What Happens If Your Social Security Number Is Leaked?

If your Social Security number has been leaked, act now: file a report at IdentityTheft.gov, put a fraud alert and a credit freeze on your credit files, watch your bank accounts closely, and take specific steps with the IRS and the Social Security Administration to block tax and benefits fraud. Speed matters. Some of the legal protections that limit your losses shrink, or disappear entirely, if you wait too long to report unauthorized activity.

The nine digits tie together your credit, your earnings history, and your tax records, so a leak can spill into several places at once. A thief may open credit cards or loans in your name, get hired under your number and pump phantom wages onto your IRS record, use your identity for medical care, or file a tax return to grab your refund before you do. Children’s numbers are a favorite target because the fraud can sit undetected for years. The steps below address each of these fronts.

Report It at IdentityTheft.gov

Your first move is the Federal Trade Commission’s portal at IdentityTheft.gov. The site asks a series of questions about what happened and then produces two things: an FTC Identity Theft Report and a personalized recovery plan with step-by-step instructions. Create an account and the site tracks your progress, updates the plan, and pre-fills letters and forms you can send to creditors and bureaus.¹

Be careful and accurate. Knowingly filing a false identity theft report with the FTC can result in fines, imprisonment, or both.¹ Before you start, gather a government-issued photo ID, any breach notification letters you received, and a written log of when you discovered the leak and what suspicious activity you have seen. Keep a recent utility bill, mortgage statement, or rental agreement on hand as well; you may need it later to prove your address to a creditor or to law enforcement.

Place a Fraud Alert on Your Credit Reports

A fraud alert tells lenders to take extra steps to verify your identity before opening new credit in your name. You only need to contact one of the three major credit bureaus — Equifax, Experian, or TransUnion — and that bureau must notify the other two.²

There are two levels:

An initial fraud alert is available to anyone who suspects they are or may become a victim of identity theft. It lasts at least one year and requires prospective lenders to use reasonable procedures to verify your identity before extending credit.²
An extended fraud alert is available after you submit an identity theft report, such as the FTC report generated at IdentityTheft.gov. It lasts seven years and requires lenders to contact you directly, using the method you specify, before approving any new credit.²

Placing an alert also entitles you to extra free credit reports. An initial alert gets you one free report from each bureau within 12 months; an extended alert gets you two from each bureau within 12 months, on top of the standard annual free report everyone receives.³ Review each report closely for accounts you do not recognize.

Freeze Your Credit at All Three Bureaus

A credit freeze goes further than a fraud alert. It blocks the credit bureaus from releasing your credit report to anyone, which means no one can open new accounts in your name, including you, until you lift the freeze. Federal law requires all three bureaus to place and lift freezes free of charge.²

Unlike fraud alerts, you must contact each bureau separately. Online or phone requests must be honored within one business day. Mailed requests get three business days. Within five business days of placing the freeze, the bureau sends confirmation along with instructions for lifting or removing the freeze, including an authentication mechanism such as a PIN or password.² Store that PIN somewhere safe. You will need it whenever you want to lift the freeze for a legitimate credit application.

A freeze stays in place until you ask that it be removed, so there is nothing to renew. When you apply for credit, lift the freeze temporarily for a specific creditor or time period, then let it snap back.

Protect Your Bank Accounts

Credit freezes and fraud alerts cover credit reports only. They do nothing to stop a thief from opening a checking or savings account, writing fraudulent checks, or draining an existing account. Contact your bank directly if you spot any unauthorized transactions and ask about extra security on your accounts.

Reporting speed matters more here than almost anywhere else. Under the Electronic Fund Transfer Act, your liability for unauthorized debit card or electronic transactions depends on how quickly you notify your bank:

Within two business days of learning about the theft, your liability is capped at $50.
After two business days but within 60 days of your statement, your liability can rise to $500.
After 60 days of your statement, you may be on the hook for the full amount of any transfers the bank can show would have been prevented by timely notice.⁴

The 60-day cliff is the dangerous one. Ignore your statements for two months and you can lose your entire right to reimbursement for unauthorized transfers. Check every statement as soon as it arrives.

You can also place a security freeze with ChexSystems, the reporting agency most banks use to screen new account applications. A ChexSystems freeze works like a credit freeze and prevents someone from opening a new bank account using your information.

Head Off Tax Fraud

One common use of a stolen Social Security number is filing a fraudulent tax return to claim your refund. If a thief files before you do, the IRS will reject your legitimate return as a duplicate and untangling it can delay your refund for months.

File IRS Form 14039

If you suspect someone has used your Social Security number for tax purposes, complete IRS Form 14039, the Identity Theft Affidavit. You can submit it online, by mail, or by fax. Filing this form flags your IRS account for suspicious activity and puts the agency on alert for fraudulent returns.⁵ If you cannot e-file because someone already filed under your number, attach the completed Form 14039 to the back of your paper return.⁶

Get an Identity Protection PIN

The IRS also offers an Identity Protection PIN, a six-digit number you include on your tax return each year to prove you are the legitimate filer. Anyone with a Social Security number or Individual Taxpayer Identification Number who can verify their identity is eligible. A new IP PIN is generated each year and must be used on every return you file that calendar year, including any late returns from prior years.⁷

The fastest way to get an IP PIN is through your IRS Online Account. If you cannot verify your identity online, you can file Form 15227 by mail if your adjusted gross income on your last filed return was below $84,000 (individual) or $168,000 (married filing jointly). After a phone verification, the IRS mails the IP PIN within four to six weeks. If neither online nor phone verification works, you can visit a local Taxpayer Assistance Center in person with photo identification.⁸

File a Police Report

A police report creates an official record of the crime. Some banks and creditors require one before they will process fraud claims or close accounts opened by the thief, and a report is especially important if the fraud involved financial losses, forged checks, or criminal activity committed under your identity.

Visit your local police department or sheriff’s office with your FTC Identity Theft Report and a government-issued photo ID. Ask for a copy of the police report, or at minimum the case number; you will need it when disputing fraudulent accounts. If someone gave your name to law enforcement during a stop or arrest, that same report is where the process of clearing your record in law enforcement databases starts.

Notify the Social Security Administration

If someone is misusing your Social Security number to collect government benefits, report it to the Social Security Administration’s Office of the Inspector General. You can submit a report online at oig.ssa.gov or call the OIG fraud hotline at 1-800-269-0271.⁹ Reporting helps the agency track fraud and protects your own benefit eligibility from being tangled up in someone else’s claims.¹⁰

Also Check for a Child’s Credit File

If the leak involved a child in your family, contact each of the three nationwide credit bureaus and ask them to search for a credit file in the child’s name. If one exists and no one in the family opened the accounts, that usually means the child’s number has been compromised, and you should run through the same steps above on the child’s behalf.¹¹

A New Social Security Number Is a Last Resort

In extreme cases the SSA may assign an entirely new number, but the bar is high. You must show that you have taken every available step to fix the problems caused by the misuse and that someone is still actively using your number despite those efforts. The SSA will not issue a new number simply because the original was lost or stolen with no evidence of ongoing misuse, and it will not issue one to anyone trying to avoid legal obligations or debts.¹²

A new number does not give you a clean slate either. Your old credit history and records may not automatically transfer, which can create complications when you apply for credit or employment. For nearly everyone, the freezes, alerts, and agency reports above resolve the problem without touching the number itself.

1
Federal Trade Commission. IdentityTheft.gov – Report Identity Theft and Get a Recovery Plan
2
Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention, Fraud Alerts and Active Duty Alerts
3
Consumer Financial Protection Bureau. What Do I Do if I Think I Have Been a Victim of Identity Theft
4
GovInfo. 15 USC 1693g – Consumer Liability
5
Internal Revenue Service. Reporting Identity Theft
6
Internal Revenue Service. Form 14039, Identity Theft Affidavit
7
Internal Revenue Service. Frequently Asked Questions About the Identity Protection Personal Identification Number (IP PIN)
8
Internal Revenue Service. Get an Identity Protection PIN
9
Social Security Administration. Fraud Prevention and Reporting
10
Office of the Inspector General. Report Fraud
11
Consumer Financial Protection Bureau. How Do I Check To See if a Child Has a Credit Report
12
Social Security Administration. Identity Theft and Your Social Security Number