How to protect yourself from medical identity theft

How to protect yourself from medical identity theft

Medical identity theft happens when someone uses your name and insurance information to receive care. The bills go to your insurer. The treatments end up in your medical record. Here is what actually stops it, starting with the steps that cost nothing.

Medical identity theft is less talked about than credit card fraud and typically more damaging when it happens. It corrupts your medical record, which can affect the care you receive for years. It drains insurance benefits that cannot easily be replaced. And unlike financial identity theft, it often goes undetected for months because people do not review their medical claims the way they review bank statements.1

The good news is that the most effective protections are mostly free. Paid identity protection services add monitoring and recovery support. The free steps are what actually prevent the theft.

The free protections that matter most

Create and monitor your MyMedicare account

Go to medicare.gov today and create a MyMedicare account if you do not have one. This account shows every service billed to Medicare on your behalf, with the date, provider, and amount.2 Review the claims history quarterly at minimum. A bill for a service you did not receive, a provider you have never seen, or a date when you were not treated is the primary signal of medical identity theft.

The Medicare Summary Notice (MSN) is mailed quarterly to beneficiaries and contains the same information. Most people do not read it carefully. Start reading it carefully.

Place a credit freeze at all three bureaus

A credit freeze is free under federal law and prevents new accounts from being opened in your name without your explicit unfreeze.3 It does not affect your existing credit, your ability to use current cards, or your credit score. Place freezes at Equifax (equifax.com/personal/credit-report-services/credit-freeze), Experian (experian.com/freeze), and TransUnion (transunion.com/credit-freeze) separately. Each has its own process.

Medical identity theft often leads to fraudulent accounts being opened in the victim's name. A credit freeze stops that component. Unfreeze temporarily when you are legitimately opening new credit, then refreeze.

Protect your Medicare number like a financial account number

Your Medicare number is a high-value target because it provides access to a broad range of covered services.2 Do not carry your Medicare card in your wallet. Keep it at home and carry a photocopy with the last four digits visible and the rest obscured for routine appointments. Providers need enough to verify your identity. They do not need the full number readily accessible in a lost or stolen wallet.

Medicare will never call you to ask for your Medicare number. If someone calls claiming to be Medicare and asks for your number, hang up and call 1-800-MEDICARE to report it.

Get an IRS Identity Protection PIN

The IRS offers an Identity Protection PIN (IP PIN) that prevents someone from filing a tax return using your Social Security number. Medical identity theft often intersects with broader identity theft that includes tax fraud.1 Enroll at irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin. The PIN is issued annually each January and must be included on your tax return.

Paid identity protection services: how they compare

Paid services add dark web monitoring, automated alerts, and identity restoration support that the free steps do not provide. Here is how the main services compare in 2026.

ServiceMonthly CostWhat It MonitorsRestoration SupportBest ForLifeLock (Norton)$11.99-$34.99 / personCredit bureaus, dark web, court records, Social Security, bank and investment accounts at higher tiers$1M reimbursement insurance at top tier; U.S.-based restoration specialistsComprehensive coverage seekers; Norton device bundle usersAura$12-$37 / month (individual to family)Credit bureaus, dark web, financial accounts, Social Security, criminal records, home title monitoring at higher tiers$1M identity theft insurance; 24/7 U.S.-based support teamFamilies; people who want all-in-one including antivirus and VPNIdentity Guard$8.99-$29.99 / personDark web, credit bureaus (3-bureau at higher tiers), bank accounts, Social Security$1M identity theft insurance; White Glove fraud resolutionBudget-conscious users; IBM Watson-powered alertsExperian IdentityWorks$9.99-$19.99 / personExperian credit monitoring; dark web; Social Security number; court recordsUp to $1M insurance at premium tier; experian-based restorationExisting Experian customers; credit monitoring focusFree (DIY)$0Credit freezes at all 3 bureaus; MyMedicare.gov claims; IRS IP PIN; manual dark web checks at haveibeenpwned.comNone automatic; self-managedDisciplined self-monitors who will actually check quarterly

What paid services do that free steps do not

Paid identity protection services primarily provide three things that the free steps do not: automated dark web monitoring with alerts, three-bureau credit monitoring without requiring you to check manually, and identity restoration specialists who will manage the recovery process if theft occurs.4

The dark web monitoring is meaningful. Stolen credentials from healthcare data breaches circulate on dark web marketplaces, and early notification of your data appearing there allows faster action before accounts are opened. The services scan these marketplaces automatically and alert you within hours of a match.

The restoration support is the most significant value for people who do not want to navigate the recovery process alone. Reversing medical identity theft, disputing fraudulent medical records, and clearing fraudulent debt from a credit file is a process that takes 100 to 200 hours on average for a victim who does it themselves.1 A restoration specialist who handles this professionally can significantly reduce that burden.

What paid services do not do

No paid service prevents identity theft before it happens. They detect it and help you recover. The credit freeze, the Medicare account monitoring, and the Medicare number protection described above are preventive. Paid services are largely reactive.4

The $1 million identity theft insurance that most services advertise reimburses documented out-of-pocket losses such as legal fees, lost wages, and unauthorized charges. It does not pay a $1 million lump sum for the experience of having your identity stolen. Read the policy details before relying on that number.

The verdict: what to prioritize

Do the free steps first. They are more effective at prevention than any paid service and cost nothing. Credit freeze at all three bureaus. MyMedicare account created and quarterly monitoring habit established. Medicare number protected. IRS IP PIN enrolled.

Add a paid service if you want automated monitoring, three-bureau credit alerts without manual checking, or the assurance of a restoration specialist if something does go wrong. Aura and LifeLock are the two with the broadest coverage and strongest restoration support. Identity Guard is the best value for cost-conscious users who want the core monitoring features.

What to do next

This week: go to medicare.gov and log in to your MyMedicare account (or create one). Review the claims from the past 12 months. Then go to equifax.com, experian.com, and transunion.com and place a credit freeze at all three. Both tasks combined take under 30 minutes and represent the two highest-impact protective steps available.2

If anything in the Medicare claims history is unfamiliar, call 1-800-MEDICARE to report it and request an investigation. If any claims show services from providers you have never seen, that is the signal to escalate immediately to the Office of Inspector General at oig.hhs.gov.

Sources

1. Identity Theft Resource Center, 2025 Annual Data Breach Report: Healthcare sector statistics. idtheftcenter.org/publication/2025-annual-data-breach-report

2. Centers for Medicare and Medicaid Services, Protecting Your Medicare Number and Preventing Medical Identity Theft. cms.gov/about-cms/agency-information/aboutwebsite/fraud-and-abuse

3. Federal Trade Commission, Free Credit Freezes: How to place freezes at all three bureaus. consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts

4. Federal Trade Commission, Choosing an Identity Theft Protection Service. consumer.ftc.gov/articles/identity-theft-recovery-steps