary or disposable VoIP number for critical bank recovery unless the institution explicitly supports it.

How do I remove my address from the internet? Removal from Google is different from removal at the original data broker. Start at the source, then ask the search engine to remove an eligible result.

Search your name plus city, then your phone, email, and home address.
Identify people-search and data-broker profiles that actually refer to you.
Use each broker’s official opt-out process; do not pay a look-alike site.
Record the profile, request date, and confirmation.
Re-check periodically because data can reappear.

Optery Free Basic Policies checked Sep 1, 2026 currently offers an exposure report and self-service opt-out information. A scan identifies likely profiles; it does not guarantee removal.

Want someone else to do the repetitive work?

Optional paid service Incogni (privacy policy; owned within the Surfshark/Nord group), DeleteMe (legal and privacy terms), and Optery (privacy policy) automate different portions of removal. These services need enough identity data, and often authorization, to find records and submit requests. Compare current coverage, data required, retention and deletion, ownership, reporting, household support, renewal, cancellation, and complaints. None can remove every source record or prevent data from reappearing.

Recommendation policy: BlockTheCalls receives no referral compensation for the resources listed in this guide as of the reviewed date. If that changes, the relationship will be disclosed beside the recommendation; recommendations should never be pay-to-play.

Californians: send one free DROP deletion request

If you live in California, the state’s free Delete Request and Opt-out Platform (DROP) sends one deletion request to every data broker registered with the state, more than 600 as of July 2026. DROP opened to consumers on January 1, 2026, and registered brokers had to start processing requests on August 1, 2026. The California Privacy Protection Agency says status updates can take up to 90 days to appear (CalPrivacy, July 10, 2026).

Who can use it: California residents only. DROP does not work outside California.
What it reaches: registered data brokers only. It does not remove search engine results, sites that are not registered brokers, or the public records your data came from, and some data is exempt by law.
Cost: free. The state says it will never charge for DROP.

Know your state privacy rights and turn on Global Privacy Control

A growing number of states have comprehensive privacy laws that let residents ask businesses to show, delete, or stop selling their personal data. Rights and covered businesses differ by state. The IAPP state privacy law tracker lists which states have laws, and your state attorney general’s website explains how to use them.

Global Privacy Control (GPC) is a browser setting that tells websites not to sell or share your personal information. California, Colorado, and Connecticut require covered businesses to treat it as a valid opt-out request from their residents (California AG, Colorado AG, Connecticut AG), and some other state laws have similar rules. Elsewhere, sites may ignore it, but turning it on costs nothing. GlobalPrivacyControl.org lists browsers and extensions that send it.

Remove yourself from these people-search sites first

These large people-search sites commonly show addresses, phone numbers, ages, and relatives. Search for your own listing, then use the site’s official opt-out page below. Opt-outs on these pages are free; do not pay a look-alike “removal” site. Most ask for an email address to confirm the request.

Whitepages opt-out: paste the URL of your listing.
Spokeo opt-out: paste the URL of your listing and confirm by email.
BeenVerified opt-out: search for your record, then confirm by email.
PeopleConnect Suppression Center: one free tool for the PeopleConnect sites, including Intelius, TruthFinder, Instant Checkmate, and US Search.
TruePeopleSearch removal and FastPeopleSearch opt-out: enter your name and email, then follow the emailed link.
MyLife opt-out form.

Removal must be repeated. People-search sites refresh from public records and other brokers, so a removed listing can return or appear under a new URL. Recheck these sites every three months during your privacy maintenance. Opt-out pages change often; we last confirmed these links load on October 2, 2026.

Ways to remove your information, and their limits
Approach	Cost	What it does	Honest limits
Manual opt-outs	Free	You submit each site’s official opt-out request yourself.	Time-consuming. You only reach sites you find, and listings can return, so you must repeat it.
California DROP	Free	One request to every data broker registered in California.	California residents only. Does not cover search results or unregistered sites. Status can take up to 90 days.
Search engine removal (for example, Google Results About You)	Free	Asks the search engine to drop eligible results that show your contact details.	The page still exists on the original site; remove it at the source too.
Paid removal service	Subscription	Submits and repeats requests to the sites on the service’s list.	You must share identity data with another company. Coverage varies, and no service can remove every record or stop data from reappearing. Check renewal and cancellation terms.

BlockTheCalls receives no compensation from any site or service in this section.

Search only yourself or your household. Try your name in quotation marks, old names, email, phone, address, username, and combinations such as name plus city or employer. Use more than one search engine because indexes differ.

Username reuse: Namechk or the WhatsMyName web app can help find public reuse. A distinctive username can connect identities you intended to keep separate.
Reverse image search: use Google Lens, TinEye, or Bing Visual Search. Reusing one photo can connect public and pseudonymous profiles.
History: review old sites in the Wayback Machine. Deleting the current page does not guarantee archived copies disappeared.
Metadata: photos can contain location and device details, while documents can contain author and organization names. Turn off camera location where appropriate, share a sanitized copy, and inspect document properties, no command-line forensic tool is required.

Review every app’s access to location and precise location, contacts, photos, microphone, camera, Bluetooth or nearby devices, and local network. Prefer “While Using the App” to “Always” when practical.

Use a strong device PIN or passcode and biometrics.
Enable Find My or Find My Device, automatic updates, backups, and lock-screen notification privacy.
Remove unused apps and avoid random phone cleaner, RAM booster, antivirus, or “privacy” apps.

Private person-to-person communication

Signal is a strong default for end-to-end encrypted Signal-to-Signal messaging and calling. It does not make ordinary SMS private, and device security still matters: someone with an unlocked phone can read what is on it.

Two practical free approaches are Firefox with uBlock Origin from the official Mozilla Add-ons store, or Brave with built-in protections. Google Chrome no longer supports the full uBlock Origin; the developer’s Chrome option is the more limited uBlock Origin Lite, so avoid look-alike “uBlock” extensions. Install extensions only from an official store and remember that aggressive filtering can break some sites; use a narrow site exception when you trust the site and need it to work. Keep the browser updated, block unnecessary third-party tracking, review site permissions, enable Global Privacy Control where supported, and remove extensions you do not need.

Do I really need a VPN?

A VPN can reduce some local-network observation, hide some destination/IP relationships from a local ISP, and help on an untrusted network.

A VPN cannot make Facebook forget who you are after you log in, eliminate cookies or fingerprinting, stop phishing or malware, or make you anonymous by itself. Do credit freezes, a password manager, passkeys or MFA, SIM/port protection, and public-data removal first. If a free VPN fits your threat model, review Proton VPN’s current free plan Policies checked Sep 1, 2026; avoid random “free VPN” apps. On Proton’s free plan, the app picks the server for you (the fastest free server for your location); changing servers picks another one at random, with a cooldown between changes.

Enable transaction alerts for every card purchase when practical, plus login, transfer, new-payee, new-device, and password-change alerts. Never approve an MFA prompt you did not initiate, and treat a caller asking you to read back a one-time code as a major red flag.

Mail still exposes cards, IRS letters, bank documents, and account-change notices. Use USPS Informed Delivery, reduce prescreened offers through OptOutPrescreen, and consider Catalog Choice or the small-fee DMAchoice after the free options. DMAchoice also offers tools to stop marketing mail to a person who has died (“Opt-out the Deceased”) and to opt out someone you care for (“Opt-out as a Caretaker”).

Short answer: Call your bank, card issuer, or payment app right away using a number you look up yourself, then get a free recovery plan at IdentityTheft.gov. Verify every caller. People reported losing about $920 million to government impostors in 2025 (FTC, June 15, 2026). The FBI’s Internet Crime Complaint Center received 201,266 complaints from people 60 and older that year (FBI IC3 2025 report).

Call the bank, card issuer, wire service, payment app, email provider, or carrier immediately using a number you independently obtained. Do not use a callback number in the suspicious message.
Preserve evidence: dates, amounts, screenshots, phone numbers, emails, payment receipts, messages, and case numbers.
Secure the primary email, change reused passwords, end unknown sessions, and add MFA or passkeys.
Use IdentityTheft.gov for a recovery plan and report fraud at FTC ReportFraud.
File an FCC consumer complaint for unwanted-call or telecom issues and an FBI IC3 report for internet-enabled crime where appropriate.

Fraudulent card transaction: lock the card and dispute promptly through the issuer.

Wire or payment-app scam: contact the provider immediately and ask whether a transfer can be recalled or frozen.

Compromised email: change the password from a trusted device, review forwarding rules and sessions, then secure downstream accounts.

SIM swap: contact the carrier fraud team, restore the number, then change account recovery methods and review financial activity.

Tax identity theft: use the IRS process and protect future filings with an IP PIN.

Lost or stolen phone: use the platform’s lost-device service, contact the carrier, revoke sessions, and remotely erase only when appropriate.

Short answer: Agree on a family code word and a “hang up and call back” rule. Ask your parent to name a trusted contact at each bank and brokerage. Use the bank’s own caregiver tools instead of sharing passwords. Help your parent freeze their credit, with their permission. Then save the free help lines below where your parent can find them. None of these steps costs money.

Set a family code word and a call-back rule

Scammers can now imitate a relative’s voice. The FBI advises families to “create a secret word or phrase with your family to verify their identity” (FBI public service announcement). Pick a word that is not a pet’s name, street, team, or anything posted online. Then practice this script together:

Hang up, even if the voice sounds exactly like a grandchild or the caller says it is an emergency.
Call the person back on the number already saved in your phone, not a number the caller gives you.
Ask for the family code word.
If you still can’t reach them, call a second relative before doing anything else.
Never send money, gift cards, or cryptocurrency to someone you know only by phone or online.

Name a Trusted Contact Person at banks and brokerages

Under FINRA Rule 4512, brokerage firms must make reasonable efforts to ask customers for a trusted contact person. Your parent can still open or keep an account without naming one. The contact must be 18 or older (FINRA trusted contact guide).

The firm may contact them to	Naming them does not
Reach your parent when the firm cannot	Let them see the account balance
Discuss possible financial exploitation or fraud	Let them make trades or other transactions
Raise concerns about your parent’s health	Let them make decisions about the account
Confirm the identity of a legal representative, such as a guardian, executor, or power of attorney	Make them a power of attorney, guardian, trustee, or executor

Many banks and credit unions offer something similar. As the CFPB puts it, trusted contacts “don’t have access to your money – they simply get notified if the financial institution sees signs of financial exploitation” (CFPB). Ask each of your parent’s banks whether it has a trusted contact form.

Get caregiver visibility without sharing passwords

The CFPB has urged banks to offer opt-in features such as alerts for specified account activity and view-only access for an authorized third party. View-only access lets a designated family member watch for problems without being able to move money (CFPB recommendations). Availability varies, so ask your parent’s bank:

Can a second person get view-only (read-only) online access?
Can alerts for withdrawals, transfers, or low balances also go to a caregiver’s phone or email?
Can we add a trusted contact?

Be careful with shortcuts. A convenience account or joint account lets the added person withdraw money, and a joint account with “right of survivorship” can pass the money to that person at death (CFPB).

Freeze your parent’s credit, with their permission

If your parent manages their own affairs, sit with them while they place the free freezes themselves using the steps in How do I freeze my credit for free?. It is their freeze, and they should keep the PINs or logins. If your parent can no longer act for themselves, a legally authorized representative may be able to request a freeze by mail. Equifax, for example, asks for proof of your identity, your parent’s identity, and your authority to act for them (Equifax incapacitated adult freeze). Each bureau has its own process.

Protect the Medicare number

“Medicare will never call you to sell you anything or visit you at your home.” If someone you don’t know calls and asks for a Medicare number, hang up (Medicare.gov).
Give the Medicare number only to doctors, insurers acting for your parent, or others you know should have it.
Read every Medicare Summary Notice (or the Medicare plan’s claims statement). Compare the dates and services with your parent’s calendar and look for anything they did not receive.
Report suspected fraud to 1-800-MEDICARE (1-800-633-4227) or the Senior Medicare Patrol (1-877-808-2468).

Social Security: representative payee vs. power of attorney

These are different things. Social Security says having power of attorney, being an authorized representative, or sharing a joint bank account “is not the same as being a payee.” The Treasury does not recognize a power of attorney for negotiating federal payments. A person with power of attorney for someone who can’t manage their benefits must still apply to Social Security to become the payee (SSA representative payee FAQ). Which arrangement fits your family depends on your parent’s situation and your state’s laws. Ask Social Security (1-800-772-1213), an elder law attorney, or a legal aid office. This guide does not give legal advice.

Free help lines to save on your parent’s phone

Check each official site for current hours before you call.
Help line	Number	Use it for
National Elder Fraud Hotline (U.S. Department of Justice)	1-833-FRAUD-11 (1-833-372-8311)	Fraud against someone 60 or older. A case manager helps you report it and connects you to other help.
Eldercare Locator (Administration for Community Living)	1-800-677-1116	Finding local services for older adults and caregivers, including your state’s Adult Protective Services reporting number.
AARP Fraud Watch Network Helpline	1-877-908-3360	Free help with spotting a scam or recovering from one. AARP membership is not required. Monday to Friday, 8 a.m. to 8 p.m. ET.
Senior Medicare Patrol	1-877-808-2468	Reporting suspected Medicare fraud, errors, or abuse.

Short answer: Freeze your child’s credit at all three bureaus. It’s free. Ask each bureau whether a credit report already exists in your child’s name. Talk with your teen about sextortion before it happens: don’t pay, save the evidence, and get help from NCMEC and the FBI.

Freeze your child’s credit

The FTC says parents and guardians can request a free credit freeze to make it harder for someone to open accounts in a child’s name. It stays in place until you ask the bureaus to lift it (FTC child identity theft guide).

Contact each bureau separately: Equifax, Experian, and TransUnion.
Have copies ready. Bureaus may ask for your driver’s license or other government ID, proof of your address (such as a utility bill or insurance statement), your child’s birth certificate, and your child’s Social Security card. A guardian who is not a parent also needs proof of guardianship.
Save each bureau’s confirmation and any PIN or login in a safe place. You or your child will need it to lift the freeze later.
Teens who are 16 or 17 may request and remove a security freeze themselves.

Check whether your child already has a credit report

Most children under 18 should not have a credit report. To check, ask each of the three bureaus for a manual search of your child’s Social Security number, using the same documents listed above. A report that exists is a warning sign. Other signs, per the FTC:

Collection notices or bills for accounts your child never opened
A denial of government benefits because the child’s Social Security number is already in use
An IRS letter about unpaid taxes or income under your child’s number
A student loan denial caused by a credit history your child didn’t create

After a school data breach

School software holds sensitive records. In the PowerSchool incident, the company said exposed information varied by person and could include names, contact details, birth dates, limited medical alert information, and Social Security numbers. It offered two years of free identity protection through Experian. If your school or district sends a breach notice:

Read it closely to see which data was involved for your child.
If a Social Security number was exposed, request a manual search at each bureau and place a freeze. Free monitoring offered after a breach ends, while a freeze stays in place until you lift it.
Change the password on your school parent portal.
Be skeptical of emails, texts, or calls that use school details to seem legitimate.

If your child or teen is being sextorted

Sextortion is when someone threatens to share sexual images unless the victim sends money or more images. The FBI says paying or cooperating rarely stops the blackmail, but law enforcement can help (FBI). Tell your child ahead of time that they are not at fault and can come to you.

Don’t pay and stop responding. Block the account after you save the evidence.
Save the evidence. Keep the messages, usernames, and profiles. Don’t delete anything before law enforcement reviews it.
Remove images. NCMEC’s free Take It Down service works for nude or sexual images taken before age 18. It creates a digital fingerprint (a “hash”) on your device. The image is not uploaded, and you can stay anonymous. Only participating platforms use the hash. Adults can use StopNCII.org.
Report it to NCMEC’s CyberTipline (1-800-843-5678) and to the FBI at tips.fbi.gov or 1-800-CALL-FBI.
Never pay anyone who offers to remove images for a fee.

The TAKE IT DOWN Act: 48-hour removal

The FTC began enforcing the TAKE IT DOWN Act on May 19, 2026 (FTC). Covered platforms, such as social media, messaging, and image or video sharing apps, must offer a way to request removal of intimate images shared without consent, whether real, edited, or AI-generated. They must remove the images and known identical copies within 48 hours of a valid request. If a platform doesn’t, report it at TakeItDown.ftc.gov. You can also report on behalf of someone else who has given you permission (FTC consumer alert).

Short answer: Identity thieves sometimes use the names of people who have died. The IRS recommends four steps: send the credit bureaus a copy of the death certificate so they add a “deceased alert,” keep the obituary brief, watch the credit reports, and file the final tax return when it is due (IRS identity theft guide). Most of these steps are free.

Step	How
Make sure Social Security knows	Funeral homes usually report the death to Social Security, so give the funeral director the person’s Social Security number. If no funeral home is involved, call Social Security at 1-800-772-1213 (SSA).
Ask the credit bureaus for a deceased alert	Mail a copy of the death certificate with the person’s legal name, Social Security number, date of birth, and date of death, plus your name, address, and a copy of your ID. A spouse can do this; anyone else needs papers showing legal authority, such as an executor appointment. Equifax says a bureau that adds a deceased notice tells the other two (Equifax).
Keep the obituary brief	The IRS warns against putting information in an obituary that thieves could use. Consider leaving out the exact birth date, mother’s maiden name, and home address.
Watch the credit reports	Check for new accounts or other unusual activity after the deceased alert is in place.
File the final tax return	File the person’s final federal tax return(s) when due.
Stop marketing mail	DMAchoice runs a Deceased Do Not Contact list that should reduce promotional mail within about three months. It charges a $6 processing fee.

Grieving families can be targets for scam calls. If someone calls about an unpaid debt or a balance owed by the person who died, use the same rule as above: hang up and call the company back on a number you look up yourself. If you find accounts you don’t recognize, follow the steps in What should I do if I was scammed or my identity was stolen?

Short answer: Spend 15 minutes every three months on the checks below, and repeat your people-search opt-outs because removed listings can come back.

Review HIBP alerts and credit reports periodically.
Verify freezes and carrier protections remain in place.
Review bank alerts, activity, devices, and payees.
Search your name, email, phone, usernames, and profile images.
Check for data-broker reappearance.
Review social privacy settings and contact syncing.
Review app permissions and lock-screen notifications.
Update devices and remove old apps and extensions.

Trust and disclosure

How We Choose Resources

Free resources first.
Government and official sources preferred.
Reputable nonprofit and open-source services where useful.
Paid products only when they add material convenience or protection.
No product is presented as complete protection.
Any affiliate or referral relationship must be disclosed beside the recommendation.

Know a free or low-cost tool that helps U.S. households protect privacy, and that we should review for this guide? Email privacy@blockthecalls.com with the name, link, and why you recommend it. Suggestions are not commitments to list a product.

This privacy guide is separate from the BlockTheCalls Privacy Policy. BlockTheCalls is building a U.S. incoming-call-screening service; it is not a telecommunications carrier. Outbound calls and 911 will continue to go through your normal phone and carrier. This public site does not collect payment details.

Quick answers

Privacy checklist FAQ

Should I freeze my credit?

For most U.S. adults, a free security freeze at Equifax, Experian, and TransUnion is one of the strongest ways to reduce new-account credit fraud. You can lift it when you need to apply for credit.

Does the Do Not Call Registry stop scam calls?

No. It restricts many legitimate telemarketers that follow the law, but it does not block calls and scammers may ignore it.

Can Apple or Google accidentally block a doctor’s call?

Yes. Any automatic system can make false positives, especially when a doctor, hospital, pharmacy, school, or recruiter calls from an unfamiliar or rotating number.

How do I know if my email was in a data breach?

Go to Have I Been Pwned, check your email, and turn on free alerts. A match means your address showed up in a known leak. It does not prove someone is in your accounts right now.

Should I pay for dark web monitoring?

Start with free breach notifications, credit freezes, account alerts, and public-exposure checks. A paid service may add convenience or recovery help, but monitoring detects problems and does not replace prevention.

How do I remove my address from the internet?

Remove it from the original people-search or data-broker site first, then ask search engines to remove eligible search results. Keep a record and check again because data can reappear.

Can I use social media without making my life public?

Yes. Keep a deliberate public profile while separating private recovery email, mobile number, home address, family accounts, real-time location, and children’s routines.

Do I really need a VPN?

A VPN can help with some network privacy, but it does not erase logins, cookies, fingerprinting, phishing, or malware. Do higher-value free protections first.

What should I do if I already sent money to a scammer?

Contact the bank, card issuer, wire service, or payment app immediately using a number you independently obtained, preserve evidence, secure affected accounts, and report the incident through the appropriate official channel.

Which people-search sites should I remove myself from first?

Start with large sites that show addresses and phone numbers: Whitepages, Spokeo, BeenVerified, the PeopleConnect sites (Intelius, TruthFinder, Instant Checkmate, US Search), TruePeopleSearch, FastPeopleSearch, and MyLife. Use each site’s official opt-out page, keep a record, and recheck every three months because listings can return.

How long does a credit freeze take?

If you request it online or by phone, each bureau must place the freeze within one business day and lift it within one hour. Placing and lifting a freeze is free.

Can I use California’s DROP if I don’t live in California?

No. DROP is free but only for California residents, and it reaches data brokers registered in California. People in other states can still use each site’s official opt-out page and any privacy rights their own state provides.

What is Global Privacy Control?

Global Privacy Control (GPC) is a browser setting that tells websites not to sell or share your personal information. California, Colorado, and Connecticut require covered businesses to treat it as a valid opt-out request from their residents, and some other state laws have similar rules.

What is a passkey?

A passkey is a sign-in method saved on your phone, computer, or password manager that replaces a password and resists phishing because it works only on the real website or app.

I got a data breach notice letter. What should I do?

If you get a breach notice letter, confirm it by contacting the company through its official website, not a link or phone number in the message. Then change that password and any place you reused it, turn on MFA or a passkey, and freeze your credit if your Social Security number or other identity data was exposed.

What is a family code word?

A family code word is a secret word or phrase your family agrees on to confirm who is really calling. The FBI recommends one because scammers can use AI to copy a relative’s voice. If a caller cannot give the word, hang up and call the person back at a number you already know.

How do I report a scam text?

Don’t tap any links or reply. Forward the text to 7726 (SPAM), use your messaging app’s report junk option, and report it to the FTC at ReportFraud.ftc.gov. Then delete it.

Should I reply STOP to a spam text?

Only to senders you recognize and signed up with, such as your pharmacy or bank. Legitimate senders must honor a STOP reply within 10 business days. Don’t reply to texts you think are scams; forward them to 7726 instead.

How do I protect a family member’s identity after they die?

Send the credit bureaus a copy of the death certificate and ask for a deceased alert, keep the obituary brief, watch the credit reports, and file the final tax return when due. Funeral homes usually report the death to Social Security.

Keep reading

Swim at Your Own Risk: Privacy Self-Audit Tools

A cautious U.S. guide to checking your own breach, public-search, data-broker, username, image, and archived-web exposure without handing secrets to unknown tools.

Self-audit extension

Verify the mobile number you own, then use the BlockTheCalls extension to search public sites for your own information and save a local cleanup report.

Get notified when access opens.

BlockTheCalls is prelaunch. You can request notification when access opens. A request does not create a paid subscription.

Start Here: The Highest-Value Free Privacy Steps

Check Have I Been Pwned and turn on free alerts

Register with the National Do Not Call Registry

Freeze Equifax

Freeze Experian

Freeze TransUnion

Lock your mobile number against SIM swaps and port-outs

Secure your primary email with a unique password and MFA or a passkey

Create an IRS Identity Protection PIN

Turn on spam warnings on your phone. Read the blocking warning first

Report scam calls and robocalls to the FTC

Enable Google Results About You

Use OptOutPrescreen for credit and insurance offers

Freeze ChexSystems

Freeze NCTUE

Consider an Innovis freeze

Consider a LexisNexis / SageStream freeze

Run a free data-broker exposure scan

Review free credit reports at AnnualCreditReport.com

Enable transaction and login alerts on banks and cards

Enable USPS Informed Delivery

Agree on a family code word

Forward scam texts to 7726 and turn on text filtering

Turn on your phone’s theft protection

A simple way to think about privacy

Prevention

Exposure discovery

Removal

Monitoring

Recovery

How do I freeze my credit for free?

Freeze the specialty files that fit your risk

Protect taxes, existing accounts, and prescreened mail

Optional advanced employment protection

Which scam calls and texts are most common right now?

How big is the problem?

Government, bank, or company impersonation

Tech support

AI voice “family emergency”

Toll or package text (smishing)

Job or “task” scam

“Wrong number” text that leads to investing or crypto

Prize, sweepstakes, or lottery

Fake debt or car warranty

What to do with spam texts

Built-in phone protections

How do I protect my phone number from SIM swaps and spam calls?

When you cannot miss an unfamiliar call

Protect the carrier account too

Your state may offer additional protection

How do I check if my information was in a data breach?

What should I do after a breach hit?

How do I secure my accounts with passwords, passkeys, and 2FA?

Stop Giving Every Company the Same Email and Phone Number

How do I remove my personal information from the internet?

Want someone else to do the repetitive work?

Californians: send one free DROP deletion request

Know your state privacy rights and turn on Global Privacy Control

Remove yourself from these people-search sites first

What can strangers find about me online?

How do I make my social media private without disappearing?

Personal account

Public or business account

Platform privacy checkups

How do I lock down my phone and other devices?

Private person-to-person communication

How do I reduce online tracking, and do I need a VPN?

Do I really need a VPN?

How do I get early warnings about bank fraud and mail theft?

What should I do if I was scammed or my identity was stolen?

How do I protect an aging parent’s money and identity?

Set a family code word and a call-back rule

Name a Trusted Contact Person at banks and brokerages

Get caregiver visibility without sharing passwords

Freeze your parent’s credit, with their permission

Protect the Medicare number

Social Security: representative payee vs. power of attorney

Free help lines to save on your parent’s phone

How do I protect my child’s identity and privacy?

Freeze your child’s credit