4 ways to protect your personal data from Musk’s DOGE
Americans across all political stripes were understandably concerned when news broke that Elon Musk, the unelected head of the so-called Department of Government Efficiency (DOGE), had gained access to the U.S. Treasury Department’s payment systems. These payment systems are responsible for trillions of dollars in federal payments, including things like Social Security benefits and tax refunds.
DOGE has felt fishy from the start, a blatant branding stunt that blurs the line between private investment and public interest by advertising Musk’s investment in Dogecoin. Knowing that Musk and his crew of DOGEbags are pursuing deep access to the Treasury Department and its troves of data has led to a number of questions (some, perhaps, a tad paranoid):
What exactly do they plan to do with my private information?
What personal data is stored in these systems and is any of it from my incognito browsing?
Couldn’t the world’s richest man find better things to do with his time?
Musk’s ability to access personally identifiable information (PII) from the Treasury Department and other federal agencies is in flux, with the courts weighing in on the legality of that access. That doesn’t mean your personal and financial information is necessarily safe—either from this current threat or from any data breaches in the future.
Here’s what you can do to protect yourself and your finances from the prying eyes of DOGE.
Know what information is vulnerable
The U.S. Treasury’s payment system handles the outlay of federal funds, including federal grants, Social Security and Medicare payments, tax information, and payments to federal contractors. Anyone who has received any of these types of federal dollars (which is pretty much everyone) has their personal information stored on the database.
Specifically, the database holds Social Security numbers, tax information, and bank account numbers (for direct deposit of tax refunds, Social Security payments, and other payments).
To be clear, the U.S. Treasury Department’s payment system is not the only place where this kind of personal information is stored—so it’s prudent to protect yourself even if “no classified material was accessed without proper security clearances,” as the DOGE claimed on February 2, 2025.
How to DOGE-proof your data
There are several actions that will help keep you safe, even if any of your personal information falls into the wrong hands.
Open a my Social Security account
Most policy and financial experts are not worried about the possibility of a Social Security payment breach. If you are currently receiving Social Security benefits, there is no reason to believe your payments are in jeopardy due to DOGE access to the U.S. Treasury.
However, a stolen Social Security number could allow an identity thief to open a my Social Security web account in your name and potentially steal your benefits. The my Social Security web portal allows you to check your earnings history, estimate future benefits, and manage current benefits (which includes setting up direct deposit).
It’s not exactly easy for hackers to access your Social Security benefits, even if they have your Social Security number. The my Social Security web portal takes data safety seriously and uses various tools to verify your identity, including information from your credit reports. So an identity thief would need to have that information, in addition to your SSN, to open an account in your name. But it is still prudent (and helpful) to establish your account now, as it will ensure that no one else opens an account in your name.
One important note: If you have already frozen your credit (more on that below), you will need to temporarily unfreeze it to establish your account.
Set up an IRS.gov account
Scammers with your personal information may also attempt to file a fraudulent tax return in your name to claim a refund. The IRS has identified this as a growing problem over the past few years, with over one million tax returns flagged as potentially fraudulent during the 2023 tax season.
Setting up an online individual account with IRS.gov can help ensure that you are the only person filing taxes in your name. This kind of account can also allow you to access your tax records, manage payments, and get virtual assistance.
For further security, you can also request an identity protection PIN (IP PIN) from the IRS. This is a six-digit number assigned to you at the beginning of the tax season that you may use to file your taxes instead of your Social Security number. The IP PIN is only shared with you, and you will need to provide it when filing your tax return to verify your identity. The IP PIN is also only valid for one calendar year, so you must request a new one each tax season.
If you have your IRS.gov online individual account set up, there is a link to request an IP PIN through that portal.
Freeze your credit
Freezing your credit means that no one, not even you, can open new credit in your name.
(The fact that you’re included in the freeze comes in handy when you’re tempted by impulse credit. You’ll actually be relieved when the cashier denies your Kohl’s credit card application, 20% discount be damned. Ask me how I know this.)
With frozen credit, even if identity thieves have your personal information, they can’t open an account in your name. Credit freezes last indefinitely, which means you don’t have to worry about renewing the chill. However, you do need to unfreeze your credit anytime you want to open a new line of credit. The credit bureaus allow you to “thaw” your credit for a specific time frame, after which point the freeze goes back into effect. These time frames can be as short as a day.
To freeze your credit, go to each of the three nationwide credit bureau websites and follow their prompts:
Practice good password hygiene
If you’ve been using Bandit1993 as your password for everything, it’s time to change it—whether or not the U.S. Treasury Department has access to your bank account. Passwords that use pet names, important dates, your mother’s maiden name, or the name of your favorite Toad the Wet Sprocket album (Dulcinea, of course!) are just too easy to guess. And though reusing passwords may feel like a timesaver, it leaves all your accounts vulnerable to any sketchy characters lurking among real TtWS enthusiasts.
Good password hygiene requires a unique, strong password for every account. Passwords made up of a random string of 16 or more characters are the most secure, but it would be literally impossible to remember such passwords for every account.
Cybersecurity experts suggest creating passphrases—a memorable phrase made up of several unrelated words—to use as passwords. These can be especially secure if you replace some letters with numbers or symbols. For example, you might choose the words watch, mirror, eclair, and limb, and create the following passphrase: W@tchMirr0rEcl@irL!mb.
If you want to hit the easy button on password security, you can ensure unique and strong passwords with a password manager. Just don’t use Bandit1993 as your master password for the manager.
Death, taxes, and security breaches
The particular security threat posed by DOGE may be novel, but it’s a good idea to remember that our information is always vulnerable in one way or another. Some proactive strategies can protect your Social Security number, tax information, and bank account from a variety of threats.
Specifically, opening accounts with my Social Security and IRS.gov can prevent fraudsters from accessing benefits and tax refunds in your name, while requesting an identity protection PIN (IP PIN) from the IRS every tax season offers further protection from identity thieves.
Freezing your credit prevents anyone—including you—from opening new credit in your name. The credit bureaus make it easy to freeze and unfreeze your credit on their websites.
And using strong, unique passwords on all your accounts is the best way to keep your information secure. Since remembering random strings of characters is impossible, use a password manager to handle the recall for you.
The fact that, via DOGE, an unelected billionaire has access to our sensitive data is rage-inducing, but we do have the power to protect ourselves.