If someone has your Social Security number, the priority is to lock down credit in your name, flag your tax and Social Security records, and get official documentation of the theft on file. Here is what to do if someone knows your Social Security number, in the order that shuts down the most damage the fastest.
Freeze Your Credit at All Three Bureaus
A credit freeze is the strongest first move. It blocks lenders from pulling your credit report, which stops most new-account fraud cold. Freezing is free, and you can lift it temporarily when you need to apply for credit yourself.
The catch: you have to contact each of the three major credit bureaus individually. A freeze at Equifax does not automatically freeze your file at Experian or TransUnion. You can request each one online, by phone, or by mail. Every bureau will give you a PIN or password to lift the freeze later, so keep those credentials somewhere safe.
Add a Fraud Alert
A fraud alert works differently from a freeze. Instead of blocking access, it flags your file so lenders are supposed to verify your identity before approving new credit. You only need to contact one bureau; that bureau is legally required to notify the other two.
An initial fraud alert lasts one year. If you have confirmed you are an identity theft victim, an extended alert lasts seven years. Many people place both a freeze and a fraud alert. The freeze does the heavy lifting; the alert adds a backup layer.
File a Report at IdentityTheft.gov
Go to IdentityTheft.gov, the FTC’s dedicated identity theft portal, and file a report. The site walks you through what happened and generates two things you will need going forward:
- An FTC Identity Theft Report, which serves as your official documentation for creditors and law enforcement.
- A personalized recovery plan with pre-filled dispute letters you can send to businesses.
The report is free and is foundational to the entire dispute process. Under the Fair Credit Reporting Act, once you submit an identity theft report along with proof of your identity and a statement identifying fraudulent items, the credit bureau must block that information within four business days. After a fraudulent debt is blocked, the creditor or collector cannot sell, transfer, or continue to collect on it.
Contact the Social Security Administration
If your SSN is being used for employment or benefits fraud, report it to the SSA’s Office of the Inspector General at oig.ssa.gov/report. The OIG investigates misuse of Social Security numbers and benefits fraud. If someone is impersonating SSA staff through phone calls or emails, use the separate scam-reporting portal on the same site.
You can also call the SSA at 1-800-772-1213 to request a block on electronic access to your Social Security record. Once the block is in place, no one can view or change your personal information through the SSA’s website or automated phone system. That includes you, so you’ll need to visit an office in person or call to make future changes. To lift the block, you’ll call and verify your identity.
Lock Your SSN in E-Verify
If employment identity theft is a concern, the Department of Homeland Security’s myE-Verify portal lets you place a Self Lock on your SSN. This prevents your number from being used to pass employment verification through the E-Verify system. The lock lasts one year and can be renewed annually. If you start a new job, you can temporarily remove it before your employer runs the check. Set this up at uscis.gov/myE-Verify.
Notify Your Banks and Card Issuers
Call every bank, credit card issuer, and other financial institution where you hold accounts. Tell them about the identity theft, ask them to flag your accounts, and find out whether any unauthorized activity has already occurred. Most institutions have dedicated fraud departments that can place temporary holds, issue new account numbers, and walk you through their dispute process.
Your liability limits depend on which type of account is hit and how quickly you report. Under the Truth in Lending Act, your maximum liability for unauthorized credit card charges is $50, and even that cap only applies to charges made before you report the card lost or stolen. Most major issuers waive it as a matter of policy.
Debit card protections are weaker and depend heavily on how fast you act. Under the Electronic Fund Transfer Act:
- Report within two business days of learning about the unauthorized transaction, and your liability caps at $50.
- Report after two business days but within 60 days of receiving the statement showing the fraud, and your liability rises to $500.
- Wait longer than 60 days, and you could lose everything the thief takes from the account after that 60-day window closes.
The difference between a $50 loss and an unlimited one comes down to checking your bank statements regularly.
File a Police Report
A police report is not always required, but it strengthens your position if a creditor disputes your claim or you need to pursue legal action. It’s especially useful if you know the perpetrator or if a financial institution asks for one. Bring your FTC Identity Theft Report, a government-issued photo ID, proof of your address, and any evidence of the theft. The report creates an official record that supports disputes with creditors and debt collectors.
What a Thief Can Actually Do With Your Number
Knowing the shapes fraud can take helps you know what to watch for. With your SSN, someone can open new credit cards, loans, or bank accounts under your name or a slight variation of it, and the debt shows up on your credit history. They can file a fraudulent tax return early in the season to claim a refund, so your legitimate return is rejected as a duplicate. They can pass employment verification, and their employer’s wage reporting under your SSN can produce phantom income on your tax record and inflate your reported earnings with the SSA. They can obtain medical care or prescriptions in your name, leaving incorrect information in your medical records. And in synthetic identity theft, criminals blend a real SSN with fabricated personal details to build an entirely new identity; those schemes often run for years before anyone catches them.
Get an IRS Identity Protection PIN
An Identity Protection PIN is a six-digit number the IRS requires on your tax return before processing it. Without the correct PIN, a fraudulent return filed under your SSN gets rejected automatically. Anyone with an SSN or Individual Taxpayer Identification Number can request one, and parents can request PINs for dependents.
The fastest way to get one is through your IRS online account at irs.gov. If you cannot verify your identity online and your adjusted gross income is below $84,000 (or $168,000 for married filing jointly), you can submit Form 15227, and the IRS will call to verify your identity, with the PIN arriving by mail within four to six weeks. You can also visit a Taxpayer Assistance Center in person. The PIN changes every year.
If you believe someone has already filed a fraudulent return using your SSN and you have not received an IRS letter about it, file Form 14039, the Identity Theft Affidavit. Once the IRS confirms you as a victim, it generally places a marker on your account that generates an IP PIN automatically going forward.
Watch for Ongoing Signs of Misuse
The initial cleanup is only part of the job. A compromised SSN can resurface months or years later, especially if it is circulating on the dark web. You cannot remove it from there once it is out, so ongoing monitoring is how you catch new problems early.
All three major credit bureaus now offer free weekly credit reports through AnnualCreditReport.com on a permanent basis. Pull them regularly and look for accounts you did not open, inquiries you did not authorize, and addresses you do not recognize. If you spot something wrong, dispute it directly with the bureau and use your FTC Identity Theft Report to request a block.
Scan every bank and credit card statement for charges you do not recognize. Thieves often start with small test transactions before larger ones. Given the debit card liability tiers above, catching a problem within two business days can be the difference between a $50 loss and a much larger one.
Unexpected letters from the IRS are one of the clearest signals of ongoing tax identity theft. Watch for notices about duplicate returns, unreported income from employers you have never worked for, or changes to your tax account you did not initiate. If you receive a Form W-2 or 1099 from an unknown employer, do not include that income on your return, and contact the SSA to review your earnings record.
If a Child’s SSN Is Involved
Children are attractive targets because the fraud can go undetected for years. A child typically won’t apply for credit until 18, giving a thief over a decade of unmonitored use. Warning signs that someone is using your child’s SSN include:
- Collection calls or overdue bills for accounts you never opened for your child.
- Being told your child’s SSN is already in use when applying for government benefits such as health coverage or nutrition assistance.
- IRS letters about unpaid taxes tied to your child’s SSN, often from someone using it for employment.
- Your child being denied financial aid because of existing bad credit tied to their SSN.
Children under 18 generally do not have a credit report. To check whether one exists, contact each of the three credit bureaus and request a manual search of your child’s SSN. If a file exists and you did not create it, that’s a strong indicator of fraud.
Parents and legal guardians can freeze a child’s credit with all three bureaus. You’ll need proof of authority, such as a birth certificate. If no credit file exists for the child, the bureau will create one solely to place the freeze; the created file cannot be used for credit purposes. Freezing and unfreezing are both free.
Can You Get a New Social Security Number?
The SSA will consider issuing a new number, but only as a last resort. You must show that you’ve taken every other step to resolve the misuse and that someone is still actively using your number despite those efforts. You’ll need to prove your identity, age, and citizenship or immigration status, plus provide evidence of the ongoing problems.
The SSA will not issue a new number if your card was simply lost or stolen but no one has used it, if you’re trying to escape bankruptcy consequences, or if you’re trying to avoid legal obligations. Even when a new number is granted, the old one does not disappear. Creditors and government agencies may still have it on file, and your credit history does not start fresh. A new number solves fewer problems than most people expect, which is why the protective measures above matter so much.