As of mid-Friday the number of states whose attorneys general have joined the multi-state investigation into the massive Experian data breach is four: less than a week after Illinois and Connecticut started the investigation, Iowa and North Carolina signed on.
This number is likely to grow but in the meantime, pretty much all Americans (not just residents of those four states) need to give their finances a level of scrutiny which, in their grandparents' day, probably would've indicated an unhealthy level of obsessiveness.
For example: if you have a credit, debit or prepaid card, you already know to carefully scrutinize every line item on your bill at the end of each month, to detect any fraudulent charges. (Pay special attention to minor charges; many successful credit-card scammers manage to operate undetected for a long time by posting small, random-sounding amounts — $7.22, $2.97, $3.34 — which credit card holders are most likely to mistake for legitimate purchases.)
Check it daily
But in light of the Experian data breach, you should check your card balance and account activity every day, whether you've used it recently or not.
The nasty irony is that before last October, when news of the Experian breach first broke, anytime you'd read an article on the theme “Hackers entered a database with your info on it; here's how to protect yourself from identity theft,” it almost always advised you to protect yourself by contacting one of the three major credit-monitoring agencies, including Experian. So there's an undetermined number of Americans out there who, in trying to protect themselves from identity theft, wound up victims of it instead.
And there's not much you can do to protect yourself; once a company or organization puts your information into its database, you have little to no control over they do with it afterwards.
If your identity is stolen (an entirely different matter from credit card fraud), chances are you'll discover it at an extremely inconvenient time – say, when you trying filing your tax return and the IRS tells you somebody already filed your taxes (or collected your refund) for you.
Or you apply for a loan — mortgage, car, credit card — and discover that someone already took out one or more loans in your name, and hasn't repaid a single one.
Good news, bad news
The good news is that you are not expected to repay these fraudulent debts in your name. (Although you might not want to think too hard about the implications of that statement: “I never applied for any loans, I had no part in them, said loans were entirely the screwup of financial entities vastly richer and more powerful than I am—and the 'good news' is, I'm not on the hook to pay for their mistakes?”)
The bad news is that, while you need not spend money, you will have to spend a lot of time straightening out the whole mess, what with collecting paperwork, making phone calls, filing police reports and so forth. Meanwhile, the company or companies whose carelessness inflicted these problems on you is not obligated to compensate you for your time and aggravation.
“Protect yourself from identity theft” is basically another way of saying “Protect yourself from the negligence of others, for you have little recourse otherwise.”