Can Your Identity Be Stolen With a Name and Birthday?

Yes, your identity can be stolen with just a name and birthday, though usually as a starting point rather than the whole job. Those two details let criminals pass basic verification calls, guess at Social Security numbers, and stitch together fake identities that look real to lenders. The FTC received more than 1.1 million identity theft reports in 2024, and a significant share of those cases began with nothing more than basic personal details scraped from social media or leaked in a data breach.¹

What a Name and Birthday Actually Unlock

A name and date of birth by themselves won’t drain a bank account. What they do is open doors. Criminals use these details to search public records databases for your address, phone number, and relatives. They call utility companies or financial institutions and pass the first layer of verification by confirming your full name and birthday. Once past that initial checkpoint, they can often talk a representative into revealing more or resetting account access.

Birthdays are one of the most common security questions on older accounts. If a thief already knows yours, resetting a password on a poorly secured account becomes trivial. Personalized phishing also gets more convincing when the sender appears to know something real about you. A “happy birthday” email from what looks like your bank, timed to your actual birthday, is far more likely to get a click than a generic scam message.

Why Your Birthday Can Lead to Your Social Security Number

Researchers at Carnegie Mellon University showed that a person’s birth date and birth state are often enough to predict their Social Security number. Their study found that the first five digits of an SSN could be correctly identified on the first attempt for 44% of people born between 1989 and 2003. With fewer than 1,000 guesses, they matched complete nine-digit SSNs for 8.5% of that same group. Because credit reporting agencies sometimes accept inquiries where only seven of nine SSN digits are correct, the practical vulnerability is worse than those numbers suggest.²

That’s the core reason a birthday matters more than it looks. Combined with information a thief can find elsewhere, it’s often the last piece needed to guess or verify the number that unlocks credit, tax, and medical fraud.

Synthetic Identity Fraud

Synthetic identity theft is where a name and birthday become most dangerous. Instead of stealing your identity wholesale, a criminal combines your real name and date of birth with a fabricated or stolen Social Security number to create a person who doesn’t quite exist. The Federal Reserve defines synthetic identity fraud as the use of combined personal information to fabricate a person or entity for financial gain, and identifies it as the fastest-growing type of financial crime in the United States.³

The Federal Reserve classifies name, date of birth, and Social Security number as “primary elements” of an identity, meaning these are the core pieces that, when combined, make a profile look legitimate to lenders and credit bureaus.³ A thief supplies your real name and birthday for authenticity, pairs them with an SSN that doesn’t obviously belong to anyone, and slowly builds credit. Small account, on-time payments for months, credit line increases, then everything maxed out and gone. Traditional fraud monitoring struggles with these accounts because the profiles look like real customers.

Downstream Consequences

Once a thief has enough of your profile to be convincing, the fraud tends to spread into two areas that hit hard.

Tax-related identity theft happens when someone files a fraudulent return using your personal information to claim your refund. The IRS flags suspicious returns filed with your name and SSN through its Taxpayer Protection Program and won’t issue a refund until you verify your identity.⁴ If a fraudulent return is filed before yours, your legitimate return will be rejected electronically, and you’ll need to file IRS Form 14039, the Identity Theft Affidavit.⁵

Medical identity theft occurs when someone uses your personal information to obtain healthcare, prescription drugs, or insurance benefits in your name. The Department of Health and Human Services warns that thieves use details like your name, Social Security number, or insurance number to submit fraudulent claims.⁶ The consequences go beyond financial loss. A thief’s medical history can get mixed into your records, meaning your file might contain someone else’s blood type, allergies, or diagnoses. Cleaning up corrupted medical records is slow and involves contacting every provider and insurer individually.

Children Face the Highest Risk

Children are especially attractive targets because they have clean credit histories and nobody checks their credit reports for years. A thief can use a child’s name, date of birth, and Social Security number to open credit cards, apply for loans, sign up for utility services, or even apply for government benefits. The FTC notes that victims often don’t discover the theft until they’re old enough to apply for a student loan or first credit card and learn they already have a credit history full of unpaid debt.⁷ A criminal can run up charges for a decade before anyone notices. If your child receives pre-approved credit offers in the mail or you get IRS notices about income reported under their Social Security number, treat those as red flags and check whether a credit file exists under their name.

How to Protect Yourself

Make Your Birthday Harder to Find

The single most effective step is limiting who can see your date of birth. Remove your full birth date from social media profiles, or at least hide the year. Facebook birthday posts and “What does your birth month say about you?” quizzes are data harvesting in plain sight. Personal information posted publicly gets indexed by data brokers, companies that compile detailed profiles by pulling from public records, social media, purchase histories, and other sources. In the United States, these companies can collect and sell your information without your consent unless you actively opt out. Opting out means visiting each broker’s website individually and submitting a removal request.

Freeze Your Credit

A credit freeze is the strongest defense against someone opening accounts in your name. It blocks lenders from accessing your credit report entirely, which means no one, including you, can open new credit until you temporarily lift or remove the freeze. Federal law requires all three major credit bureaus to place and remove freezes free of charge.⁸ Placing a freeze online or by phone takes effect within one business day, and lifting it takes as little as one hour by the same methods.

If a full freeze feels too restrictive, a fraud alert is a lighter alternative. You only need to contact one of the three bureaus, and that bureau is required to notify the other two. An initial fraud alert lasts one year and tells businesses to verify your identity before extending new credit.⁹

Use Strong Authentication

Enable multi-factor authentication on every account that offers it. Even if a thief guesses your password using your birthday, they’ll hit a wall when the account demands a code from your phone or authentication app. Wherever possible, avoid security questions with answers that could be found online. Your mother’s maiden name, your high school, and your birthday are all publicly searchable. Use answers that have nothing to do with the actual question, and store them in a password manager.

Request an IRS Identity Protection PIN

Anyone with a Social Security number or ITIN can request an IP PIN from the IRS, even without being an identity theft victim. This six-digit code is required on your tax return each year and prevents someone else from filing under your name. You can request one through your IRS.gov online account, through Form 15227 if your adjusted gross income is below $84,000 (or $168,000 for married filing jointly), or by visiting a Taxpayer Assistance Center in person.¹⁰ Parents and legal guardians can also request IP PINs for dependents.

What to Do If Your Identity Is Already Stolen

Speed matters. Contact your bank and credit card companies immediately to report unauthorized transactions and freeze or close affected accounts. Then place a credit freeze or fraud alert with the credit bureaus.9

File an identity theft report at IdentityTheft.gov, the FTC’s dedicated recovery site. Based on the information you provide, the site generates a personalized recovery plan and an Identity Theft Report you can use when disputing fraudulent accounts or filing a police report.¹¹ If you create an account on the site, it will walk you through each step, track your progress, and pre-fill dispute letters.

File a police report with your local law enforcement agency and bring copies of your FTC Identity Theft Report and any documentation of fraudulent charges.¹¹ Some creditors and institutions require a police report before they’ll remove fraudulent accounts from your record. Change all compromised passwords and any other passwords that are similar or reused across accounts. If the theft involved tax fraud, file Form 14039 with the IRS and request an IP PIN to protect future returns.⁵

1
Federal Trade Commission. New FTC Data Show a Big Jump in Reported Losses to Fraud to $12.5 Billion in 2024
2
Proceedings of the National Academy of Sciences. Predicting Social Security Numbers from Public Data
3
Federal Reserve. Synthetic Identity Fraud Defined
4
Internal Revenue Service. How IRS ID Theft Victim Assistance Works
5
Internal Revenue Service. When to File an Identity Theft Affidavit
6
Office of Inspector General – HHS. Medical Identity Theft
7
Federal Trade Commission. How To Protect Your Child From Identity Theft
8
Office of the Law Revision Counsel. 15 US Code 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
9
Federal Trade Commission. Credit Freezes and Fraud Alerts
10
Internal Revenue Service. Get an Identity Protection PIN
11
Federal Trade Commission. Identity Theft: A Recovery Plan