Personal Privacy & Security handbook

Set up sign-in protection

• Open the security settings for the email address you use for banking and password resets.
• Gmail — open your Google Account → Security & sign-in → 2-Step Verification.
• Outlook or Hotmail — open Microsoft security settings → Manage how I sign in → Additional security → Two-step verification → Turn on.
• iCloud Mail — open Settings → your name → Sign-In & Security → Two-Factor Authentication.
• Enroll a passkey or security key if offered. Otherwise, set up an authenticator app. Use text messages if that is your available option.
• Complete the setup confirmation and check that the account shows protection is enabled.

Keep a way back in

• Check and update the recovery phone number and email address.
• Save backup codes in a private place outside this inbox and phone, if offered.
• Register a second supported sign-in method if available.
• Keep your working session open and test sign-in in a private browser window.
• Confirm the new method works, then sign out of the test window.

Set up your manager

• iPhone — open Apple Passwords. In Settings → General → AutoFill & Passwords, enable autofill and select Passwords.
• Android or another iPhone option — install Bitwarden from the official app store, create an account and enable its autofill service.
• If your manager uses a master password, create a unique passphrase of at least 16 characters and save it in your private recovery record.
• Enable two-step sign-in for the manager or the account that protects it.
• Write down the recovery details and store them in a private physical place. Keep the manager’s own recovery codes outside its vault.

Replace reused passwords

• Save your email’s website address, username and a newly generated unique password in the manager.
• Change the email password at the real provider website.
• Keep your working session open and test the saved login in a private window.
• Turn on two-step sign-in for your email.
• Repeat the password-change and sign-in test for one financial or other important account.
• Schedule time to replace the remaining reused passwords.

Check for exposed information

• If you choose to share your email address with the service, search it at Have I Been Pwned.
• For an exposed or reused password, change it at the real service and anywhere else it was reused.
• Check the manager’s recovery email and phone number, and install pending app updates.

Freeze the three main reports

• Gather your name, date of birth, Social Security number, current address and any requested identity documents.
• Request a free security freeze through Equifax. Save the confirmation.
• Request a free security freeze through Experian. Save the confirmation.
• Request a free security freeze through TransUnion. Save the confirmation.
• Skip paid monitoring, credit locks, subscriptions and trials during setup.
• Sign back in to each bureau and confirm all three reports are frozen.
• Store each login, confirmation and lift instructions in your password manager.

Optional additional freezes

• Request a freeze through Innovis. Save its confirmation.
• Request a freeze through ChexSystems. Save its confirmation and access instructions.
• Request a freeze through LexisNexis. Save its confirmation and management instructions.
• If freezing a child’s file, use each bureau’s protected-consumer process and provide the requested identity and authority documents.

Review reports and other protections

• Request all three credit reports from AnnualCreditReport.com.
• Check accounts, addresses and inquiries. Save the reports privately and dispute errors using the contacts supplied.
• Request and review your LexisNexis Consumer Disclosure. Dispute incorrect entries using the report’s instructions.
• If choosing myE-Verify Self Lock, follow its official enrollment instructions and record how to unlock it before an employer’s E-Verify check.

Before an application

• Ask the lender or bank which reporting companies it will check.
• Schedule a temporary lift with those companies, with a start and end date.
• Confirm access before applying, then confirm the freezes return afterward.

Social Security

• Open my Social Security and sign in through Login.gov or ID.me, or complete registration.
• Protect the sign-in with the strongest supported method you can use and save recovery details.
• Compare the earnings record with your W-2s or tax records.
• Record any missing years or incorrect amounts and contact SSA about corrections.

IRS

• Open IRS Individual Online Account and sign in through ID.me, or complete registration and identity verification.
• Open notices and balance information. Save any notice that requires action.
• Contact the IRS through its official website about an unfamiliar balance or notice.
• If enrolling for an IP PIN, use the account’s IP PIN section and save the issued code with its calendar year.
• Add a January reminder to retrieve the current IP PIN if you remain enrolled.
• Enter the current IP PIN when filing, or give it to your trusted preparer when ready to file.

USPS Informed Delivery

• Open USPS Informed Delivery and check address eligibility.
• Sign in or create a USPS account and finish address and identity verification.
• Enable multifactor authentication.
• Choose notifications and confirm the email address is yours.
• Sign back in and confirm you can open the Informed Delivery dashboard.

Make a family response plan

• Choose the person each of you will call for a second opinion.
• Save their number in Contacts with the label “Scam second opinion.”
• Write the number on a card beside the home phone.
• Call once together to confirm the number works.
• Practice saying “I’ll look up the number and call back,” then ending the call.
• Rehearse an urgent family-money request and verify it by calling a saved family number.

When a suspicious request arrives

• End the conversation and contact the bank, agency or family member using a number you already trust.
• Keep sign-in codes private and decline unexpected requests for remote device access.
• Stop a request to move money to a “safe account” or pay an unexpected caller by gift card or cryptocurrency.
• Open the service’s usual app or your bookmark to check an account alert.
• Inspect a public QR code for a covering sticker. Use another posted payment method if altered.
• Close a scanned page that asks for an unexpected app installation or payment.
• Ask a trusted person to review a prize or investment offer before acting.

If money or information was shared

• Ask what was sent or shared and when.
• Call the bank or payment provider immediately about money sent.
• Disconnect a remotely controlled device and use another trusted device to secure accounts.
• Save messages, receipts, transaction IDs and case numbers.
• Follow the matching branch of the Emergency checklist.

Home network

• Read the router label and find the model’s setup guide on the maker’s support website, or open your internet provider’s router app.
• Set Wi-Fi security to WPA3 Personal if supported by your devices, or WPA2 Personal for compatibility.
• Set different, unique passwords for Wi-Fi and router administration. Save them securely.
• Install router updates and enable automatic updates if offered.
• Reconnect your phone and load a webpage.
• Enable guest Wi-Fi with its own name and password.
• Turn off guest access to the local network or intranet.
• Connect to guest Wi-Fi and check that internet access works and main-network devices are unavailable.

Sharing at home

• Find My — open People, select anyone you no longer want to share with, and choose Stop Sharing My Location.
• Google Maps — open your profile → Location sharing, select the person and choose Stop.
• Review other apps that share location and remove unwanted sharing.
• Remove current travel details from public posts if you want them private.
• Google Home — open profile → Home settings → Google Assistant or Gemini for Home voice assistant → Personal results. Turn off personal results on shared devices where needed.
• Test a calendar request on the shared speaker or display.

Devices, paperwork and mail

• Back up files and open a sample from the backup.
• Test email, password-manager and verification-code access on the replacement device.
• Remove the memory card and physical SIM you are keeping.
• Follow the device maker’s “before you sell” checklist for sign-out, activation locks and erasure.
• Confirm the erased device reaches the initial setup screen.
• Shred discarded papers containing account, tax or other sensitive details.
• If opting out of prescreened credit offers, complete the five-year online request or return the signed permanent opt-out form through OptOutPrescreen.com.

Install updates

• Confirm you have a recent backup, then connect the device to power.
• iPhone/iPad — Settings → General → Software Update. Install updates and enable automatic installation.
• Android — Settings → System → Software updates. Install available updates and restart when prompted.
• Windows — Settings → Windows Update. Check for updates, install and restart.
• Mac — System Settings → General → Software Update. Install updates and enable automatic updates.
• Install pending app updates and complete the browser’s update check.

Set and test the screen lock

• Choose a PIN or password with no birthday or simple sequence.
• iPhone/iPad — set the passcode in Face ID & Passcode or Touch ID & Passcode. Set a short delay in Display & Brightness → Auto-Lock.
• Android — search Settings for Screen lock and Screen timeout.
• Windows — Settings → Accounts → Sign-in options. Set up a supported Windows Hello method and test Windows key + L.
• Mac — System Settings → Lock Screen. Require the password immediately after the screen saver or display turns off.
• Lock and wake the device. Confirm that unlocking requires your sign-in method.

Make and check a backup

• iPhone/iPad — Settings → your name → iCloud → iCloud Backup. Enable backup and choose Back Up Now.
• Android — Settings → Google → All services → Backup. Review device data and photos and start a backup.
• Check the phone’s successful backup date and confirm important photos are backed up.
• Windows — connect a backup drive, open Control Panel → System and Security → File History, and turn it on.
• Mac — connect a backup drive and set it up in System Settings → General → Time Machine.
• Check included folders. Restore a small test file to a different location and open it.
• Keep backup-account recovery information and any backup-encryption password accessible separately.

Review app access

• Remove unused apps.
• iPhone/iPad — Settings → Privacy & Security.
• Android — Settings → Apps → select an app → Permissions.
• Windows — Settings → Privacy & security → select a permission category.
• Mac — System Settings → Privacy & Security → select a permission category.
• Remove camera, microphone, location or other access that a feature you use does not need.
• Test the app’s usual task after changing permissions.
• Add a monthly “Device check” calendar reminder for updates, backup dates and unused apps.

Make a family plan

• Set aside 20 minutes with your child and open their three most-used apps or games.
• Choose two trusted adults they can ask for help.
• Practice closing an uncomfortable conversation, stopping replies and asking an adult for help.
• Tell your child they can ask for help even after sharing something or breaking a family rule.

Accounts and parental controls

• Give the child their own account with their correct birth date and connect it to your family group.
• Protect the parent account with a unique password and two-step sign-in.
• Apple — Settings → Family → child’s name. Review Content & Privacy Restrictions and Apps & Websites.
• Set age ratings and enable Ask to Buy when your child needs app approval. Keep the Screen Time passcode private.
• Google — Family Link → child → Controls → Google Play. Review age ratings and set Require approval for to All content if you want download approval.
• Request a free app together and confirm the approval request reaches you.
• Test that the child can still call or message a parent.

Contact and sharing settings

• In each selected app, choose Private or Friends only where offered.
• Limit messages and friend requests to known contacts where supported.
• Turn off public location sharing.
• Review the friend list together and remove unfamiliar contacts after discussing them.
• Find the Block and Report buttons together.
• Remove public school names, addresses, live locations and routine details you want private.
• Review photos for school badges, documents and location clues before posting.
• Ask before sharing your child’s photo and agree on the same rule with relatives.
• Schedule a 10-minute follow-up for next week.

If a child is threatened

• Stay with the child, thank them for telling you and stop replies to the person threatening them.
• For immediate physical danger, contact local emergency services.
• Report the account, block it, and keep existing messages and account details available for reporting.
• Record usernames, profile links and dates.
• Report suspected online child sexual exploitation through NCMEC’s CyberTipline.
• If an explicit image taken before age 18 is already on the person’s device, follow Take It Down. Avoid downloading or forwarding an image for this purpose.

Prepare and regain access

• Use an updated device you control; disconnect a device with suspected malware or unwanted remote access.
• Record account name, incident date and evidence without recording passwords or codes here.
• Secure your primary email before accounts that depend on it.
• Open your provider's official recovery route if locked out.
• Google — Account recovery.
• Microsoft — Hacked-account help.
• Apple — Account recovery.
• Record the case number, next action and follow-up date if recovery is pending.

Repair sign-in and recovery

• Generate and save a unique replacement password in your password manager.
• Add and verify a recovery method you control; remove unfamiliar recovery addresses and numbers.
• Remove unfamiliar passkeys, security keys and verification methods.
• Turn on two-step verification if it is off.
• Replace backup codes if offered; store them separately from this checklist.

Close unwanted access

• Google — Security & sign-in → recent events and devices. Sign out unfamiliar sessions and remove unwanted third-party connections.
• Microsoft — Additional security options → Sign out everywhere; follow separate Xbox sign-out instructions if needed.
• Apple — account.apple.com → Devices. Remove unfamiliar devices and verify the Apple Account on your own devices.
• Revoke unfamiliar connected apps and unused app passwords where offered.
• Test the replacement sign-in in another window after securing recovery methods.

Repair email and follow up

• Gmail — See all settings → Forwarding and POP/IMAP, Filters and Blocked Addresses, Accounts and Import. Remove unauthorized entries.
• Other webmail — inspect Forwarding, Rules, Automatic replies and delegated access; remove unauthorized changes.
• Inspect Sent and Deleted/Trash folders for unauthorized messages and resets.
• Send a test email from another account and confirm delivery.
• Warn affected contacts through a trusted channel if impersonation messages were sent.
• Replace passwords on other accounts that reused the exposed password.
• Inspect purchases, payment methods and sharing; report unauthorized activity through official channels.
• Use the Emergency checklist for money or identity misuse.
• Schedule security and forwarding checks for tomorrow and one week later; record provider follow-ups.

Choose a browser checklist

• Open the browser guide, choose your device and browser, then print that focused checklist.
• Repeat for each browser you regularly use.

Confirm your account and password

• On iPhone or iPad, open Settings → your name. On Mac, open System Settings → your name. Confirm the account email or phone number belongs to you.
• Confirm you can find this account in your password manager. If the password is reused or exposed, replace it with a unique generated password through Sign-In & Security → Change Password on your iPhone/iPad or Mac. Save the replacement.

Enable two-factor authentication and check trusted numbers

• On iPhone/iPad, open Settings → your name → Sign-In & Security → Two-Factor Authentication. On Mac, use System Settings → your name → Sign-In & Security → Two-Factor Authentication.
• If two-factor authentication is off, follow the setup prompts to turn it on. Confirm it shows as enabled.
• Inspect trusted phone numbers. Add and verify a current number before removing one you no longer control. If practical, add a second reliable number that remains reachable if your main iPhone is lost.

Review devices signed in to your account

• Open Apple Account and select Devices, or scroll through the device list under your name in Settings/System Settings.
• Open each entry and identify the device. Remove devices you no longer own after signing out of them, and investigate entries you cannot recognize.
• If a device is missing or stolen, use the Emergency checklist before removing it from your account.

Add a recovery contact

• Choose a trusted person with a compatible Apple device and ask if they are willing to help with account recovery.
• On iPhone/iPad, open Settings → your name → Sign-In & Security → Recovery Contacts → Add Recovery Contact. On Mac, use System Settings → your name → Sign-In & Security → Recovery Contacts.
• Follow the prompts and confirm the person is listed as added. If an invitation is required, wait for acceptance before marking this task complete.

Enable Stolen Device Protection if you use an iPhone

• On your iPhone, open Settings → Face ID & Passcode or Touch ID & Passcode → Stolen Device Protection. Update iOS and set up the listed prerequisites if the option is unavailable.
• Turn protection on. For protection regardless of location, choose Always under Require Security Delay, if offered.
• Reopen the setting to confirm it is enabled. If you do not use an iPhone, mark this task not applicable.

Confirm your recovery plan and schedule a review

• Check that you can unlock your password manager and reach at least one trusted number if your main device is unavailable.
• Record your recovery contact’s name and where your recovery information is stored. Keep passwords and codes off this tracking checklist.
• Create a calendar reminder three months from today to recheck trusted numbers, devices and your recovery contact.

Keep Automatic Verification enabled

• Open Settings/System Settings → your name → Sign-In & Security → Automatic Verification.
• Confirm it is on; enable it if needed and recheck the setting.

Optional — Legacy Contact

Status: Completed _ Skipped _ Revisit later _ Date _

• Choose a trusted person and discuss the Legacy Contact role.
• Open Settings/System Settings → your name → Sign-In & Security → Legacy Contact → Add Legacy Contact.
• Complete setup and share or print the access key; confirm your contact received it.
• Save a separate copy with important records and confirm it is retrievable.
• Keep the access key off this checklist.

Optional — Contact Key Verification

Status: Completed _ Skipped _ Revisit later _ Date _

• Check Apple’s compatibility requirements and update devices signed in to iMessage.
• Open Settings/System Settings → your name → Contact Key Verification; enable Verification in iMessage.
• With a contact using the feature, open conversation details → Verify Contact on both devices.
• Compare codes in person or over a secure call; mark verified only if they match and confirm the verification mark.
• If codes differ, stop sharing sensitive information until the mismatch is resolved.

Optional — Recovery Key

Status: Completed _ Skipped _ Revisit later _ Date _

• Read Apple’s Recovery Key guidance and decide whether to accept replacing standard account recovery.
• If proceeding, prepare secure storage outside Apple Passwords and iCloud before enabling it.
• Open Settings/System Settings → your name → Sign-In & Security → Recovery Key and follow setup prompts.
• Print or write down the key; store secure copies and complete Apple’s confirmation step.
• Confirm you can retrieve a copy and reach your trusted phone number without your main device.
• Record storage locations separately; keep the actual key off this checklist.
• If a key is already enabled, verify existing copies and trusted-number access instead of replacing it unnecessarily.

Open the correct account and run Security Checkup

• Open Google Account on your own device. Check the profile picture or initial and confirm the email address you intend to secure.
• Open Security Checkup. Inspect each recommendation, starting with recent security activity.
• If you see activity you did not initiate, stop routine setup and follow Recover a hacked account.

Verify recovery email and phone

• In Google Account, open Security & sign-in. Under How you sign in to Google, inspect Recovery phone and Recovery email where offered.
• Add or update a phone number you control and a different email inbox you can access. Complete any verification prompts.
• Open the recovery inbox and confirm you can sign in without relying only on this Google account. Keep your current Google session open until the recovery details are verified.

Protect sign-in with a unique password and two-step verification

• Confirm this account has its own password saved in your password manager. Replace it through Google Account → Security & sign-in → Password if it is reused or exposed.
• Open Security & sign-in → How you sign in to Google → 2-Step Verification. If it is off, follow the setup prompts.
• When offered a choice, start with a Google prompt on your own locked phone rather than text-message codes. Keep a usable backup method and confirm verification is enabled.

Add a passkey on your own device

• On a personal device protected by a screen lock, open Google Account → Security & sign-in → Passkeys and security keys.
• Inspect existing passkeys. If you do not already have one on a device you control, choose Create a passkey when offered and follow the prompts.
• Keep your original session open and test signing in from another browser window using the passkey. Confirm it unlocks with your device’s supported PIN or biometrics.

Save backup codes separately

• Open Google Account → Security & sign-in → 2-Step Verification → Backup codes.
• Generate codes if you have none, then print or save them in a secure location you can reach without your phone or this Google account.
• If an old set is lost or exposed, generate a replacement and discard the invalid old set. Record only the storage location on your progress checklist.

Sign out old sessions and remove unwanted app access

• Open Google Account → Security & sign-in → Your devices → Manage all devices. Inspect the device and session details.
• Sign out sessions you no longer use. If you cannot identify a session, sign it out and follow the recovery guide if the activity looks unauthorized.
• Open the third-party connections page. Inspect each service and the access it has. Remove access you no longer need.

Test access and schedule a review

• Using a second browser window, confirm your intended sign-in method works while keeping the original session open.
• Check that recovery information and backup-code storage remain accessible if your main phone is lost.
• Set a calendar reminder three months from today to repeat Security Checkup and review recovery details, devices and connected apps.

Use for every site

• Open the link, locate your matching record if needed, submit the opt-out and complete verification.
• Record dates and status below. Recheck after the provider’s stated period, or set your own two-week reminder if none is given.
• Confirm the listing or official request status before marking complete; use the company’s Privacy/Opt out link if a route fails.

Acxiom

• Acxiom removal route. Choose the consumer-data or marketing opt-out you want.

Status: Not started _ Pending Verified removed / opted out _ No match Not applicable _ Blocked _

Submitted _ Confirmed _ Checked ____

Listing / case reference ______

Next action ____ Next check date __

BeenVerified

• BeenVerified removal route. Find your matching record in the opt-out search.

Status: Not started _ Pending Verified removed / opted out _ No match Not applicable _ Blocked _

Submitted _ Confirmed _ Checked ____

Listing / case reference ______

Next action ____ Next check date __

InfoTracer

• InfoTracer removal route.

Status: Not started _ Pending Verified removed / opted out _ No match Not applicable _ Blocked _

Submitted _ Confirmed _ Checked ____

Listing / case reference ______

Next action ____ Next check date __

Intelius

• Intelius removal route. Follow any official redirect to its current privacy-request service.

Status: Not started _ Pending Verified removed / opted out _ No match Not applicable _ Blocked _

Submitted _ Confirmed _ Checked ____

Listing / case reference ______

Next action ____ Next check date __

LexisNexis — privacy or safety suppression

• LexisNexis — privacy or safety suppression removal route. Choose Your Privacy Rights or the safety-suppression route that fits your eligibility.

Status: Not started _ Pending Verified removed / opted out _ No match Not applicable _ Blocked _

Submitted _ Confirmed _ Checked ____

Listing / case reference ______

Next action ____ Next check date __

LexisNexis Marketing

• LexisNexis Marketing removal route. Choose Request Opt-Out/Opt-In → direct-marketing opt-out.

Status: Not started _ Pending Verified removed / opted out _ No match Not applicable _ Blocked _

Submitted _ Confirmed _ Checked ____

Listing / case reference ______

Next action ____ Next check date __

MyLife

• MyLife removal route. Use the homepage footer’s Privacy or Do Not Sell/Share link.

Status: Not started _ Pending Verified removed / opted out _ No match Not applicable _ Blocked _

Submitted _ Confirmed _ Checked ____

Listing / case reference ______

Next action ____ Next check date __

Radaris

• Radaris removal route. Follow the site’s removal instructions.

Status: Not started _ Pending Verified removed / opted out _ No match Not applicable _ Blocked _

Submitted _ Confirmed _ Checked ____

Listing / case reference ______

Next action ____ Next check date __

Spokeo

• Spokeo removal route. Have your matching profile URL ready if requested.

Status: Not started _ Pending Verified removed / opted out _ No match Not applicable _ Blocked _

Submitted _ Confirmed _ Checked ____

Listing / case reference ______

Next action ____ Next check date __

TruePeopleSearch

• TruePeopleSearch removal route.

Status: Not started _ Pending Verified removed / opted out _ No match Not applicable _ Blocked _

Submitted _ Confirmed _ Checked ____

Listing / case reference ______

Next action ____ Next check date __

Whitepages

• Whitepages removal route. Have your matching profile URL ready if requested.

Status: Not started _ Pending Verified removed / opted out _ No match Not applicable _ Blocked _

Submitted _ Confirmed _ Checked ____

Listing / case reference ______

Next action ____ Next check date __

More sites to check

FastPeopleSearch

• FastPeopleSearch removal route.

Status: Not started _ Pending Verified removed / opted out _ No match Not applicable _ Blocked _

Submitted _ Confirmed _ Checked ____

Listing / case reference ______

Next action ____ Next check date __

FamilyTreeNow

• FamilyTreeNow removal route.

Status: Not started _ Pending Verified removed / opted out _ No match Not applicable _ Blocked _

Submitted _ Confirmed _ Checked ____

Listing / case reference ______

Next action ____ Next check date __

That’s Them

• That’s Them removal route.

Status: Not started _ Pending Verified removed / opted out _ No match Not applicable _ Blocked _

Submitted _ Confirmed _ Checked ____

Listing / case reference ______

Next action ____ Next check date __

USPhoneBook

• USPhoneBook removal route.

Status: Not started _ Pending Verified removed / opted out _ No match Not applicable _ Blocked _

Submitted _ Confirmed _ Checked ____

Listing / case reference ______

Next action ____ Next check date __

Optional — find additional listings

• Search your quoted full name and city, then your phone and email; do not search passwords or full government-ID numbers.
• Record matching URLs, request removal through each site’s official route, complete confirmation and assign follow-up dates.
• Copy a tracking entry above for each additional or duplicate listing.

Request removal of eligible Google results

• Open Google’s Results about you instructions. Follow its link to Results about you, or in the Google app open your profile picture → Results about you if available.
• If you choose monitoring, enter only the details you want Google to look for and review the offered notification options. Skip monitoring if you do not want to supply those details.
• For a matching result, request removal through the offered result controls. If the feature is unavailable, use Google’s detailed personal-information removal form. Supply the exact source URLs and requested evidence.
• Record each request separately from the source-site request. Check its status and any response; if denied, read the reason before resubmitting with corrected or additional information.

Refresh results after the source changes

• Confirm the source page no longer displays the information you wanted removed.
• If Google still displays old information, open Google’s Refresh outdated content instructions and choose Request refresh.
• Enter the affected page URL, follow the prompts, submit, and record the request. Recheck the search result after Google processes it.

Reduce what your own profiles publish

• Open Google Account → Personal info → Choose what others see → Go to About me. Set personal contact details and birthday visibility to Only you where offered. If your layout differs, look for About me under People & sharing.
• Pick the two other public profiles you use most. Open each profile’s editing controls. Remove your home address, personal phone, full birthday and daily location details from public bios or contact fields unless you deliberately need them public.
• Inspect the last five public posts or photos on each profile. Delete, edit or restrict posts exposing your home, school, routine or current whereabouts. Ask others to remove public posts revealing those details where necessary.
• Open each profile’s public URL while signed out and check what a visitor can see. Record any field or post that still needs attention.

Track results and set follow-up dates

• For every request, record the site, source URL, submission and confirmation dates, current status, next action and next check date. Keep search-engine requests on separate rows from source removal.
• Schedule a check for the date the provider states. If it gives no date, set your own reminder for two weeks from submission; this is a follow-up reminder, not a promised turnaround.
• Add a recurring reminder every three months to repeat the searches and inspect previously removed listings. Repeat after a move or name change.
• For persistent records, return to the site’s official privacy support with your case number and exact URL. Record the response and any revised next step.

California residents — optional DROP request

• Open California DROP, confirm eligibility, and review the verification requirements.
• If eligible, choose Get started with DROP, complete verification and submit a request.
• Store the request reference privately; use Check DROP status to track progress and record follow-up dates.
• If not eligible, mark this section not applicable.

Optional — choose paid help

• Compare covered sites with this checklist; identify uncovered sites to handle yourself.
• Check repeat scans, resubmissions and reports of verified outcomes.
• Read total cost, renewal pricing, trial billing date, cancellation and household coverage.
• Review required personal information, authorization and data-deletion terms; decide separately on optional inbox access.
• If subscribing, record the renewal/cancellation reminder and first report-review date.
• Track uncovered sites yourself and check the first progress report.

Service ____ Uncovered sites ______

First report check _ Renewal / cancellation reminder _

Money sent or an unfamiliar transaction

• Call the bank, card issuer or payment provider using its usual app or the number on your card.
• Say “I need to report fraud and stop a payment.” Give the date, amount, method and recipient.
• Explain whether the payment was unauthorized or you were tricked into authorizing it.
• Ask about stopping or recalling it, blocking more misuse and the dispute deadline.
• Save the case number, receipts, messages and transaction IDs.
• For gift cards, contact the issuer and keep the card and receipt.

Account takeover or an exposed password

• Use a trusted device and the provider’s official recovery process to regain access.
• Change the password at the real account and anywhere it was reused.
• End unfamiliar sessions and remove unauthorized recovery details or sign-in methods.
• Remove unfamiliar forwarding rules, filters, connected apps and app passwords.
• Enable or repair two-step sign-in and test access while keeping the trusted session open.
• Warn affected contacts through a separate trusted channel.

Remote device access or locked files

• Disconnect Wi-Fi, mobile data and network cables on the affected device.
• Keep backup drives disconnected.
• From another trusted device, contact affected banks and secure exposed accounts.
• Record the remote-access tool or ransom message before erasing anything.
• Arrange help through the maker’s official support or someone you already trust.
• Keep the device offline until checked and recovered. Decline ransom demands.

Missing phone or suspected number takeover

• iPhone — open iCloud.com/find, select the phone and use Mark as Lost.
• Android — open android.com/find, select the phone and use Mark as lost.
• Call your mobile carrier through its official contact details and ask it to secure your number.
• Revoke the missing device’s sessions for email and financial accounts where possible.
• Use a saved backup sign-in method to regain access.
• Read the lost-device instructions before remote erasure or removing the phone from the account.
• Report theft to local police. Avoid confronting someone at a map location.

Identity misuse and follow-up

• Contact affected providers’ fraud departments and ask about closing fraudulent accounts and disputing charges.
• Freeze all three nationwide credit reports and review them for unfamiliar accounts.
• Report identity theft at IdentityTheft.gov and follow its recovery plan.
• Record dates, case numbers and deadlines in a private incident log.
• Report scams at ReportFraud.ftc.gov and internet crime at IC3.gov.
• Report a fraudulent unemployment claim to the relevant state agency using the Department of Labor’s official directory.
• Add calendar reminders for the deadlines each organization gives you.