Social Security Number Stolen? What to Do, Step by Step

If your Social Security number has been stolen, act on three fronts today: report it at IdentityTheft.gov (the Federal Trade Commission’s recovery site), place a free credit freeze with Equifax, Experian and TransUnion, and secure your tax and Social Security accounts so no one can open them in your name. Those steps block the most common ways a stolen number gets used, and they cost nothing.

Social security identity theft feels overwhelming because the number follows you for life and can’t simply be canceled like a credit card. The good news is that the damage usually comes from what someone does with the number, and most of those routes can be closed. This guide walks through the order to do things, what each agency actually handles, and the scams that often follow a data breach.

How a stolen Social Security number gets misused

Knowing the likely uses helps you decide where to look for damage. A stolen number on its own is a risk; a number combined with your name, date of birth and address is what criminals actually want.

• New credit. Opening credit cards, loans or phone contracts in your name. This is the most common and the one a credit freeze is designed to stop.
• Tax refund fraud. Filing a tax return in your name early in the season to collect a refund before you file.
• Employment. Someone uses your number to work, which can show up as income you never earned on your tax records or your Social Security earnings record.
• Benefits fraud. Attempts to claim or redirect government benefits, including Social Security payments.
• Medical identity theft. Getting treatment or prescriptions billed to your insurance, which can also put wrong information in your medical records.
• Account takeover. Using your number to pass identity checks on existing bank, phone or online accounts.

You may not know which of these is happening yet. That is fine. The steps below cover all of them.

What to do first: the first 24 hours

1. Freeze your credit at all three bureaus. Contact Equifax, Experian and TransUnion separately and request a security freeze. Federal law makes freezes free, and a freeze stops most lenders from pulling your report, which blocks most new-account fraud. You can lift it temporarily when you apply for credit yourself. Keep the PINs or login details each bureau gives you.
2. Consider a fraud alert as well. A fraud alert tells lenders to take extra steps to verify your identity. Placing one at any of the three bureaus means that bureau must tell the other two. An initial alert lasts one year; if you have an identity theft report, you can request an extended alert that lasts seven years.
3. Report it at IdentityTheft.gov. The FTC’s site walks you through a report and gives you a personal recovery plan with prefilled letters. The resulting FTC Identity Theft Report is what many creditors and bureaus ask for when you dispute fraudulent accounts. You can also call the FTC at 1-877-438-4338.
4. Change passwords on your email and financial accounts. If the leak came from a hacked account rather than a company breach, the email account matters most, because it can be used to reset everything else. Turn on two-step verification with an authenticator app where you can.
5. Write down what you know. Where you think the number was exposed (a breach notice, a lost wallet, a phishing call), the date, and anything suspicious you have already seen. You will be asked this more than once.

Social Security Administration identity theft: what SSA does and doesn’t handle

Many people’s first instinct is to call Social Security. It is worth knowing what the Social Security Administration identity theft role actually is, because it is narrower than most people expect.

• SSA does not take general identity theft reports. For credit, loans and most other misuse, SSA points people to the FTC and IdentityTheft.gov. That is the main reporting route.
• Create your “my Social Security” account. Setting up your own online account at ssa.gov means a criminal can’t create one in your name and redirect your benefits or change your details. If you don’t want online access at all, SSA offers a way to block electronic access to your record.
• Check your earnings record. Your Social Security Statement, available in your online account, lists the earnings reported under your number each year. Income from an employer you never worked for is a sign someone is using your number for work. Contact SSA to correct your earnings record.
• Benefit problems. If you receive benefits and payments stop, change, or go to an account you don’t recognize, contact SSA directly using the number on ssa.gov.
• Fraud and impersonation scams. The SSA Office of the Inspector General (OIG) takes reports of Social Security fraud and of scammers pretending to be SSA. You can report through the OIG website.

So if you are wondering how to report identity theft to Social Security, the practical answer is: report the identity theft itself to the FTC, then use SSA for your own account, your earnings record and your benefits, and SSA’s OIG for fraud involving Social Security programs or impersonation.

Can you get a new Social Security number?

Sometimes, but rarely, and it is not a fix-all. SSA may assign a new number in limited situations, such as when you have done everything you can to resolve the misuse and are still being harmed by it. A new number doesn’t erase your credit history or old records tied to the old number, and it can cause its own problems with lenders and records that no longer match. Treat it as a last resort to discuss with SSA, not a first step.

Protect your tax refund

Tax refund fraud is a common use of a stolen number, and it is one of the easiest to prevent.

1. Get an IRS Identity Protection PIN. The IRS offers an IP PIN to anyone who can verify their identity. Once you have one, a return filed under your number without that PIN is rejected. You get a new PIN each year.
2. If someone already filed in your name, you will usually find out when your e-filed return is rejected as a duplicate or when you get an IRS notice. Respond to any notice using the contact details on it, and complete IRS Form 14039, the Identity Theft Affidavit, if the IRS or IdentityTheft.gov directs you to.
3. Watch for income you didn’t earn. An IRS notice about unreported wages from an unfamiliar employer is often the first sign of employment-related misuse. Keep a copy for your SSA earnings record correction too.

Close the less obvious doors

A credit freeze covers the three major bureaus. A few other systems are worth locking too, especially if you know your number is circulating.

• Bank and specialty reports. Banks often check ChexSystems before opening a checking account, and utility and phone companies may use other specialty agencies such as NCTUE. Both allow consumers to request a security freeze.
• E-Verify Self Lock. Through the myE-Verify service run by U.S. Citizenship and Immigration Services, you can lock your number against use in E-Verify, which some employers use to check work eligibility. It only affects employers who use E-Verify, but it is a useful extra layer.
• Your children’s numbers. Children’s numbers are attractive to fraudsters because nobody checks a child’s credit. Parents and guardians can request a freeze for a minor at each bureau.
• Your mobile carrier. Ask your carrier about a port-out PIN or number lock, so someone with your details can’t move your phone number to a new SIM and intercept verification codes.

Keep watching: what to monitor over the next year

Freezes block new damage. Monitoring catches anything that got through before you acted.

• Credit reports. You can check your reports from all three bureaus for free at AnnualCreditReport.com, the official source, and the bureaus offer free weekly reports there. Look for accounts, addresses and hard inquiries you don’t recognize.
• Bank and card statements. Small test charges often come before larger ones.
• Explanation of benefits statements from your health insurer, for care you didn’t receive.
• Mail and email. Bills, collection letters or welcome emails for accounts you never opened are signs to act on right away.
• Your name in search results. People-search sites and data brokers often publish your address, phone and relatives, which makes it easier for criminals to pass identity checks. Our guide to removing yourself from people search sites covers the opt-out process.

If you find a fraudulent account, contact the company’s fraud department, tell them you are an identity theft victim, and send your FTC Identity Theft Report. Then dispute the account with each bureau that lists it. The recovery plan at IdentityTheft.gov includes letters for both steps.

A worked example

This scenario is illustrative, not a real case.

Dana gets a letter from a healthcare billing company saying a breach exposed patients’ names, dates of birth and Social Security numbers. There is no sign of misuse yet.

1. That evening she freezes her credit at Equifax, Experian and TransUnion and saves each PIN in her password manager.
2. She creates her my Social Security account, checks her earnings record, and sees only her own employers.
3. She applies for an IRS Identity Protection PIN online.
4. She asks her mobile carrier to add a port-out PIN, and freezes her ChexSystems report.
5. She doesn’t file an identity theft report yet, because nothing has been misused. She saves the breach letter and sets a reminder to pull her credit reports every few months.

Four months later a collection letter arrives for a phone contract in another state. Because she has the breach letter and her freeze dates, she files at IdentityTheft.gov the same day, sends the report to the carrier’s fraud department and disputes the entry with the bureau. Her earlier steps limited the damage to one account instead of several.

Common mistakes to avoid

• Calling numbers from the message that alarmed you. Scammers send fake breach alerts and “SSA” calls on purpose. Look up contact details yourself on the official site.
• Freezing only one bureau. Lenders use different bureaus. A freeze at one leaves the other two open.
• Paying for recovery you can do for free. Freezes, IdentityTheft.gov reports, IRS IP PINs and credit reports at AnnualCreditReport.com cost nothing. Paid monitoring can be convenient, but it mainly alerts you after something happens, while a free freeze blocks most new accounts up front.
• Waiting for proof of misuse. The freeze and the IP PIN are preventive. They work best before anything goes wrong.
• Throwing away paperwork. Keep letters, report numbers, call dates and names. Disputes can take months, and records make them faster.

When a stolen number becomes a reputation problem

Most social security number identity theft stays financial. Sometimes it spills over: a debt collector’s public filing, a court record from a case someone else caused under your name, or an impersonator using your identity online. If fraud leaves false records or accounts attached to your name in search results, our guide to what to do if your identity is stolen covers the wider recovery, and our personal reputation management team can help with what shows up when people search for you. For prevention going forward, see our list of ways to prevent identity theft. If you are also dealing with threats, harassment or impersonation, our help resources page lists places to get support.

Frequently asked questions

Should I report a stolen Social Security number to the police?

It is optional in most cases. The FTC Identity Theft Report from IdentityTheft.gov is usually what creditors and credit bureaus need. Some companies or situations may still ask for a police report, and it can help if you know who the thief is, so file one locally if you are asked or if it helps your case.

Does a credit freeze hurt my credit score?

No. A freeze doesn’t affect your credit score and doesn’t stop you from using your existing accounts. It only stops most new lenders from viewing your report until you lift the freeze, which you can do temporarily when you apply for credit.

How do I know if someone is using my Social Security number?

Signs include accounts or inquiries you don’t recognize on your credit reports, an IRS notice about a duplicate return or unfamiliar wages, earnings on your Social Security Statement from employers you never worked for, and bills or collection letters for accounts you didn’t open.

Will Social Security call me about identity theft?

Be very cautious. Scammers often pretend to be SSA and claim your number has been suspended or used in a crime. SSA does not suspend numbers or demand payment by gift card, wire or cryptocurrency. Hang up and contact SSA using the details on ssa.gov, and report impersonation to the SSA Office of the Inspector General.

How long does it take to recover from Social Security identity theft?

It depends on how many accounts were affected and how quickly you act. Freezes and an IP PIN take effect quickly. Disputing fraudulent accounts and correcting records can take weeks or months, which is why keeping copies of every letter and report number helps.