Social Security identity theft happens when someone gets hold of your nine-digit SSN and uses it to impersonate you for financial or government purposes. There are five common routes: physical theft of documents and mail, phone and impersonation scams that get you to hand the number over, large-scale data breaches that leak millions of numbers at once, insiders at workplaces that legitimately hold your SSN, and people already close to you who have direct access to your paperwork. The FTC received over 1.1 million identity theft reports in 2024, and a stolen SSN sits at the center of most of them.1Federal Trade Commission. Consumer Sentinel Network Data Book 2024 That single number links your credit history, tax records, employment file, and government benefits, which is why thieves want it and why the routes to get it are so varied.
Stolen Wallets, Mail, and Trash
The simplest path runs through paper. Wallets and bags often contain a Social Security card or an ID that displays the number, and a single theft can hand a criminal everything needed to start opening accounts within hours.
Dumpster diving still works because people throw sensitive paper into curbside trash without shredding it. Old tax returns, bank statements, pre-approved credit offers, and benefit letters routinely carry your full SSN along with enough supporting detail to pass security questions. A cross-cut or micro-cut shredder is one of the cheapest defenses available.
Mail theft rises sharply during tax season, when W-2s, SSA benefit statements, and IRS letters travel through residential mailboxes. A thief who intercepts your W-2 gets your SSN, your employer, and your income figures, which is everything needed to file a fraudulent tax return before you do.2Internal Revenue Service. Form W-2/SSN Data Theft: Information for Businesses and Payroll Service Providers If your mailbox sits at the curb without a lock, a locking box or USPS Informed Delivery closes the gap. Informed Delivery is a free service that emails you grayscale images of letter-sized mail heading to your address, so anything that disappears becomes visible.3USPS. Informed Delivery – Mail and Package Notifications
Phone Scams and Impersonation
Many thieves never touch a physical document. They get you to read the number aloud. The most common version is a call from someone claiming to be an SSA agent, IRS officer, or bank representative. Caller ID spoofing makes the number on your screen match the agency’s real number, and that small detail disarms most people’s skepticism.
The technique is manufactured urgency. Callers say your benefits are about to be suspended, a warrant has been issued for your arrest, or your account will be frozen unless you verify your SSN immediately. Real agencies do not operate this way. The SSA will never threaten you over the phone, demand immediate payment, or ask you to confirm your full SSN during an unsolicited call.4Social Security Administration. Fraud Prevention and Reporting
These scams are getting harder to detect. AI-powered voice cloning lets attackers scrape a short audio clip of someone you know from a webinar, voicemail, or social media video and generate a convincing replica of that person’s voice. Hearing what sounds like your boss, your spouse, or your adult child asking you to read off a number pushes past the instinct to verify. If a call is unexpected and asks for sensitive information, hang up and call the person or agency back on a number you look up yourself.
Data Breaches and the Dark Web
By sheer volume, corporate and government breaches account for more SSN theft than any other route. The 2017 Equifax breach exposed the SSNs, birth dates, and addresses of roughly 148 million Americans. The 2015 Office of Personnel Management breach compromised personal data of more than 20 million federal employees and applicants, including biometric identifiers.
Stolen records don’t sit with one thief. They get organized into searchable databases and resold on dark web marketplaces. A standalone SSN typically sells for a few dollars; a “fullz” bundle with name, date of birth, and address runs from about $20 to over $100. At those prices, criminals buy in bulk and run automated fraud attempts at scale.
Buyers use these identities to file fraudulent tax returns, apply for government benefits, and open credit accounts, often long before the victim learns about the breach.5U.S. Department of Justice. Stolen Identity Refund Fraud The gap between the institutional leak and your discovery can stretch for months. Dark web monitoring services can shorten that gap, but the more reliable check is reviewing your credit reports. All three major bureaus offer free weekly reports through AnnualCreditReport.com.6AnnualCreditReport.com. Annual Credit Report – Home Page
Insider Access at Work
Employees who handle personnel files, payroll, insurance forms, or tax preparation have routine, legitimate access to SSNs. That proximity makes insider theft hard to catch. A dishonest HR clerk can photograph a screen, copy a spreadsheet, or memorize numbers during ordinary tasks without triggering any alarm.
The exposure extends to medical offices, accounting firms, and any workplace that processes new-hire paperwork or insurance claims. Insiders may use the numbers themselves to open credit lines or sell batches to outside criminal groups. Because the access looks normal, routine audits often miss it.
Federal law requires employers to securely dispose of consumer reports and the information gathered from them, including SSNs, once they are no longer needed. Acceptable disposal methods include shredding paper and rendering electronic data unreadable.7Federal Trade Commission. Using Consumer Reports: What Employers Need to Know Many workplaces fall short in practice. If you spot unsecured SSN data at your job, raise it before it becomes a breach.
Theft by Family Members and People Close to You
This is the variety people least expect and most often fail to report. A family member, romantic partner, or caregiver already has physical access to the home where Social Security cards, tax returns, and financial statements are stored. No hacking, no interception, no dumpster required.
Trust makes it worse. You might share your SSN with a spouse on a joint application, hand it to a parent helping with medical paperwork, or leave documents accessible to a roommate. Someone in that position who turns dishonest can open utility accounts, take out payday loans, or apply for credit cards in your name. Because they know your personal history, they can answer security questions that would stop a stranger.
The emotional dimension is what makes familiar fraud so damaging. Victims often know who did it but delay reporting because pressing charges against a parent, child, or partner feels impossible. That delay gives the perpetrator more time to accumulate debt in your name. Unauthorized use of someone’s SSN is a federal crime regardless of the relationship.
Why Children’s SSNs Are a Distinct Target
A child’s SSN is attractive precisely because nobody is watching it. Children don’t apply for credit, don’t check reports, and don’t receive statements. A thief who obtains a child’s SSN can build a fraudulent credit history that goes undetected for years, sometimes more than a decade, until the child applies for a student loan or a first apartment and finds a credit file full of delinquent accounts.8Consumer Advice – FTC. How To Protect Your Child From Identity Theft In many of these cases the perpetrator is a family member with direct access to the child’s documents, which loops back to familiar fraud.
Warning signs include bills, credit card offers, or debt collection calls arriving in your child’s name.9Consumer Financial Protection Bureau. How Do I Check To See if a Child Has a Credit Report You can request a free credit freeze for a minor child through each of the three major bureaus. The freeze blocks anyone from opening new credit in the child’s name until you lift it. It takes more effort than freezing your own credit because you have to mail proof of your identity, your relationship, and the child’s identity, but for a child whose SSN was exposed in a breach it is the strongest protection available.
Signs Your SSN Has Been Compromised
Most people don’t discover SSN theft the moment it happens. They find out through a downstream effect. Common early signals:
- Collection notices or bills for accounts you never opened.
- A sudden, unexplained drop in your credit score.
- Credit denials for accounts you’d normally qualify for.
- An IRS notice saying more than one return was filed under your SSN, or that you have wages from an employer you don’t recognize.
- Wages you didn’t earn showing up on your SSA earnings record when you log in through my Social Security at ssa.gov.4Social Security Administration. Fraud Prevention and Reporting
- Credit card offers or debt collection calls in a child’s name.
What to Do If Your SSN Has Been Stolen
Speed matters. The longer a thief has unchallenged use of your SSN, the more accounts they open and the harder cleanup becomes. These steps can happen in parallel.
Freeze your credit. A credit freeze blocks any new account from being opened in your name, including by you, until you lift it. It is free at all three bureaus and lasts indefinitely. A fraud alert is a lighter option that asks lenders to verify your identity before approving new credit; an initial alert lasts one year, and an extended alert for confirmed victims lasts seven.10Consumer Advice – FTC. Credit Freezes and Fraud Alerts A freeze is the stronger choice for most identity theft situations.
File a report at IdentityTheft.gov. The federal government’s central recovery site generates a personalized plan with pre-filled letters and checklists. The report is your official FTC Identity Theft Report, which creditors and bureaus often require when disputing fraudulent accounts.11Federal Trade Commission. IdentityTheft.gov A local police report adds a paper trail some creditors ask for separately.
Report SSN misuse to the SSA. If someone is using your number to work, collect benefits, or defraud Social Security programs, report it to the SSA’s Office of the Inspector General through their online fraud form.12Office of the Inspector General. Report Fraud
Get an IRS Identity Protection PIN. The IP PIN is a six-digit number the IRS assigns to your account. Any return filed under your SSN without it gets rejected. Anyone with an SSN or ITIN can enroll through the IRS online account tool, and parents can request one for dependents.13Internal Revenue Service. Get an Identity Protection PIN If a fraudulent return was already filed under your SSN, submit Form 14039, the Identity Theft Affidavit, to start the resolution process.14Internal Revenue Service. When To File an Identity Theft Affidavit
Keep watching. Pull your free credit reports on a rolling schedule through AnnualCreditReport.com.6AnnualCreditReport.com. Annual Credit Report – Home Page Check your SSA earnings record at least once a year. Watch for collection letters, bills for services you didn’t use, and IRS notices about income you didn’t earn. The earlier you catch new fraudulent activity, the easier it is to shut down.
One habit closes a lot of the doors above: keep the physical Social Security card in a secure spot at home rather than in your wallet. It rarely needs to be produced in daily life, and carrying it just multiplies your exposure.