Yes. I think I shared on here before I had my identity stolen and since used maliciously 2x. In summary I would get one of those protection apps (I use Aura), change every single password and as many user IDs as you can, and also lock down his credit with all three credit bureaus…more on that below.
First someone tried to get a bank loan. They had my name, address, social, etc. the only way I found out is my Amex card reported a credit check. When I looked I saw it was Bank of America and got it sorted before any damage was done.
I then researched and chose Aura as a security app. They alert me whenever anything happens, breaches where my data is found, etc.
Fast forward 2 years - Aura alerts me of a credit check. Now I thought I had locked down my credit, but i had only locked one bureau (I thought they communicated so it locked all of them). Turns out it was a car dealer and someone was trying to get a loan for a car online.
The dealer sent me a pic of the photo ID…had all my details, just with a different photo. I got the guys phone number, etc. all of that is now in the hands of the police.
So yeah, getting your identity stolen sucks, but provided you lock your credit, keep good password discipline and get an app to watch over the rest he should be ok.