When I tried to log on to my Yahoo mail account, a message appeared stating that my password wasn't valid. The options for retrieving a forgotten password didn't work, either (my zip code was rejected). I also can't log on to my EBay account (where, coincidentally, I use the same user name and password).

Dane Matsushita, Renton, Washington

Try the simple solution first: Make sure your <Caps Lock> key isn't active. Most security-minded sites use case-sensitive passwords; if your <Caps Lock> is on, your password will be rejected.

If that doesn't solve the problem, you're almost certainly the victim of identity theft. What gives it away are the zip code and the lost access to two accounts that use the same password. If you lose access to only one site, it could be something less scary--such as a failed attempt to steal your identity. Sometimes a site will shut down your account because of suspicious activity before real harm is done.

If a Web site's password stops working, and you know you didn't forget it, your first job is to visit any other sites where you use the same password. If you can still log on, change your password on those sites immediately. Next, contact credit-card companies whose account numbers you registered at the sites to which you can no longer log on, and cancel the accounts. Also let the companies know that you suspect you are the victim of identity theft.

At sites where your password no longer works, don't bother restoring a "forgotten" password. This usually creates a new password that's e-mailed to you. Since the culprits have almost certainly changed your account's contact information, requesting the password will do nothing except send an alert that you're on to them.

Instead, search the site for a way to contact an actual person at the company--a phone number, an e-mail address for customer service, or a Web-based form. Phone numbers are better--the response is quicker, and it's an emergency. Find someone associated with the site who can verify you are who you say you are and can fix the problem.

If there's no way to get in touch with such a person, let that account go and open another one--preferably with a firm that lets you contact a human being.

When it comes to identity theft, an ounce of prevention is worth much more than a pound of cure. So use a reliable firewall, antivirus program, and spyware checker. Visit this page on our site to learn more about PC security basics.

Avoid phishers' hooks. Delete e-mail that seems to come from your bank or another site you do business with and that asks you to send or update your personal info or to click a link to log on. Banks and e-commerce sites don't work this way.

Don't use passwords that are easy to break (you'd be surprised how simple it is for crackers to discover your kids' names). Use odd combinations of upper- and lowercase letters. Add numbers and symbols. Change your passwords regularly. And don't use the same password for more than one site. Click here to read Scott Spanbauer's October 2003 Internet Tips column, "Can You Pass the PC World Password Safety Test?"

A password manager stores multiple passwords so you don't have to memorize them. I recommend the free, open-source Password Safe program. It's easy to use, and it generates random passwords no one will ever guess (see FIGURE 1). All of your password data is safely Blowfish-encrypted (so that's one password you'd better remember).

Send your questions to answer@pcworld.com. We pay $50 for published items. Click here for more Answer Line columns. You'll find Contributing Editor Lincoln Spector's humorous and other writings at www.thelinkinspector.com