What to Do if Your Information Is Found on the Dark Web

A person wearing a gray hoodie looks at multiple computer and tv displays showing dark web websites.

If you've heard of the dark web, you might be worried that criminals can use it to steal your identity and access accounts. And you have a valid reason for being concerned.

The dark web is a part of the internet that's a little more difficult to access than the rest of the internet, and there are dark web marketplaces where people sell illicit goods and information, including stolen accounts and personal details. If you find your information on the dark web, take immediate action to update your passwords, report any fraudulent credit card charges and secure your accounts.

You can check to see where your information appears with a free dark web scan. And while there might not be a simple way to get your information removed from the dark web, you can take measures to protect your accounts and identity.

1. Change Your Passwords

One of the first things you can do is make sure someone can't use your stolen login information to access your accounts. A simple way to do this is to change any passwords associated with accounts that are reportedly on the dark web.

If you use the same password—or similar password variations—for multiple accounts, you may want to change the other accounts' passwords as well. Use a strong password that can't be easily guessed or hacked, or consider using a password manager to create complex passwords for you.

2. Add Multifactor Authentication to Your Accounts

Multifactor authentication (MFA) is when an account requires you to verify your identity using two or more authentication methods. For example, you might have to enter a code sent to your phone when you try to log in to your bank account. By confirming the code, you're verifying that you know the username and password and have control of the phone associated with the account.

Adding MFA can help keep others out of your account even if your username and password are leaked on the dark web. Some accounts automatically require MFA, but others offer it as an optional feature. Sometimes, it won't be an option even if you want to enable MFA.

When you can turn it on, you may be able to choose from different types of authentication, such as receiving a text message or email, using your fingerprint, or using a code or push notification from an authentication app. In general, text message and email MFA are the least secure options, but they're still better than nothing.

3. Try to Add SIM-Swapping Protection to Your Phone

SIM swapping is when someone temporarily takes over your phone line using the same SIM swapping procedure that you'd use to activate a new phone. Criminals do this by tricking or paying off mobile phone carriers' employees. They then can have your text message MFA codes sent to a phone they control so they can access your accounts.

Some mobile phone carriers have a security feature that keeps your number from being ported to a new phone until you contact the company to disable the security. However, you may need to contact your carrier to activate the feature.

4. Report the Theft of Your Personal and Account Information

You may find that your personal information is being sold or shared online, including your:

  • Name and address
  • Social Security number
  • Driver's license and passport
  • Medical records and account numbers
  • Financial account numbers and details
  • Emails, usernames and passwords

Criminals can use this information in a variety of ways, such as to impersonate you or create a fake identity using your Social Security number. They may even make a driver's license or medical insurance card using your information and then use the documents if they're arrested or want to get a medical procedure.

You can report the theft of this information to the Federal Trade Commission on IdentityTheft.gov. You'll then receive a personalized plan with the next steps you can take based on what was stolen.

5. Freeze Your Credit

Freezing your credit reports with all three major credit bureaus―Experian, TransUnion and Equifax―can help keep someone else from opening an account in your name. Once your reports are frozen, creditors can't access your credit report to make new lending decisions. However, your report can still be accessed for other reasons, such as if your current creditor wants to review your report or if you want to check your credit.

You can freeze and unfreeze your credit for free and as often as you'd like, but you'll need to contact each credit bureau directly. Also, don't forget to unfreeze or temporarily "thaw" your reports when you apply for a new credit card or loan. If that seems like too much work, you can add a fraud alert to your credit report that asks lenders to verify your identity before approving credit in your name.

6. Stay Proactive

Having safety measures in place can help protect you from identity theft regardless of whether your information is on the dark web. Here's how:

  • Use a password manager. A password manager can help you create, securely store and fill in unique and strong passwords for all your accounts.
  • Learn how to detect social engineering. Many hacks and scams are successful because someone gets tricked into sharing their login or personal information with a fraudster. Detecting and avoiding phishing, smishing and vishing scams can be important for keeping your information and finances safe. One rule of thumb: Never click on a link or provide information in an email or text unless you have verified the sender's authenticity.
  • Get identity theft monitoring. Monitoring services, such as Experian IdentityWorksSM, can alert you if your personal information is detected in a variety of databases and if there are suspicious changes in your credit report. It also includes identity theft insurance, which can help you cover costs associated with recovering your identity.

Found Out What's Already Online

There are different tools you can use to see if your information is on the dark web, has been leaked in a data breach or is easily accessible on the surface (in other words, not dark) web. Experian's free dark web scan can look for your email address, phone number and Social Security number, and Experian's personal privacy scan can search for your information on people finder sites.

The purpose of this question submission tool is to provide general education on credit reporting. The Ask Experian team cannot respond to each question individually. However, if your question is of interest to a wide audience of consumers, the Experian team may include it in a future post and may also share responses in its social media outreach. If you have a question, others likely have the same question, too. By sharing your questions and our answers, we can help others as well.

Personal credit report disputes cannot be submitted through Ask Experian. To dispute information in your personal credit report, simply follow the instructions provided with it. Your personal credit report includes appropriate contact information including a website address, toll-free telephone number and mailing address.

To submit a dispute online visit Experian's Dispute Center. If you have a current copy of your personal credit report, simply enter the report number where indicated, and follow the instructions provided. If you do not have a current personal report, Experian will provide a free copy when you submit the information requested. Additionally, you may obtain a free copy of your report once a week through December 31, 2022 at AnnualCreditReport.