Lock down your accounts

What we're defending against

In IT we call it account takeover. Someone gets your password, or enough of your personal details to talk their way past a help desk. Then they change where the money goes. VA has warned about exactly this. Thieves collect a veteran's personal details from social media, the dark web and old data breaches, then call VA's contact center and switch the direct deposit to a bank account or prepaid card they control.

You don't need to be an expert to stop it. You need three things. A sign-in that a phished password can't open. Your credit frozen. Your Social Security number off the street. The rest of this chapter walks through each one, then gives you a checklist for the weekend.

Source: VBA: Fraud prevention, direct deposit/payment redirection (checked 2026-10)

Signing in to VA.gov today

VA.gov and the VA: Health and Benefits app now use three sign-in providers: Login.gov (run by the U.S. government), ID.me and CLEAR (both private companies). VA no longer offers the old My HealtheVet user ID and password for sign-in (with rare temporary exceptions), and it no longer accepts DS Logon either. If you still have a DS Logon login, VA says it's only good for Defense Department sites now.

Verifying your identity is a one-time step, and both Login.gov and ID.me require a second sign-in factor. Pick one provider and set it up properly. Bookmark va.gov/sign-in and start there every time. Never start from a link in an email or text.

Sources: VA: Creating an account for VA.gov; VA News: Veterans get more time to transition to new online login system; VA News: Switch from DS Logon by September 30 (Aug 2025); VA.gov Design System: Sign-in terms (checked 2026-10)

Your second factor: not all are equal

A second factor means that a stolen password alone won't get anyone in. Here's how the options rank, strongest first:

• Passkey ("face or touch unlock") or a hardware security key. These are what we mean by phishing-resistant. They won't hand anything to a fake site, so a convincing phishing page gets nothing. Login.gov lists face or touch unlock, security keys and PIV/CAC cards as more secure against phishing and theft. VA notes that CLEAR uses passkeys.
• An authenticator app. It makes a new six-digit code every 30 seconds on your phone. It's much better than a text, but you can still be talked into reading the code to a scammer.
• A code by text message or email. Better than nothing. The FTC calls it the least secure type of two-factor authentication. Use something stronger when the site offers it.

Set up at least two methods so that losing your phone doesn't lock you out. Login.gov warns that it can't restore access if you lose every method. And no matter what the caller says, never read a sign-in code to anyone.

Sources: Login.gov: Authentication methods; FTC: Creating strong passwords and other ways to protect your accounts; CISA: Turn on MFA (checked 2026-10)

A password manager, and guard your email first

Nobody can remember forty strong, unique passwords. Don't try. Use a password manager, either the one built into your phone or browser or a well-reviewed third-party one, and give it one long passphrase you don't use anywhere else. Then guard your email harder than anything else. Whoever controls your email can reset every other password you have. VA also says not to build passwords or PINs from your SSN, your service dates or your birthday.

Sources: FTC: Creating strong passwords; CISA: Use strong passwords; VBA: Fraud prevention (checked 2026-10)

Freeze your credit, all three bureaus

A credit freeze stops anyone from opening new credit in your name, including you, until you lift it. It's free to place and free to lift, and it doesn't affect your credit score. You have to contact each bureau separately: Equifax, Experian and TransUnion. When you need to apply for a loan or card, thaw it online and freeze it again afterward. A fraud alert is a different, lighter tool. You call one bureau and it tells the other two. Still on active duty? Ask about the free active duty alert.

Source: FTC: Credit freezes and fraud alerts (checked 2026-10)

Your SSN, your DD-214 and your direct deposit

Social Security says not to carry your card, or any document that shows your number, unless you actually need it that day. That includes a folded DD-214 in your wallet. When a business asks for your SSN, ask why it's needed, how it will be used, and what happens if you say no. Shred old papers that show it. If you need a copy of your DD-214, it's free (see the previous chapter), so there's no reason to keep extra copies lying around.

Look at your VA direct deposit every few months. Sign in at VA.gov, open your profile, and confirm the bank and the last digits of the account number are yours. You can update deposit details there for disability compensation, pension and education payments. If a payment is missing or the account looks wrong, call VA at 1-800-827-1000 right away.

Sources: SSA Handbook §1402; SSA: Guard your card (June 2025); VA: Change your direct deposit information; VBA: Fraud prevention (checked 2026-10)

The first hour after you've been scammed

Don't sit on it, and don't be ashamed. Smart people get got every day. Speed matters more than pride.

1. Stop the money. Call your bank or card company using the number on the back of the card and ask them to reverse the charge. For gift cards, call the card issuer. For a wire, call the wire company. For a payment app, report it in the app. For crypto, contact the exchange. For cash you mailed, call the Postal Inspection Service at 1-877-876-2455.
2. If it touched VA money, call VA at 1-800-827-1000.
3. If you gave up a password, change it on that account and anywhere you reused it, then turn on two-factor authentication.
4. If you let someone onto your computer, disconnect it from the internet, run a security scan, then change your passwords from a different device.
5. If you gave out your SSN, freeze your credit at all three bureaus and follow the plan at IdentityTheft.gov.
6. Report it. ReportFraud.ftc.gov, plus the contacts in the previous chapter.

Sources: FTC: What to do if you were scammed; IdentityTheft.gov (checked 2026-10)

Do it this weekend: the 10-item checklist

1. Set up Login.gov or ID.me (or CLEAR) for VA.gov if you haven't, and bookmark va.gov/sign-in.
2. Add a passkey or security key to that account, plus a second backup method.
3. Install a password manager and give it one long passphrase you use nowhere else.
4. Lock down your main email: new unique password, plus an authenticator app or passkey.
5. Switch your bank and VA sign-in off text-message codes wherever a stronger option exists.
6. Freeze your credit at Equifax, Experian and TransUnion. It's free.
7. Sign in to VA.gov and confirm your direct deposit account is yours.
8. Take your Social Security card and any DD-214 copy out of your wallet and lock them up.
9. Save these numbers in your phone: VA 1-800-827-1000, VSAFE 833-388-7233, VA OIG 1-800-488-8244.
10. Walk one family member through this list, especially an older veteran or a surviving spouse.