Reporters have spilled gallons of ink writing about the likelihood that people like you and me will have to deal with the damaging effects of identity theft related to the Equifax breach.

Even more has been said about what that damage might look like: how thieves will obtain our SSNs, what they might use our identities to open up or steal, and how these activities might follow us into the future and erode our financial health.

Now that we’ve been blindsided with the news that our SSNs are exposed–and had been for MONTHS before we were made aware–the big question is how and to what extent can we protect ourselves?

Assume you are part of the breach–because you probably are.

Original estimates put the amount of people affected at 143 million, but just days ago, Equifax revealed another 2.5 million people may have also been compromised.

With this kind of volume, it’s a mistake to think your information wasn’t part of the compromise. Around half of the people in the United States are affected–whether or not you should be prepared for credit fraud ultimately boils down to a coin toss.

What isn’t a question is protecting yourself now–before something happens–is far more effective and easier than waiting until after you’ve discovered fraudulent activity.

So, assume you’ve been compromised. Take steps right now to shield yourself and you’ll hopefully spare yourself a ton of frustration and anxiety later.

What you can do before your identity is stolen.

Get credit monitoring.  Usually for a small monthly fee, there are several credit monitoring services available to consumers. These agencies will routinely review your credit report with an eye toward unusual changes or inconsistencies that may be flags for fraudulent activity. You will be notified about new accounts opened in your name, changes to existing account information, and any hard credit checks that might indicate someone attempting to get a loan, a credit card, or some other kind of service.

Keep in mind credit monitoring will not protect you from actual theft. It simply helps to keep you abreast of activity on report so you can act quickly if something isn’t right. The sooner you act, the better your ability to reverse and prevent further damage.

To make amends for the breach, Equifax is currently offering 12 months of free credit monitoring.

Freeze your credit.  For around $10, you can contact each of the Big Three credit reporting bureaus (Equifax, TransUnion, Experian) and request a credit freeze. Also called a security freeze, this makes things substantially harder for an identity thief and is one of the best tools in your arsenal to prevent theft.

A credit freeze locks access to your credit report. Under a freeze, lenders and other companies that need to perform credit checks before offering services are blocked from pulling your report, and therefore unable to issue credit in many cases. This could block a thief from obtaining a loan or credit card in your name.

But credit freezes aren’t totally perfect. They won’t stop a thief from editing existing or using existing accounts. And they don’t block everyone from accessing your report (if you’ve already worked with an institution, they may be excluded from the freeze).

If you’re planning on applying for a new utility service, a mortgage, a car loan, a new apartment, or new job, a credit freeze can also block people you want to access your report. So unless you have no plans to make life moves that involve credit checks, a credit freeze may not be an option.

If you do need to lift a credit freeze, be aware that thawing your credit can sometimes be a lengthy process. In the event of an emergency purchase for which you may need credit quickly, a credit thaw could do as much harm as good.

Credit freezes do not negatively affect your credit score.

Place an initial fraud alert on your account.  Like a credit freeze, placing a fraud alert on your account can be done with any of the Big Three credit bureaus. The Fair Credit Reporting Act allows consumers to put a fraud alert on their account for free.

A fraud alert doesn’t lock access to your report, but rather flags it as at risk for fraudulent activity for any creditors pulling your report. These creditors will handle that report with increased scrutiny, taking extra measures to verify your identity.

While it doesn’t prevent someone from opening an account in your name, it does put your report under a magnifying glass should someone try. A thief is much more likely to be caught when your report is flagged in this way.

There are three kinds of fraud alerts. If you are thinking of requesting a fraud alert before you’ve been victimized–an “initial” fraud alert–the duration is 90 days.

Seniors are particularly at risk.

We’ve talked a little bit about what can happen if an identity thief decides to try and collect your Social Security benefits–not only is it very possible, but it’s incredibly easy to do with just a few pieces of basic information and your SSN.

But any attempt on the identity and financial information of seniors deals double damage. Not only do seniors have to deal with all of the same repercussions as younger Americans, but in many cases, they also won’t have the means or ability to repair or protect their credit.

An adult on a fixed, small income has to make a big sacrifice to pay for the services required to fix the damage or prevent the theft in the first place. And once the damage is done, the aftermath can hit a senior much harder–they may have no way to keep themselves afloat or walk back what was done.

And sadly, identity thieves are fond of targeting seniors.  Retirees offer more opportunities to cash in: thieves can take advantage of Social Security payments, retirement savings accounts flush with cash, and the fact that many seniors aren’t making big financial decisions that would prompt them to check their credit reports regularly.

Be very vigilant. At the very least, take advantage of your free credit report per year to keep track of your data on your own. And be prepared to act quickly if you see something you shouldn’t.

According to White House cybersecurity coordinator Rob Joyce, the government may already be considering a departure from the use of Social Security numbers as identification.

Speaking at the 2017 Washington Post Cybersecurity Summit yesterday, Joyce confirmed the Trump Administration has asked federal officials to put their heads together and come up with a plan to significantly change the way we identify citizens–namely by dropping the SSN completely.

These revelations come in the continuing chaos that is the Equifax breach fallout. The breach–one of the worst in history–has exposed the SSNs and associated personal data of 143 million Americans to identity thieves.

Chances are good if you’ve worked or are currently working in the U.S., those nine little digits that control your entire work, financial, and credit history are currently up for grabs somewhere on the dark web.

With your SSN and a few key pieces of identifying information, thieves have all they need to drain your bank account, take out credit cards and loans in your name, open utility accounts, obtain pricey medical treatments, and even file for your tax refund.

For soon-to-be Social Security beneficiaries, identity theft can be particularly nasty. Imagine filing for your retirement benefits only to find that “you” have already been receiving Social Security payments for several years.

Or you file for disability or supplemental Social Security benefits and your claim is denied outright due to someone claiming earnings under your SSN (these earnings may exceed what is allowed by supplemental, and to claim disability, one cannot have claimed significant earnings since the onset of the disability).

These realities are painful for victims who had absolutely no say in the matter. We didn’t leave our doors unlocked or carelessly hand our information to strangers–and when it comes to credit reporting, the Big Three credit bureaus have our SSNs and identifying information whether we like it or not.

Even Richard Smith, former Equifax CEO, wonders whether it isn’t time for a big change in the way we use SSNs:

“The concept of a Social Security number in this environment being private and secure–I think it’s time as a country to think beyond that. What is a better way to identify consumers in our country in a very secure way? I think that way is something different than an SSN, a date of birth, and a name.”

Smith, who was at the helm of Equifax for the past 12 years, stepped down following the breach.

Joyce, too, thinks it’s high time we ditch the SSN to protect the privacy and financial security of our country’s citizens–especially considering that once issued, a SSN is permanent:

“I feel very strongly that the Social Security number has outlived its usefulness. It’s a flawed system.  If you think about it, every time we use the Social Security number, you put it at risk… It’s a flawed system that we can’t roll back…after we know we had a compromise.”

Joyce and others in the government are currently floating a variety of alternatives to phase out the SSN. For himself, Joyce is in favor of a modern cryptographic public-private key system that would prevent thieves from ever converting your complex key back into your actual identifier.

Laurence Kotlikoff, a contributor at Forbes, asked the question we thought of–and likely many Social Security beneficiaries, too–after Equifax’s major security breach exposing up to 143 million of our Social Security numbers to potential criminals:

How could this massive breach of critical Social Security information affect our ability to claim or receive our benefits should a thief choose to target us?

While media outlets have focused on how such a breach might affect those still working in the form of phony loans and credit cards taken out with stolen Social Security numbers, very little attention has been paid to those currently or soon to claim Social Security benefits.

But according to Kotlikoff, beneficiaries absolutely have cause for concern.

As we’ve mentioned in previous posts, one such concern may involve a program that scammers have already exploited with great success to hijack retirees’ Social Security payments.

My Social Security, a program that the Social Security Administration created to make accessing, editing, and managing your Social Security account much more convenient, is a huge target for thieves.

With just a few pieces of someone’s basic personal information, a thief can easily impersonate their victim, gain access to their account, and edit the details to reroute direct deposit payments into an account specified by the thief.

Typically, these details are acquired via manipulating the victim into offering them up. But a breach like this easily gives thieves everything they need to steal someone’s benefits without ever contacting him.

“Imagine you are 62, retired, but waiting till 70 to collect your Social Security benefit. Further, suppose that a thief with your personal data, including your Social Security number, notifies Social Security that you have moved and provides a new address. The thief then can file for your early retirement benefits and have the checks sent to this new address or wired to his/her bank account…

… Eight years later you turn 70 and you file for your retirement benefit only to be told you’ve been receiving it for 8 years. What do you do?”

It’s Kotlikoff’s opinion that people currently collecting Social Security have just as much of a reason to worry.

Kotlikoff offers several pieces of advice for beneficiaries looking to protect themselves from any potential Social Security theft that may result from this breach, including immediately making copies of your Social Security earnings record and any statements related to your benefits.

For more information about how you can protect yourself from becoming a victim in this latest data breach, you can read the rest of Kolitkoff’s recommendations right here.