It’s just common sense that you shouldn’t carry around your social security card or bank PIN number in your wallet, and that you should lock up or shred any financially sensitive documents like credit card or bank statements. Yet, criminals are still able to gain access to these key pieces of personal identifying information and use them for their own illegal gain. Contrary to popular belief, the majority of identity theft does not start online. It comes from stolen mail, dumpster diving, and lost or stolen wallets.

Armed with your personal information (your name, address, birth date, etc.), the thief can commit check or credit card fraud, and even obtain a loan in your name. When the financial institution checks the personal information against the data at a national credit bureau, it sees no problem. The data the thief provided matches the official records.

Here’s how you can defend against basic identity theft, where the criminal steals your identity and then uses it to open a new credit account for their personal gain. Place an “Initial Fraud Alert” on all three of your credit reports (TransUnion, Equifax, and Experian). This can only be done if you feel your personal information has been compromised. The Initial Fraud Alert requires that lending institutions call you at the phone number listed on your credit report to confirm any new transactions. That should stop a thief from getting money in your name, but unfortunately the Initial Fraud Alert only lasts for 90 days.

Another form of identity theft is credit hijacking. That is when the criminal steals your identity in order to use your existing credit accounts. In order to protect against credit hijacking, many online merchants now use “Address Verification Service.” This security feature only approves credit card transactions for merchandise that is shipped to the same address as your credit card billing address. So far, so good. Until the thief calls up the bank, posing as you, and changes your billing address. An excellent defense against this scam is to establish a personal security code with all your bank accounts and credit cards. This code is a unique group of numbers and letters that you create, and then give to the financial institutions. Now when the thief tries to hijack your credit, the bank will ask for the personal security code, and he’ll be stopped cold. Of course, it’s critical that you keep this code truly secure.

In summary, if you establish an Initial Fraud Alert and a personal security code, you’ll be protected against the most common forms of identity theft. If a thief tries to open a new credit account in your name, the financial institution will call you for approval. And if the criminal tries to hijack your credit by changing your mailing address, the financial institution will ask for your personal security code. Game over.