I think GP means create your account on these sites before a fraudster does it for you. I.e., if you already have an account, they need your login credentials to access your account. But, if you have not established an account, they can often establish a new account using nothing but publicly available data like your birthday and street address for identity verification, then access your data (IRS experienced a lot of fraudulent accounts being created to steal peoples' tax refunds; their new verification system is less susceptible, but IMO too invasive [biometric data]).