Eighteen. That's how many devices were connected to my home network the night I finally sat down and actually counted them, and I could only put a name to eleven. Seven strangers were sitting quietly inside my Wi-Fi, right next to my banking app and the payroll spreadsheet I still had open from work. My stomach dropped. One of them had named itself Living-Room-PC. I haven't owned a desktop computer since 2021, and for a second, identity theft stopped being something that happened to other people again.
After the six-thousand-dollar mess my family lived through in 2022 — my dad's IRS gift-card scam and my own cloned credit card at the gas pump — finding uninvited devices on my own network felt like walking into my kitchen and finding a stranger already sitting at the table. Identity theft prevention had become something I thought I'd already handled: freeze the credit, watch the statements, keep the binder current. I'd even signed up for a free year of monitoring through a data-breach settlement at one point, the kind that promises to watch the dark web for your information, and let it lapse without ever checking whether a single alert had fired. Turns out none of that mattered if the front door — the actual network everything else ran through — was standing wide open, no matter what any subscription's marketing page promised.
Why My Home Network Was a Security Blind Spot
As an HR manager, I handle sensitive payroll data and Social Security numbers for a few hundred employees every day, so I'd assumed I had this part figured out. Finding a stranger's device parked on my own Wi-Fi felt like showing up to teach a class and realizing you left your own classroom door unlocked overnight. If I couldn't keep an unnamed Android and an unknown PC off my own router, I had no business telling my parents their accounts were safe.
Deon — a coworker from HR who has weathered more than a few of my fraud panics with me — just laughed when I texted him a screenshot of the device list and said something like, "okay, so unplug the mystery ones first." His calm is aggravating in the best way, and it was exactly the push I needed instead of spiraling over what somebody might already have seen. None of what came next required a computer science degree, either — Wi-Fi security turned out to be closer to installing a better deadbolt than rewiring the whole house, and digital safety for two households ate one Saturday, not a total life overhaul.
WPA3 and the Password Nobody Changes
Getting to the router itself was almost anticlimactic — a factory reset held down for thirty seconds, and the whole thing started over from scratch. Most of us are still running the password the installer scribbled on a sticker years ago, which is roughly as secure as leaving the factory code on a home alarm panel. During that same weekend, when I redid my parents' network too, I moved both households over to WPA3 encryption. It's the newest version of Wi-Fi security, and if your router is more than a few years old, there's a decent chance it's still stuck on the older standard. Upgrading is closer to swapping a screen door for a solid one — it doesn't make you invisible, but it makes you a far less interesting target than the house two doors down still broadcasting a network named after its router brand.
Changing the admin password mattered just as much, maybe more, since that's the login controlling the router itself rather than just the guest Wi-Fi. Leaving it on the factory default is like leaving your house key sitting in the outdoor lock overnight — technically closed, but not actually secured. Every new password went straight into the same fraud binder I started after gift card scams and monitoring helped my father recover, written on paper, nowhere near anything with a Wi-Fi chip in it.
Dad's Printer Was Broadcasting Unsecured
The real surprise came at my parents' place, not mine. Their network still felt cluttered on the scanner app even after I thought I'd cleaned everything up, and it turned out my dad's old wireless printer was broadcasting its own unencrypted signal to anyone nearby. Anyone parked outside their building could have connected to that printer and worked their way sideways into everything else on the network.
Hackers rarely come in through the front window; they find the one gap you forgot existed, like a cat door nobody remembers unlocking. That printer was exactly that. We lock down the laptop and forget the smart fridge, the ancient printer, the light bulbs that haven't had a software update since sometime in the last decade. I turned off the printer's wireless entirely and ran a cheap USB cable to it instead. Nothing broadcasting means nothing to find.
Leaving WPS Turned On, On Purpose
Plenty of advice online says to switch off Wi-Fi Protected Setup the moment you set up a router, and for years I repeated that advice myself without questioning it much. Newer hardware changed my mind. The routers I installed for my parents have real protections against the brute-force guessing that made WPS notorious in the first place, and sometimes letting a new device connect through that built-in handshake is safer than typing a password into some cheap smart-home gadget's shaky interface.
I kept WPS on for my parents specifically so they can add a new tablet without calling me every time, but I made sure the router's lockout setting was active — enough failed PIN attempts and the whole thing locks for an hour. It's a trade between convenience and being locked down tight, and for two people who already call me about every software update, convenience won this round.
Three Things Worth Doing This Weekend
None of this has to happen in one panicked afternoon. Mine didn't, either. Start small this weekend. Open your router's app or web page and actually look at the connected-devices list; if something is labeled "unknown" or doesn't match anything in your house, block it before you do anything else (I once found a neighbor's smart TV had been piggybacking on my parents' signal for months). Put everything you don't fully trust — the smart TV, the thermostat, the kids' game console — on its own guest network with a separate password, so if one cheap smart bulb gets compromised, whoever's inside it stays stuck in that one lane instead of reaching the laptop with your tax returns on it. And check whether your router updates its own firmware automatically; those updates usually patch exactly the holes that let people in, and if yours doesn't have that option, it might be time to replace it.
Locking down the router only secures the perimeter, not the vault behind it. I've written separately about the steps to freeze your credit at all three bureaus for free, because even a locked-down network won't stop someone who already has your Social Security number some other way. This is a different job than the VPN advice you'll hear for airport or hotel Wi-Fi, by the way — out there, you're borrowing someone else's network and trying to hide your traffic from strangers sharing it with you, while at home the network is already yours, so the job is closing the doors, not disguising what's walking through them.
By the fourth week, the connected-devices list finally stopped surprising me — no new names, no mystery signals, just the same familiar list night after night. Around that same stretch, my dad's credit report came back unchanged for the first time in six months: no new inquiries, no accounts I didn't recognize, nothing to flag. I remember actually exhaling over that one, a longer breath than I realized I'd been holding. If there's one thing worth carrying out of all this, it's that identity protection isn't just about watching your credit files — it's about closing the door those files sit behind in the first place. Check the list this weekend. You'll either find nothing, which is its own kind of relief, or you'll find exactly what I found.