What to Do If Someone Steals Your Social Security Number

If someone has stolen your Social Security number, act in this order: file an identity theft report at IdentityTheft.gov, place a credit freeze or fraud alert with the three credit bureaus, review your credit reports and block fraudulent accounts, notify your banks, report the misuse to the Social Security Administration, protect your tax account with the IRS, and file a police report. Each step below tells you what to do if someone steals your Social Security number, why the step matters, and what deadlines apply.

Signs Your Number Has Been Stolen

You often learn about the theft through its side effects. Credit you expected to get is denied. Collectors call about debts you never took on. Unfamiliar accounts show up on a credit report. The IRS sends a notice saying more than one return was filed under your number, or that you owe tax on income you never earned.¹ Any one of these is reason to start the steps below.

File a Report at IdentityTheft.gov First

Your first call is to the federal government’s identity theft portal at IdentityTheft.gov. The site produces two documents you will use for the rest of the recovery: an FTC Identity Theft Report and a personalized recovery plan.² The Identity Theft Report is a standardized document that proves to creditors, banks, and credit bureaus that you were a victim. It also unlocks specific legal rights, including the ability to block fraudulent accounts from your credit file and to place an extended fraud alert that lasts seven years.

Create an account when you file. The site will then walk you through each step, track what you’ve done, and pre-fill the letters you need to send to creditors and bureaus. If you don’t create an account, print your report and recovery plan on the spot, because you will not be able to get back into them later.²

Freeze Your Credit or Place a Fraud Alert

Contact the three national credit bureaus, Equifax, Experian, and TransUnion. A fraud alert tells lenders to verify your identity before opening new credit in your name. You only need to place it with one bureau; that bureau must notify the other two. An initial alert lasts one year and can be renewed. With your FTC Identity Theft Report or a police report, you can place an extended alert that lasts seven years.³

A credit freeze is stronger. It blocks access to your credit file entirely, so no one, including you, can open new credit accounts until you lift it. Freezing and unfreezing are free at all three bureaus under federal law, and you have to place the freeze at each bureau separately.⁴ A freeze stays in place until you lift it, and you can lift it temporarily when you actually need to apply for credit. If you know your number is compromised, a freeze at all three bureaus is the most effective way to stop new fraudulent accounts.

Review Your Credit Reports and Block Fraudulent Accounts

You are entitled to a free credit report from each bureau every 12 months at AnnualCreditReport.com, and all three bureaus now offer free weekly reports through the same site. Identity theft victims who have placed a fraud alert are entitled to additional free copies.⁵

Look for accounts you did not open, inquiries you did not authorize, and addresses or employers you do not recognize. If you find fraudulent information, federal law gives you a stronger tool than a standard dispute. You can demand that the credit bureau block the item from your file, and the bureau must do so within four business days of receiving your identity theft report, proof of identity, identification of the fraudulent items, and a statement that the accounts are not yours. The bureau also has to notify the company that reported the fraudulent account.⁶ Unlike a dispute, this block does not depend on the bureau investigating and agreeing with you; it works off your identity theft report.

Notify Your Banks Fast

Call every bank, credit union, and brokerage where you hold an account. Ask each institution to flag the account, review recent activity, and change account numbers if any fraudulent charges have posted. Give them a copy of your FTC Identity Theft Report so they can start reversing fraudulent transactions and closing compromised accounts.

Speed matters here because federal rules on unauthorized electronic transfers tie your liability to how quickly you report. Notify your bank within two business days of learning about the theft, and your liability is capped at $50. Wait longer than two business days but report within 60 days of the statement, and your exposure rises to as much as $500. Fail to report unauthorized transfers that appear on a periodic statement within 60 days, and you can be on the hook for the full amount of any transfers that happen after that window closes.⁷ The 60-day clock runs from when the statement is sent, not when you open it. Check your accounts often during recovery.

Report the Misuse to the Social Security Administration

When a thief uses your number to get a job, the employer reports that income to the IRS under your number. That can make it look like you underreported income, and it corrupts your Social Security earnings record.¹ Call the SSA at 1-800-772-1213 so the agency can walk through your earnings with you and correct its records. You can also report fraud through the SSA Office of the Inspector General.⁸

Check the record yourself by signing in at ssa.gov and reviewing the wages and self-employment income listed for each year. If you see earnings from employers you never worked for, pull together your own W-2s, tax returns, and pay stubs, and contact the SSA to start the correction process.⁹ Your future benefits are calculated from this earnings history, so leaving bad entries in place can cause problems later.

Protect Your Tax Account With the IRS

Tax-related identity theft happens when someone files a return under your number to steal your refund. The right response depends on how you learn about it.

If the IRS sends you a Taxpayer Protection Program letter (such as Letter 5071C or Letter 4883C), follow the verification instructions in that letter. Do not file Form 14039. If instead you discover the theft on your own, for example when your e-filed return is rejected because a return has already been filed under your number, complete Form 14039 (Identity Theft Affidavit), attach it to the back of a paper tax return, and mail it to the IRS.¹⁰

Once the IRS confirms you are a victim, it will mark your account with an identity theft indicator and enroll you in the Identity Protection PIN program. You will receive a new six-digit IP PIN each calendar year and must include it on every future return to verify your identity.¹⁰ If you did not set the PIN up through your online IRS account, the agency mails it to you each year.¹¹ The IRS encourages anyone to opt into the IP PIN program, even if your identity theft did not involve a fraudulent return.¹²

File a Report With Local Police

A police report strengthens your case. Combined with your FTC Identity Theft Report, it gives you the strongest record for creditors and bureaus, and it is required for placing an extended fraud alert.¹³ You can file at your local police station or, in many places, online. Bring:

A government-issued photo ID such as a driver’s license or passport
Your FTC Identity Theft Report from IdentityTheft.gov
Evidence of the misuse, such as collection notices, unfamiliar bank statements, or IRS letters
Proof of address, such as a utility bill, lease, or bank statement

Ask for a copy of the completed report, or at minimum a case number, and keep it with your FTC report.

If Medical Care or Insurance Is Involved

If someone uses your number to receive medical treatment or file insurance claims, the risk goes beyond money. A thief’s blood type, allergies, or prescriptions can end up in your file and drive a bad treatment decision later. Start with your explanation of benefits statements. If you see services you never received, report the fraud to your insurer.

Under HIPAA, you can ask a healthcare provider to amend inaccurate information in your medical records. The request must be in writing. The provider has 60 days to act, with the possibility of one 30-day extension. If the provider accepts the amendment, it must update the affected records and notify anyone who previously received the wrong information and may have relied on it. If the provider denies your request, you can submit a written statement of disagreement that will be attached to your record.¹⁴ Request a copy of your file after corrections to confirm they were made.

If the Number Belongs to a Child

Children are frequent targets because their credit files sit unused for years. A parent or guardian can contact each of the three bureaus to check whether a credit file exists in the child’s name. A child under 18 generally should not have a credit report; if one exists and you did not authorize an account, someone has likely been using the child’s number.¹⁵

When you find fraudulent accounts, contact each bureau and explain that the account holder is a minor who cannot legally enter into a contract. You can use the FTC’s Uniform Minor’s Status Declaration Form along with a letter asking the bureau to remove the fraudulent accounts, inquiries, and collection notices.¹⁵ File the theft at IdentityTheft.gov the same way you would for an adult. Federal law also lets parents and legal guardians place a free credit freeze on a child’s file at all three bureaus.¹⁶ Each bureau asks for documentation proving your identity and your relationship to the child, such as a birth certificate and a government-issued ID, and the specific documents vary, so check each one’s requirements before submitting.

When a New Social Security Number Is on the Table

A new Social Security number is a last resort. The SSA considers issuing one only after you can show that you have taken every available step to fix the problems and that someone is still actively misusing your number.¹ You will need Form SS-5, original documents proving your age, identity, and citizenship or immigration status, and evidence of the ongoing misuse.¹⁷ Because originals are required, plan on an in-person visit to an SSA office.

A new number is not a clean slate. The SSA cross-references it with your old number to preserve your records, so your prior credit history, debts, and any unresolved issues stay connected to you. In practice, the report tied to your new number may reflect an incomplete history, which can temporarily lower your credit score. You will also have to update the new number manually with every bank, employer, and government agency that has the old one. That is why the SSA approves new numbers only when the evidence of continuing harm is strong.

1
Social Security Administration. Identity Theft and Your Social Security Number
2
IdentityTheft.gov. What To Do Right Away
3
FTC: Consumer Advice. Credit Freezes and Fraud Alerts
4
Consumer Financial Protection Bureau. What Is a Credit Freeze or Security Freeze on My Credit Report?
5
Federal Trade Commission. Free Credit Reports
6
Office of the Law Revision Counsel. 15 USC 1681c-2 – Block of Information Resulting From Identity Theft
7
eCFR. Section 1005.6 – Liability of Consumer for Unauthorized Transfers
8
Office of the Inspector General. Report Fraud
9
Social Security Administration. How to Correct Your Social Security Earnings Record
10
Internal Revenue Service. How IRS ID Theft Victim Assistance Works
11
Taxpayer Advocate Service. Protect Yourself From Tax-Related Identity Theft – Get an Identity Protection PIN
12
Internal Revenue Service. Form 14039 Identity Theft Affidavit
13
Consumer Financial Protection Bureau. What Do I Do if I Think I Have Been a Victim of Identity Theft?
14
eCFR. Section 164.526 – Amendment of Protected Health Information
15
Consumer Financial Protection Bureau. How Do I Check To See if a Child Has a Credit Report?
16
Federal Trade Commission. New Protections Available for Minors Under 16
17
Social Security Administration. Learn What Documents You Will Need To Get a Social Security Card