How to Report a Stolen Social Security Number: IRS, SSA, and Credit

To report a stolen Social Security number, start at IdentityTheft.gov, where the Federal Trade Commission creates an official Identity Theft Report and a personalized recovery plan you will use with every other agency and creditor. From there, notify the IRS, the Social Security Administration, and the three credit bureaus. Speed matters. The longer a thief holds your number, the more accounts, tax filings, and medical records they can compromise before anyone catches it.

Start at IdentityTheft.gov

IdentityTheft.gov is the federal government’s central portal for identity theft victims, and it is the first call you should make. You can also report by phone at 1-877-438-4338.¹ The site asks a series of questions about what happened, which accounts were affected, and when you discovered the theft. At the end you get two documents: an official FTC Identity Theft Report and a personalized recovery plan.

The recovery plan generates pre-filled letters you can send to creditors and debt collectors and provides step-by-step checklists tailored to your case. If you create an account, the system tracks your progress and updates the plan as your situation changes.¹ Download and print the report and the plan. Nearly every agency and creditor you deal with next will want to see the FTC report before they cooperate.

The report also unlocks legal rights you would not otherwise have. With it, you can request a seven-year extended fraud alert from the credit bureaus instead of the standard one-year alert.² The extended alert forces lenders to take extra verification steps before approving new credit in your name for the full seven years.

Before you start, have a government-issued photo ID, proof of your current address, your Social Security number and date of birth, and any evidence of the theft ready. That evidence includes credit card statements showing charges you did not make, collection letters for accounts you did not open, IRS notices about returns you did not file, and any data breach notification you received. Keep a running log of every call, letter, and email tied to the theft, including the date, the agency, the person you spoke with, and what they said. Consistent records across every filing make your case harder to dismiss later.

Report to the IRS and Request an IP PIN

Tax-return fraud is one of the first ways a stolen number gets used. If a thief has already filed a return in your name, or has taken a job under your number, tell the IRS with Form 14039, the Identity Theft Affidavit. The form asks for the tax years affected, an explanation of the impact on your account, and when you became aware of the theft.³ The IRS prefers online submission at irs.gov, but you can also fax the form toll-free to 855-807-5720 or mail it to the IRS in Fresno, CA 93888-0025. Pick one method only.

Once the IRS processes your affidavit, it places a marker on your tax account that flags future filings for manual review.³ If someone has already filed using your number for the current year, you will not be able to e-file. Attach Form 14039 to the back of a paper return and mail it to your usual filing address.

After the immediate problem is handled, request an Identity Protection PIN through your IRS online account. An IP PIN is a six-digit number the IRS assigns you each year that must appear on your tax return before the IRS will accept it. Anyone with a Social Security number or Individual Taxpayer Identification Number who can verify their identity is eligible. Parents and legal guardians can also request one for a dependent, though minors under 18 must use an alternative enrollment method rather than the online portal.⁴ This is the single best tool for preventing future tax fraud with your number.

Notify the Social Security Administration

Contact the SSA’s Office of the Inspector General fraud hotline at 1-800-269-0271, or file online at oig.ssa.gov, to register the misuse.⁵ The SSA report serves a different purpose than the IRS report: it protects your earnings record, which is what your future retirement and disability benefits are calculated from. If a thief worked under your number, that employer’s wage reports are now sitting on your record. Left uncorrected, those phantom earnings can distort your benefit calculations or trigger an IRS mismatch notice years later.

Correcting Your Earnings Record

To remove fraudulent income from your Social Security earnings statement, file a written request for correction with any SSA office. Identify the time period and include any evidence that the earnings are not yours, such as proof you lived in a different state or worked for a different employer during that period.⁶ The SSA can correct entries that resulted from fraud even after the normal time limit for corrections has passed.

A New Social Security Number Is a Last Resort

The SSA will consider assigning a new number, but only after you have exhausted every other remedy and someone is still actively misusing your current number. You will need to prove your identity, age, and citizenship or immigration status, and provide evidence of ongoing harm.⁷ The SSA will not issue a new number just because your card was lost or stolen with no evidence of actual misuse, or to help you avoid bankruptcy or legal obligations. A new number brings its own complications, too. Your old credit history, employment records, and benefit calculations do not automatically transfer.

Freeze Your Credit and Place a Fraud Alert

Fraud alerts and security freezes are different tools, both free, and in most cases you want both.

Fraud Alerts

An initial fraud alert lasts one year and requires creditors to take reasonable steps to verify your identity before opening new credit. You only need to contact one of the three major bureaus, Equifax, Experian, or TransUnion, and that bureau is legally required to notify the other two.⁸ With an FTC Identity Theft Report, you can place an extended fraud alert that lasts seven years.²

Security Freezes

A security freeze goes further. It blocks anyone from pulling your credit report, which stops most new-account fraud cold. You must contact each bureau separately. Federal law requires all three bureaus to place and remove freezes free of charge, and to process online or phone requests within one business day and mail requests within three business days.²

When you freeze your file, each bureau gives you a confirmation number or PIN you will need later to temporarily lift or permanently remove the freeze. Experian no longer uses PINs. You manage the freeze through a free Experian account instead.⁹ Store the confirmation details from each bureau somewhere secure. You will need to lift the freeze whenever you apply for a new credit card, mortgage, apartment, or anything else that runs a credit check.

Dispute Fraudulent Accounts on Your Credit Report

With alerts and freezes in place, pull your credit reports from all three bureaus and look for accounts, inquiries, and addresses you do not recognize. Identity theft victims are entitled to free credit reports beyond the standard annual report when they place a fraud alert.¹⁰

For each fraudulent account, contact both the creditor and the credit bureau. Send a dispute letter identifying the account, explaining it was opened through identity theft, and include a copy of your FTC Identity Theft Report. The pre-filled letters in your IdentityTheft.gov recovery plan make this easier. Creditors who receive an identity theft report are required to stop collecting on the fraudulent debt and must give you copies of the application and transaction records the thief used.

Do not treat this as a one-time cleanup. Keep monitoring your reports for at least a year, because stolen numbers often circulate for months before every instance of misuse surfaces. A new fraudulent account can appear six months after you thought everything was resolved.

Consider Filing a Police Report

A police report is optional but worth doing. Some creditors and agencies still want to see one before they will remove fraudulent accounts, and it creates a law enforcement record that strengthens your position in later disputes. Bring your FTC Identity Theft Report, a photo ID, proof of address, and any evidence of the theft to your local police station.¹¹ Ask for a copy of the completed report before you leave. The written report is what matters for your paper trail.

If a Thief Used Your Number for Medical Care

Medical identity theft creates a second problem beyond billing: it contaminates your health records with someone else’s conditions, allergies, and medications, which a doctor treating you for a real emergency could rely on. Under HIPAA, you have the right to obtain copies of your medical and billing records from any covered health plan or provider and to have inaccurate information corrected.¹²

Request records from every provider and insurer you use and look for treatments, prescriptions, and diagnoses that are not yours. To dispute inaccurate entries, write to the provider or health plan identifying each item, explain why it is wrong, and include supporting documents. The provider must correct the information and notify any labs or other providers that received the incorrect data.¹² You are also entitled to one free accounting of disclosures from each provider every 12 months, which can reveal whether your records were improperly shared.

If the Stolen Number Belongs to a Child

Children are prime targets because a stolen child’s number can go undetected for years. Thieves use children’s numbers to open utility accounts, apply for credit, and secure employment. The damage often surfaces only when the child turns 18 and applies for their first student loan or credit card.

To check whether your child already has a credit file, contact each of the three major bureaus. TransUnion and Experian offer online child identity theft inquiry forms; Equifax requires a request by mail.¹³ A child under 16 should have no credit file at all. If one exists, that is a strong indicator of identity theft.

When you find fraudulent accounts, contact each bureau to explain that the account holder is a minor who cannot legally enter into contracts. Send a completed FTC Uniform Minor’s Status Declaration Form with a letter requesting removal of all accounts, inquiries, and collection notices tied to the child’s name.¹³ You can also freeze a child’s credit file proactively. Bureaus generally require a copy of the child’s birth certificate, Social Security card, your government-issued ID, and proof of your current address to verify your authority as parent or guardian.

Parents can also request an IRS Identity Protection PIN for a child, which prevents anyone from filing a tax return using the child’s number.⁴ For children under 18, use a mail-based or in-person enrollment method rather than the online portal.

1
Federal Trade Commission. IdentityTheft.gov
2
Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
3
Internal Revenue Service. Form 14039 – Identity Theft Affidavit
4
Internal Revenue Service. Get an Identity Protection PIN (IP PIN)
5
Social Security Administration. Fraud Prevention and Reporting
6
eCFR. 20 CFR Part 404 Subpart I – Correcting the Earnings Record
7
Social Security Administration. Identity Theft and Your Social Security Number
8
Federal Trade Commission. Credit Freezes and Fraud Alerts
9
Experian. Freeze Your Credit File for Free
10
Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act
11
Federal Trade Commission. IdentityTheft.gov – Recovery Steps
12
Federal Trade Commission. Medical Identity Theft – FAQs for Health Care Providers and Health Plans
13
Consumer Financial Protection Bureau. How Do I Check to See if a Child Has a Credit Report?