If your Social Security number has turned up on the dark web, the exposure itself can’t be undone, but the fraud that usually follows can. Move fast on a few systems and you close off most of the ways a thief actually cashes in on a stolen SSN. The steps below are what to do when your SSN is on the dark web, in the order that gives you the most protection for the least effort.
Freeze Your Credit at Every Bureau
A credit freeze is the single most effective step you can take right now. It blocks lenders from pulling your credit report, which means no one can open new credit cards, loans, or lines of credit in your name. Freezing is free, doesn’t affect your credit score, and stays in place until you lift it.1Federal Trade Commission Consumer Advice. Credit Freezes and Fraud Alerts
You have to contact each of the three major bureaus separately:2USAGov. How to Place or Lift a Security Freeze on Your Credit Report
- Equifax: 1-800-685-1111 or equifax.com
- Experian: 1-888-397-3742 or experian.com
- TransUnion: 1-888-909-8872 or transunion.com
Each bureau will give you a PIN or password you’ll use later to lift the freeze temporarily when you legitimately apply for credit. Online and phone requests to lift must be honored within one hour; mailed requests can take up to three business days.2USAGov. How to Place or Lift a Security Freeze on Your Credit Report
Most people stop there. That leaves gaps. Freeze these too:
- Innovis, a fourth consumer credit bureau some lenders check. Freeze at innovis.com/securityFreeze or 1-800-540-2505.3Innovis. Security Freeze Request Online
- ChexSystems, which tracks checking and savings account history. A freeze here stops fraudsters from opening bank accounts in your name. Use the consumer portal or call 800-887-7652.4ChexSystems. Place a Security Freeze
- The National Consumer Telecom and Utilities Exchange, which covers phone, electric, and cable accounts. A free NCTUE freeze is available at nctueconsumerportal.com or 1-866-349-5355.5NCTUE. Consumer
Add a Fraud Alert
A fraud alert tells creditors to take extra steps to verify your identity before approving new credit. You only need to contact one of the three major bureaus; that bureau is required to notify the other two. An initial fraud alert is free and lasts one year. If someone has already used your SSN, you can place an extended alert lasting seven years, but you’ll need an FTC Identity Theft Report from IdentityTheft.gov or a police report to qualify.1Federal Trade Commission Consumer Advice. Credit Freezes and Fraud Alerts
A freeze and a fraud alert work well together. The freeze blocks access entirely; the alert adds verification whenever you temporarily lift the freeze.
Lock Down Your Social Security Account
Call the SSA at 1-800-772-1213 and ask for a Block Electronic Access on your Social Security record. Once activated, this stops all automated telephone and online access to your account, so no one can view or change your information through SSA’s electronic services. You lose your own online access until you contact the SSA to remove the block, which is a fair trade when your number is actively exposed.6Social Security Administration. How You Can Help Us Protect Your Social Security Number and Keep Your Information Safe
If you later suspect someone is using your SSN for employment or to collect benefits, report that separately to the SSA’s Office of the Inspector General at oig.ssa.gov or 1-800-269-0271.7Social Security Administration. Fraud Prevention and Reporting
Get an IRS Identity Protection PIN
Tax-related identity theft happens when someone files a fraudulent return using your SSN to claim a refund. The IRS Identity Protection PIN program prevents this. An IP PIN is a six-digit number known only to you and the IRS; any federal return filed with your SSN must include it, so a return filed without your PIN gets rejected. You can request an IP PIN through the IRS website even if you haven’t been a victim yet, and a new one is issued each year.8Internal Revenue Service. Get an Identity Protection PIN
If someone has already filed a return in your name, or you get IRS notices about income you didn’t earn, file Form 14039 (Identity Theft Affidavit) online or by mail. Once the IRS confirms the fraud, they typically assign you an IP PIN automatically for future years.9Internal Revenue Service. When to File an Identity Theft Affidavit
Lock Your SSN for Employment Checks
Identity thieves sometimes use stolen SSNs to pass employment verification, leaving you with tax liability for wages you never earned. The federal E-Verify system offers a free Self Lock feature through myE-Verify that locks your SSN in the E-Verify database. If an employer tries to verify a new hire using your locked SSN, the system flags it as a mismatch. The lock stays active as long as your account is valid, and you can log in to unlock it temporarily when you start a legitimate new job.10E-Verify. Self Lock
Not every employer uses E-Verify, so this won’t catch everything. Also check your Social Security earnings statement through your mySocialSecurity account periodically for wages from employers you don’t recognize. Discrepancies could mean someone is working under your number and could distort your future benefits.
Secure Your Bank Accounts and Passwords
Call your banks and credit card companies, tell them your SSN has been compromised, and ask them to flag your accounts for unusual activity. Some banks can add verbal passwords or extra authentication requirements. Watch for small test charges; thieves often run one before making a larger purchase, so set transaction alerts as low as your bank allows.
Change the passwords on every important online account, starting with email, banking, and government portals like IRS and SSA. Use a unique password for each; a password manager makes this workable. Turn on multi-factor authentication wherever it’s offered, and prefer an authenticator app over text-message codes when you can, because phone numbers tied to a compromised SSN can be targeted through SIM-swap attacks.
Report Fraud Once It Actually Happens
The SSA draws an important line: if your SSN was exposed but nobody has actually misused it yet, you don’t need to file an FTC Identity Theft Report. Focus on the protective steps above. The FTC report becomes necessary once actual fraud occurs.7Social Security Administration. Fraud Prevention and Reporting
When misuse does happen, go to IdentityTheft.gov. Filing there generates an FTC Identity Theft Report and a personalized recovery plan with pre-filled letters for creditors and debt collectors.11Federal Trade Commission. Report Identity Theft The FTC report is what unlocks the extended fraud alert and lets you require credit bureaus to block fraudulent accounts from your file under the Fair Credit Reporting Act; the bureau must act within four business days of receiving your report and identifying the fraudulent items.12Office of the Law Revision Counsel. 15 USC 1681c-2 – Block of Information Resulting From Identity Theft File a police report as well if accounts have been opened or purchases made; some creditors still require one before they’ll investigate. Keep copies of everything.
Monitor Your Credit and Watch for Less Obvious Fraud
All three major credit bureaus now offer free weekly credit reports permanently through AnnualCreditReport.com, and Equifax provides six additional free reports per year through 2026.13Federal Trade Commission. Free Credit Reports Stagger your checks across the bureaus so you’re reviewing a different report every couple of weeks. Look for accounts you didn’t open, hard inquiries you don’t recognize, addresses you’ve never lived at, and employers you’ve never worked for.
Two kinds of fraud don’t show up on a credit report and deserve their own attention.
Medical Identity Theft
When someone uses your identity to get medical care, their health information can end up in your records. Incorrect blood types, allergies, or diagnoses in your file create a real safety risk if you later need emergency treatment. Request copies of your medical records from doctors, hospitals, and health insurers at least once a year and look for treatments, prescriptions, or diagnoses you don’t recognize. Under the HIPAA Privacy Rule, you have the right to request an amendment; a provider must act within 60 days, with a possible 30-day extension, and if they agree, must make reasonable efforts to notify entities that received the incorrect information. If they deny the request, you can file a statement of disagreement that must be included with any future disclosure of the disputed information.14U.S. Department of Health & Human Services. The HIPAA Privacy Rule and Electronic Health Information Exchange in a Networked Environment: Correction
Children’s SSNs
Children’s numbers are prime targets because the fraud can go undetected for years, until the child applies for a first credit card, student loan, or job. Warning signs include credit card offers arriving in a child’s name, IRS notices about taxes owed by a minor, or debt collector calls asking for your child. You can place a credit freeze on a child’s file with each of the three major bureaus. Most children won’t have a credit file at all, so the bureau creates one and immediately freezes it. Expect to mail copies of the child’s birth certificate and Social Security card, your government-issued ID, and proof of address; each bureau posts its own instructions.
When a New Social Security Number Is (and Isn’t) an Option
The SSA can assign a new number, but only as a last resort. You must show you’ve done everything possible to resolve the problems caused by misuse of your current number and that someone is still actively using it to harm you. The SSA will not issue a new number simply because your SSN was exposed, because your card was lost or stolen, or to help you avoid bankruptcy or other legal obligations.15Social Security Administration. Identity Theft and Your Social Security Number A new number also carries its own costs: your credit history, employment records, and tax records stay tied to the old one, and starting over with a blank credit file can make housing, loans, and jobs harder in the short term.
Staying Safe Going Forward
Once your SSN is on the dark web, assume it stays there. Keep your credit frozen as the default and lift it only when you need to. Review your credit reports on a rotation rather than once a year. Watch your Social Security earnings statement for unfamiliar employers. Renew your IRS IP PIN annually.
Expect phishing attempts in the weeks and months after a breach. Someone with your SSN may pose as your bank, the IRS, or the SSA to pry more information out of you. The IRS will never initiate contact by email or text. The SSA won’t call threatening arrest. Any unexpected message asking you to verify personal information is almost certainly a scam. Store physical documents with your SSN somewhere secure, and shred anything you no longer need.