What to Do if Your Social Security Number Is Stolen

If your Social Security number is stolen, act the same day: report the theft at IdentityTheft.gov, file a police report, freeze your credit with all three bureaus, call every bank and card issuer where you hold an account, and secure your IRS, Social Security, and E-Verify records before the thief can open more accounts or file a return in your name. Federal law caps your liability for unauthorized charges and gives you tools to block fraudulent accounts, but most of those protections depend on how fast you report. The steps below run in the order that matters most.

Report the Theft at IdentityTheft.gov

Start at IdentityTheft.gov, the Federal Trade Commission’s central portal for identity theft victims.1Federal Trade Commission. IdentityTheft.gov The site walks you through questions about what happened and produces two documents you’ll use repeatedly: an FTC Identity Theft Report and a personalized recovery plan.

The Identity Theft Report is a sworn statement about the fraud. You can use it in place of a police report in many situations, including when you ask credit bureaus to block fraudulent information or when you demand that a business turn over records of accounts opened in your name. Under federal law, businesses that received payment or extended credit using your stolen information must give you copies of application and transaction records once you show proof of your identity and the report.2Office of the Law Revision Counsel. 15 USC 1681g – Disclosures to Consumers Save digital and printed copies. Almost every step that follows asks for one.

File a Police Report

After the FTC report, file one with your local police department. Bring the FTC report, a government-issued photo ID, proof of address like a utility bill, and any evidence you have: bank statements showing unauthorized charges, collection letters for accounts you didn’t open, IRS notices about returns you didn’t file. Ask for a full report rather than an abbreviated one, and write down the case number. Financial institutions and government agencies typically want both documents before they’ll clear fraudulent debts or restore accounts.

If your number was stolen through the mail (an intercepted tax form, bank statement, or benefits notice), also report it to the U.S. Postal Inspection Service at uspis.gov/report or 1-877-876-2455.3United States Postal Inspection Service. Report a Crime

Freeze Your Credit and Add a Fraud Alert

Contact Equifax, Experian, and TransUnion and place both a security freeze and a fraud alert on your file. They do different things, and you want both.

Security Freeze

A freeze blocks anyone from pulling your credit report to open new accounts. A lender that tries simply cannot access the file, which stops most new-account fraud before it starts. You can request a freeze online, by phone, or by mail. Online and phone requests must be placed within one business day; mailed requests within three business days.4Federal Trade Commission. Starting Today, New Federal Law Allows Consumers to Place Free Credit Freezes and Yearlong Fraud Alerts Freezes are free to place, lift, and remove.5Consumer Financial Protection Bureau. What Is a Credit Freeze or Security Freeze on My Credit Report

Each bureau sends written confirmation with a PIN or credential you’ll need to lift the freeze temporarily when you apply for credit yourself. Store those securely.

Fraud Alert

A fraud alert doesn’t block your report; it flags it, telling creditors to take extra steps to verify identity before opening a new account. Two types:

Both are free.7Federal Trade Commission. Credit Freezes and Fraud Alerts

Block Accounts Already Opened

If fraudulent accounts or charges are already on your report, ask the bureaus to block them. Send your identity theft report with a letter identifying each fraudulent item, and the bureau must block the information within four business days.8Office of the Law Revision Counsel. 15 USC 1681c-2 – Block of Information Resulting From Identity Theft

The three major bureaus aren’t the only ones tracking your financial history. If you suspect the thief has tried to open bank accounts, order a free ChexSystems report at 1-800-428-9623. You can also flag your information with check verification companies like Telecheck (1-800-710-9898) and Certegy (1-800-437-5120) so they’ll decline stolen checks.9Federal Trade Commission: IdentityTheft.gov. Identity Theft Recovery Steps

After that, monitor. All three major bureaus now provide free weekly credit reports at AnnualCreditReport.com.10Federal Trade Commission. You Now Have Permanent Access to Free Weekly Credit Reports Check them at least monthly for the first year to catch anything that slips through.

Notify Your Banks and Card Issuers

Call the fraud department of every bank, credit union, and credit card issuer where you hold an account. Close compromised accounts and get new numbers issued. Follow every call with a written notice by certified mail with return receipt, enclosing a copy of the police report. That creates a paper trail proving when you notified each institution.

Federal liability limits depend on the account type and how fast you report:

  • On credit cards, your maximum liability for unauthorized charges is $50, and once you notify the issuer you owe nothing for charges made after. Most major issuers waive even the $50 under zero-liability policies.11Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
  • On debit cards and bank accounts, reporting within two business days of learning about the theft caps liability at $50. Wait longer than two business days but report within 60 days of receiving a statement showing the unauthorized transfer, and liability can rise to $500. Miss the 60-day window and you can be responsible for the full amount of transfers made after that deadline.12GovInfo. 15 USC 1693g – Consumer Liability

Debit card fraud is where every day of delay costs money. Once you report, the bank generally has ten business days to investigate and must correct confirmed errors within one business day of finishing.13Consumer Financial Protection Bureau. How Do I Get My Money Back After I Discover an Unauthorized Transaction or Money Missing From My Bank Account

Secure Your IRS Account

A stolen SSN is commonly used to file fraudulent returns and claim refunds. Signs include an IRS notice about a return you didn’t file, wages from an employer you don’t recognize, or a rejected e-filed return because one was already submitted under your number.

File IRS Form 14039, the Identity Theft Affidavit, to alert the IRS and secure your tax account. You can complete it online at irs.gov, mail or fax the paper version, or submit it through IdentityTheft.gov so the FTC transmits it to the IRS. Only file Form 14039 if you believe someone used your SSN on a return or otherwise tampered with your tax account. The IRS asks victims who have already received certain IRS letters about the issue not to submit the form, because those letters mean the IRS has already flagged the problem.14Internal Revenue Service. When to File an Identity Theft Affidavit

Once processed, the IRS enrolls you in the Identity Protection PIN program and mails a CP01A notice each year (typically mid-December through early January) with a new six-digit IP PIN. You must include it on every federal return to verify your identity.15Internal Revenue Service. Frequently Asked Questions About the Identity Protection Personal Identification Number (IP PIN) Resolving a case involving a fraudulent return can take several months.

You don’t have to wait for fraud to get an IP PIN. Any taxpayer with an SSN or ITIN can opt in through their online IRS account, which prevents anyone from filing a return under your number without the PIN.16Internal Revenue Service. Get an Identity Protection PIN (IP PIN)

Check Your Social Security Earnings Record

A thief who has your SSN may use it to get a job, which means the employer’s wage reports show up on your Social Security earnings record. Incorrect earnings can affect your future benefits. Sign in to your personal my Social Security account at ssa.gov and confirm every entry matches a job you actually held.17Social Security Administration. Review Record of Earnings SSA recommends reviewing your record each August, after employers have reported the prior year.

If wages from an employer you never worked for appear, file Form SSA-7008, Request for Correction of Earnings Record. Mail it to SSA at 6100 Wabash Avenue, Baltimore, MD 21215, or bring it to your local office.18Social Security Administration. Request for Correction of Earnings Record (SSA-7008)

Also report the misuse of your number to the Social Security Administration’s Office of Inspector General, either online at oig.ssa.gov or by calling the OIG fraud hotline at 1-800-269-0271 (10 a.m. to 2 p.m. ET, Monday through Friday).19Social Security Administration. Fraud Prevention and Reporting

Lock Your SSN in E-Verify

To block employment fraud, use the Department of Homeland Security’s myE-Verify service to place a free Self Lock on your number. Once locked, any employer running your SSN through E-Verify gets a mismatch, which stops the thief from passing the employment check.20E-Verify. Self Lock

Create or sign in to a myE-Verify account and set your challenge questions. The lock stays active until you unlock it. If you’re about to start a job with an employer that uses E-Verify, log in and unlock the number before your first day so your own verification goes through.20E-Verify. Self Lock

Watch for Medical Identity Theft

A stolen SSN can be used to receive medical care, fill prescriptions, or file insurance claims in your name. That corrupts your medical records, which can be dangerous if a provider later treats you based on someone else’s history, and it can produce collection notices for services you never received.

If you’re on Medicare, review your Medicare Summary Notices for services or equipment you don’t recognize. Report suspected Medicare fraud at 1-800-MEDICARE (1-800-633-4227) or through medicare.gov.21Medicare. Reporting Medicare Fraud and Abuse For private insurance, ask your insurer’s fraud department for your claims history and flag anything you didn’t receive. If inaccurate entries appear in your health records, contact each provider directly to dispute them and ask that the fraudulent records be separated from yours.

When a New Social Security Number Is an Option

SSA will assign a new number only in rare cases, as a last resort. You must have already taken every other step to stop the misuse and still be actively harmed by continued use of your original number. SSA will not issue a new number simply because your card was lost or stolen without evidence of ongoing misuse, and it won’t issue one to help you avoid bankruptcy or other legal responsibilities. To apply, you’ll need evidence of the continued problems and proof of your identity, age, and citizenship or immigration status.22Social Security Administration. Identity Theft and Your Social Security Number

A new number also carries real costs. Your credit history doesn’t transfer, so you start over with no record, which makes renting, borrowing, or opening a bank account harder. Academic records and professional credentials tied to the old number may be harder to reach as well. For most victims, credit freezes, fraud alerts, an IP PIN, and an E-Verify Self Lock provide enough protection without the complications of switching numbers.