39 SHARES 
 
 In recent years, many Americans’ personal information has become compromised by big data breaches. In 2018 alone, prominent companies like Adidas, Best Buy, Delta, Kmart, Macy’s and Sears have fallen victim to cybercriminals. According to the Identity Theft Resource Center’s most recent Data Breach Report, between January 1, 2005 and August 31, 2018, there have been 9,395 breaches. That accounts for over 1.1 billion records compromised. 
 
 The federal government and various businesses in recent years have taken more aggressive measures to build up our defenses. The Trump administration recently released a new cybersecurity plan, including taking more offensive measures toward foreign cyberattacks. Despite this, criminal strategies continue to evolve and grow in sophistication, keeping consumers vulnerable to identity theft and fraud. 
 
 But some Americans are more susceptible than others to such crimes. In order to determine who is most likely to be exposed to and affected by identity theft and fraud, WalletHub compared the 50 states and the District of Columbia across ten key metrics. Our data set ranges from identity-theft complaints per capita to average loss amount due to fraud. Read on for our findings, tips for protecting your personal information and a full description of our methodology. 
 
 Main Findings 
 
 States With the Most Identity Theft & Fraud 
 
 Overall Rank* State Total Score ‘Identity Theft’ Rank ‘Fraud’ Rank ‘Policy’ Rank 1 Nevada 72.66 2 5 27 2 Florida 69.11 12 2 27 3 New Jersey 68.52 1 25 5 4 Delaware 68.34 21 1 50 5 California 64.12 6 17 16 6 District of Columbia 63.89 20 3 5 7 New York 62.17 9 15 27 8 West Virginia 62.10 8 29 5 9 Michigan 61.71 10 13 41 10 North Dakota 61.64 4 37 5 11 Ohio 61.44 3 41 41 12 Maryland 59.60 7 19 51 13 Illinois 59.39 5 40 18 14 New Mexico 59.38 13 21 27 15 Colorado 59.20 14 14 41 16 South Carolina 57.83 22 9 41 17 Texas 57.72 18 12 27 18 Oregon 57.06 33 4 18 19 Tennessee 56.85 26 8 27 20 Georgia 56.36 23 10 27 21 Arizona 56.35 17 16 41 22 North Carolina 56.16 31 6 27 23 Pennsylvania 55.63 24 23 1 24 Minnesota 55.62 19 28 5 25 Virginia 55.28 25 11 18 26 Oklahoma 55.09 15 44 5 27 Nebraska 54.87 11 51 18 28 New Hampshire 53.70 30 20 1 29 Massachusetts 53.34 16 48 5 30 Missouri 51.04 32 27 1 31 Alabama 50.22 46 7 5 32 Rhode Island 49.86 28 47 4 33 Washington 49.32 27 38 18 34 Mississippi 48.91 34 18 18 35 Connecticut 48.16 29 36 27 36 Louisiana 46.48 39 22 18 37 Utah 45.49 36 30 27 38 Idaho 45.48 37 43 5 39 Alaska 44.38 38 39 18 40 Arkansas 43.35 35 45 41 41 Kansas 42.95 40 31 41 42 Wyoming 42.78 44 32 5 43 Montana 42.72 41 42 27 44 Indiana 42.35 47 24 27 45 Kentucky 41.83 45 35 16 46 Wisconsin 41.25 43 33 27 47 Maine 40.42 49 46 5 48 Iowa 39.25 42 49 41 49 Vermont 38.86 50 34 27 50 South Dakota 37.85 51 26 18 51 Hawaii 36.79 48 50 41 
 
 
 
 *No. 1 = Most Vulnerable 
 
 Quick Tips for Avoiding Identity Theft & Fraud 
 
 Emphasize Email Security : It’s obviously important to use strong passwords for all financial accounts, but you may not realize how essential it is to focus on email. Your primary email address will likely serve as your username and means of resetting your password on other websites. If it’s vulnerable, all of your other accounts will be, too. As a result, make sure to use an especially secure password and establish two-step verification for this account. 
 
 : It’s obviously important to use strong passwords for all financial accounts, but you may not realize how essential it is to focus on email. Your primary email address will likely serve as your username and means of resetting your password on other websites. If it’s vulnerable, all of your other accounts will be, too. As a result, make sure to use an especially secure password and establish two-step verification for this account. Sign Up for Credit Monitoring : Credit monitoring is the best way to keep tabs on your credit report. It provides peace of mind in the form of alerts about important changes to your file, including potential signs of identity theft. WalletHub offers free monitoring of your TransUnion credit report. 
 
 : Credit monitoring is the best way to keep tabs on your credit report. It provides peace of mind in the form of alerts about important changes to your file, including potential signs of identity theft. WalletHub offers free monitoring of your TransUnion credit report. Leverage Account Alerts & Update Contact Info : Setting up online management for all of your financial accounts (e.g., credit cards, loans, Social Security), and keeping your phone number, email address and street address up to date will make them harder for identity thieves to hijack. Establishing alerts for changes to your contact info and other suspicious account activity will serve as a safeguard. 
 
 : Setting up online management for all of your financial accounts (e.g., credit cards, loans, Social Security), and keeping your phone number, email address and street address up to date will make them harder for identity thieves to hijack. Establishing alerts for changes to your contact info and other suspicious account activity will serve as a safeguard. Use Common Sense Online: Don’t open emails you don’t recognize. Don’t download files from untrustworthy sources. Don’t send account numbers and passwords via email or messenger applications. And don’t enter financial or personal information into websites that lack the “https” prefix in their URLs. 
 
 For more tips and information, check out WalletHub’s Identity Theft Guide. 
 
 Ask the Experts 
 
 As a cyber-oriented culture, it’s natural to wonder whether and how our daily habits assist hackers in stealing our personal information. We consulted a panel of experts for answers to such questions and advice on how to safeguard our data against cybercriminals. Click on the experts’ profiles to read their bios and thoughts on the following key questions: 
 
 What can individuals do to guard against identity theft? How should consumers choose among third-party providers offering services to protect their identity and personal data? Should victims of identity theft be able to change their Social Security number? How can we make this number more difficult to steal and use (e.g., add more digits)? Is the recent expansion of social media facilitating identity thefts? Should the federal government intervene to establish a clear process for victims of identity theft looking to clear their name? What measures can authorities undertake in order to avoid cases like the recent Equifax leaks? Should credit bureaus be tested for security breaches by authorities on a regular basis? If so, would the Consumer Financial Protection Bureau play a larger role in regulation and enforcement of bureaus? 
 
 Methodology 
 
 In order to determine where American consumers are most vulnerable to identity theft and fraud, WalletHub compared the 50 states and the District of Columbia across three key dimensions: 1) Identity Theft, 2) Fraud and 3) Policy. 
 
 We evaluated those dimensions using ten key metrics, which are listed below with their corresponding weights. Each metric was graded on a 100-point scale, with a score of 100 representing the most vulnerable. 
 
 Finally, we determined each state and the District’s weighted average across all metrics to calculate its total score and used the resulting scores to rank-order our sample. 
 
 Identity Theft – Total Points: 47.5 
 
 Identity-Theft Complaints per Capita: Full Weight (~23.75 Points) 
 
 Average Loss Amount Due to Online Identity Theft: Full Weight (~23.75 Points) 
 
 Note: This metric was calculated using the following formula: Total Loss Amount / Total Number of Online Identity-Theft Complaints. 
 
 Fraud – Total Points: 47.5 
 
 Fraud & Other Complaints per Capita: Full Weight (~11.88 Points) 
 
 Median Loss Amount Due to Fraud: Full Weight (~11.88 Points) 
 
 Note: This metric was calculated using the following formula: Total Reported Amount Paid / Total Number of Complaints Stating the Amount Stolen. “Total reported amount paid” is based on the total number of fraud complaints for which the amount paid was reported by the victims. The amount paid ranges from $0 to $999,999. 
 
 Persons Arrested for Fraud per Capita: Full Weight (~11.88 Points) 
 
 E-Commerce Attack Rates: Full Weight (~11.88 Points) 
 
 Policy – Total Points: 5.0 
 
 Availability of Security-Freeze Law for Minors’ Credit Reports: Full Weight (~1.25 Points) 
 
 Note: This binary metric considers the presence or absence of legislation allowing parents, legal guardians or other representatives of minors to place a security freeze on the minor’s credit report. 
 
 Availability of Identity-Theft Passport Program : Full Weight (~1.25 Points) 
 
 Note: This binary metric considers the presence or absence of Identity-Theft Passport programs that help victims of identity theft reclaim their identity. When presented to a law-enforcement agency, an “identity-theft passport” allows a victim to prevent his or her arrest for offenses committed by an identity thief. 
 
 Compliance with REAL ID Act : Full Weight (~1.25 Points) 
 
 Note: According to the Department of Homeland Security, the REAL ID Act “establishes minimum security standards for license issuance and production and prohibits Federal agencies from accepting for certain purposes driver’s licenses and identification cards from states not meeting the Act’s minimum standards. The purposes covered by the Act are: accessing Federal facilities, entering nuclear power plants, and, boarding federally regulated commercial aircraft.” This binary metric considers a state’s compliance, noncompliance or extension of time to comply with the ACT. An extension allows a state to accept driver’s licenses and identification cards issued by that jurisdiction to accept those forms of identification for official purposes, under the condition that the state has provided adequate justification for noncompliance. 
 
 
 
 Data Disposal Laws by State : Full Weight (~1.25 Points) 
 
 Note: This is a binary metric that measures the presence or absence of data disposal laws in each state. Businesses and government collect personal information and store it in various formats-digital and paper. Several states have enacted laws that require entities to destroy, dispose or otherwise make personal information unreadable or undecipherable. 
 
 
 
 Videos for News Use: 
 
 
 
 Sources: Data used to create this ranking were collected from the Federal Trade Commission, Internet Crime Complaint Center, Federal Bureau of Investigation, Department of Homeland Security, Experian Information Solutions and National Conference of State Legislatures. 
 
 Image: alexskopje / Shutterstock.com 
 
 Was this article helpful? Yes No Awesome! Thanks for your feedback. Thank you for your feedback. Sorry! Failed to send the feedback. Please try again later. Submit ||||| Now Playing: Watch this: Equifax breach: Were you one of the 143 million affected? 
 
 One of the largest data breaches in history has left 143 million people wondering if their highly personal data has been exposed to hackers. For now, Equifax doesn't explicitly tell you if you were a victim, and in 99.99 percent of cases (yes, literally), it won't notify you by direct mail. But, if you're concerned you're vulnerable to identity theft because of the breach, this guide is for you. 
 
 Read more: Everything you need to know about the Equifax hack 
 
 But first: A quick recap 
 
 Equifax, one of the three major credit bureaus, lost control of customer data that included social security numbers, home addresses, credit card numbers, drivers license numbers and birth dates. The company estimates that the data of 143 million people were exposed, which equals roughly half the US population. That means that the chances you are affected are pretty high. 
 
 Even though Equifax set up a program to help people protect their potentially-exposed data, it might not give everyone complete confidence in keeping their identities secure. Here's why: 
 
 Equifax's enrollment program doesn't explicitly tell you if your data was a part of the breach. The company only makes it clear to those who weren't exposed. It's confusing. (We reached out to Equifax for comment and haven't heard back.) 
 
 The breach could have started as early as mid-May 2017. That means that the data of 143 million people were exposed for more than three months. It's unclear what the hackers did with the data during those months. 
 
 Those who would like to be prudent about protecting their identity might have to wait a week before they are officially enrolled in Equifax's protection program. For some, that's just not fast enough. 
 
 You don't have to wait to enroll in Equifax's program to start protecting yourself against the hack. Here's what you can do. 
 
 Step 1: Enroll in Equifax's program 
 
 Equifax's own identity protection program isn't perfect, but it will help ensure you're using every available resource to protect your identity. We put together a guide on how to follow the program here. Note that even if the enrollment tool indicates you weren't exposed, you're still eligible for a free one-year subscription to Equifax's protection services. (Not a bad idea given the frequency of breaches.) 
 
 Some language in the terms of service for Equifax's program, Trusted ID, have raised concerns that enrollment in the program prevents consumers from participating in a class-action lawsuit. CNET is looking into this and reached out to Equifax for comment. We'll update this story when we know more. 
 
 Step 2: Check your credit reports 
 
 More than three months passed between the time the breach may have started and now. We're not sure if the data of those affected was used maliciously during that period, so consider looking through your credit reports for any suspicious activity. The federal government guarantees everyone a free annual credit report from the three major bureaus -- yes, including Experian. You can get those reports here. 
 
 When looking through your reports, keep an eye out for new accounts you didn't open, late payments on debts you don't recognize and any other activity that looks unfamiliar. 
 
 If you suspect someone used your identity to open credit cards, take on loans, or re-open closed accounts, contact the credit card company's fraud department immediately. You are not responsible for charges made on a fraudulent card, but you have to report the issue in a timely manner. Once you've reported the fraudulent credit, follow this guide to recovering from identity theft. 
 
 Step 3: Freeze your credit 
 
 It's still early days, so even if your credit report comes back clean, remain vigilant about protecting your credit. One of the most reliable ways to prevent someone from opening credit cards in your name is to place what's called a "credit freeze." 
 
 When you freeze your credit, you (or anyone masquerading as you) will be required to un-freeze your account by providing the PIN you got when you froze your credit. 
 
 To freeze your credit, contact each of the credit bureaus using these phone numbers: 
 
 The process is usually automated and can be completed within a few minutes. Just be sure to write down your PINs in a secure place. 
 
 Step 4: Set a fraud alert 
 
 A fraud alert is another way to make it hard for identity thieves to open accounts in your name. When a fraud alert is set, credit card companies will be required to verify your identity before opening an account. That, combined with the credit freeze, is a great way to keep your credit secure. 
 
 To set a fraud alert, contact just one of the credit card bureaus and ask for an initial fraud alert. Once the alert is set, it will last 90 days. After that, you'll have to renew it. Here are the appropriate phone numbers for the bureaus (remember, just call one): 
 
 Step 5: Repeat the process for your loved ones 
 
 Because Equifax is not notifying those affected through direct mail or email, some people will be left without the resources or tech-savvy to protect their identities or find out if they were compromised. With that in mind, consider helping your loved ones -- especially the elderly without computer access -- with the above steps. 
 
 Watch out for tax season 
 
 It's still to early to know if and how the data exposed in Equifax's breach will be misused, but one major concern comes around during tax season. Identity thieves can use stolen social security numbers to file fraudulent tax returns and receive refunds. 
 
 Many victims find out they have been targeted in tax fraud when they try to file their taxes -- the IRS tells them that their taxes were already filed. One of the best ways to prevent this from happening is to file early. For more, the IRS has an easy-to-follow guide on tax fraud. ||||| Former Equifax CEO Richard Smith, who stepped down after the breach, endured a bipartisan shaming Tuesday at a hearing of a House Energy and Commerce subcommittee. | Chip Somodevilla/Getty Images IRS awards multimillion-dollar fraud-prevention contract to Equifax The no-bid contract was issued last week, as the company continued facing fallout from its massive security breach. 
 
 The IRS will pay Equifax $7.25 million to verify taxpayer identities and help prevent fraud under a no-bid contract issued last week, even as lawmakers lash the embattled company about a massive security breach that exposed personal information of as many as 145.5 million Americans. 
 
 A contract award for Equifax's data services was posted to the Federal Business Opportunities database Sept. 30 — the final day of the fiscal year. The credit agency will "verify taxpayer identity" and "assist in ongoing identity verification and validations" at the IRS, according to the award. 
 
 Story Continued Below 
 
 The notice describes the contract as a "sole source order," meaning Equifax is the only company deemed capable of providing the service. It says the order was issued to prevent a lapse in identity checks while officials resolve a dispute over a separate contract. 
 
 Lawmakers on both sides of the aisle blasted the IRS decision. 
 
 "In the wake of one of the most massive data breaches in a decade, it’s irresponsible for the IRS to turn over millions in taxpayer dollars to a company that has yet to offer a succinct answer on how at least 145 million Americans had personally identifiable information exposed," Senate Finance Chairman Orrin Hatch (R-Utah) told POLITICO in a statement. 
 
 The committee's ranking member, Sen. Ron Wyden (D-Ore.), piled on: "The Finance Committee will be looking into why Equifax was the only company to apply for and be rewarded with this. I will continue to take every measure possible to prevent taxpayer data from being compromised as this arrangement moves forward.” 
 
 Morning Tax Sign up for our tax policy newsletter and stay informed — weekday mornings, in your inbox. Email Sign Up By signing up you agree to receive email newsletters or alerts from POLITICO. You can unsubscribe at any time. 
 
 The IRS defended its decision in a statement, saying that Equifax told the agency that none of its data was involved in the breach and that Equifax already provides similar services to the IRS under a previous contract. 
 
 "Following an internal review and an on-site visit with Equifax, the IRS believes the service Equifax provided does not pose a risk to IRS data or systems," the statement reads. "At this time, we have seen no indications of tax fraud related to the Equifax breach, but we will continue to closely monitor the situation." 
 
 Equifax did not respond to requests for comment. 
 
 Equifax disclosed a cybersecurity breach in September that potentially compromised the personal information, including Social Security numbers, of more than 145 million Americans — data that security experts have described as the crown jewels for identity thieves. The company is one of three major credit reporting bureaus whose data determine whether consumers qualify for mortgages, auto loans, credit cards and other financial commitments. 
 
 The company has subsequently taken criticism for issuing confusing instructions to consumers, which contained language that appeared aimed at limiting customers' ability to sue, as well as tweeting out a link to a fake website instead of its own security site. The Justice Department later opened a criminal investigation into three Equifax executives who sold almost $1.8 million of their company stock before the breach was publicly disclosed, Bloomberg has reported. 
 
 Former Equifax CEO Richard Smith, who stepped down after the breach, endured a bipartisan shaming Tuesday at a hearing of a House Energy and Commerce subcommittee. The full committee's Republican chairman, Greg Walden of Oregon, proclaimed: "It's like the guards at Fort Knox forgot to lock the doors." 
 
 Reps. Suzan DelBene (D-Wash.) and Earl Blumenauer (D-Ore.) separately penned letters to IRS Commissioner John Koskinen demanding he explain the agency's rationale for awarding the contract to Equifax and provide information on any alternatives the agency considered. 
 
 "I was initially under the impression that my staff was sharing a copy of the Onion, until I realized this story was, in fact, true," Blumenauer wrote. 
 
 The IRS, which has suffered its own embarrassing data breaches as well as a tidal wave of tax-identity fraud, has taken steps to improve its outdated information technology with the help of $106.4 million that Congress earmarked for cybersecurity upgrades and identity theft prevention efforts. 
 
 Hatch questioned the agency's security systems in a letter to Koskinen last month. Hatch said he was concerned that the IRS lacked the technology necessary "to safeguard the integrity of our tax administration system."
– Given the recent Equifax security breach—alongside a 630% increase in data breaches in the past year, according to one report—identity theft is bound to be a concern for many Americans. But it turns out the state you call home has a lot to do with your risk. WalletHub reviewed identity theft and fraud complaints and policy across the US to come up with the most vulnerable states.