If your Social Security number has been compromised, act in this order: pull all three of your credit reports, place a fraud alert or credit freeze with the credit bureaus, file an FTC Identity Theft Report at IdentityTheft.gov, and then work outward to the IRS, the Social Security Administration, and any account or medical provider the thief may have touched. The sequence matters. The Identity Theft Report, in particular, unlocks legal rights you’ll rely on when you start disputing fraudulent accounts, so getting it early saves work later.
Pull Your Credit Reports First
Before you can protect yourself, you need to know what’s already been done in your name. The three nationwide credit bureaus — Equifax, Experian, and TransUnion — offer free weekly credit reports on a permanent basis through AnnualCreditReport.com, the only site authorized by federal law to provide them.1Federal Trade Commission. Free Credit Reports Pull all three. Not every creditor reports to every bureau, so a fraudulent account can sit on one report and not the others.
Look for accounts you never opened, addresses where you’ve never lived, employers you’ve never worked for, and hard inquiries from lenders you never contacted. Write down every unfamiliar entry with the dates, account numbers, and creditor names. This becomes your evidence file for every report and dispute that follows.
Place a Fraud Alert or Credit Freeze
These are two different tools, and you can use both at once.
Fraud Alert
An initial fraud alert tells lenders to verify your identity before opening new credit in your name. It lasts one year, costs nothing, and you only need to contact one of the three bureaus; that bureau is required by law to notify the other two.2Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts You don’t need proof of identity theft. A good-faith belief you’re at risk is enough.
Once you’ve filed an FTC Identity Theft Report or a police report, you qualify for an extended fraud alert that lasts seven years. Same one-bureau rule. The extended alert also removes you from prescreened credit and insurance offer lists for five years.3Federal Trade Commission. Credit Freezes and Fraud Alerts
Credit Freeze
A freeze is stronger. It blocks the credit bureaus from releasing your report to most lenders, which effectively stops new accounts from being opened because lenders won’t approve applications they can’t underwrite. Placing and lifting a freeze is free under federal law. Bureaus must freeze your file within one business day of a phone or online request, and within three business days of a mailed one.2Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
Unlike a fraud alert, a freeze requires contacting each bureau separately. Each one gives you a PIN or password to lift the freeze temporarily when you need to apply for a legitimate loan, apartment, or card. A lift by phone or online can take as little as one hour. Store those PINs somewhere secure but accessible; losing them adds friction at the worst possible moment.
File an FTC Identity Theft Report
Go to IdentityTheft.gov and file a report. The site walks you through the details and generates an FTC Identity Theft Report, which is the single most useful document in your recovery.4Federal Trade Commission. IdentityTheft.gov It’s a legal document. With it, you can force credit bureaus to block fraudulent information from your file, stop debt collectors from pursuing debts that aren’t yours, and prove to creditors that the accounts were opened by someone else.
The site also builds a personalized recovery plan and generates pre-filled letters you can send to creditors and bureaus. Save the report both digitally and on paper. You’ll reference its number repeatedly for months, sometimes years.
File a Police Report
A police report creates a law enforcement record and strengthens your position when a creditor pushes back on a fraud claim. Bring your FTC Identity Theft Report, a government-issued photo ID, proof of your address, and any evidence of the theft such as fraudulent billing statements or IRS notices.5U.S. Department of Justice. Identity Theft and Identity Fraud Ask for a copy before you leave.
Not every department treats identity theft with urgency, especially when the fraud originated online or out of state. File it anyway. The document carries weight with banks and federal agencies regardless of whether the local investigation goes anywhere.
Dispute Fraudulent Accounts and Bureau Entries
With your Identity Theft Report in hand, contact the fraud department of every company where a thief opened an account or made charges. Ask them to close the account, remove the charges, and send you written confirmation that the account isn’t yours and you aren’t liable for it. Keep those letters permanently. If a fraudulent account resurfaces on your credit report years later, that letter resolves it fast.
Separately, write to each of the three credit bureaus with a copy of your Identity Theft Report and a copy of your government-issued ID. Identify the specific fraudulent entries and ask the bureau to block them. Under the Fair Credit Reporting Act, once you provide a valid Identity Theft Report the bureau must block the fraudulent information and may not re-insert it.6Office of the Law Revision Counsel. 15 USC 1681 – Congressional Findings and Statement of Purpose You can dispute entries without an Identity Theft Report too, but the process takes longer and the bureau isn’t required to permanently block the information.
Protect Against Tax-Related Identity Theft
A stolen SSN is commonly used to file a fraudulent tax return claiming a refund. If you suspect this has happened, or you received an IRS notice about a return you didn’t file, submit Form 14039 (Identity Theft Affidavit) to the IRS. You can complete it online or file a paper version by mail or fax.7Internal Revenue Service. When to File an Identity Theft Affidavit If you can’t e-file your legitimate return because someone already filed using your SSN, attach Form 14039 to the back of your paper return.
Whether or not a fraudulent return has been filed, request an Identity Protection PIN from the IRS. An IP PIN is a six-digit number that must be included on your tax return for the IRS to accept it. Without the PIN, a fraudulent return filed under your SSN will be rejected. Any taxpayer with an SSN or ITIN can request one. The fastest route is through your IRS online account. If your adjusted gross income is below $84,000 (or $168,000 for married filing jointly), you can also apply using Form 15227 and verify your identity by phone. Otherwise, schedule an in-person appointment at an IRS Taxpayer Assistance Center.8Internal Revenue Service. Get an Identity Protection PIN Once enrolled online, you retrieve a new IP PIN each year through your account.
Report Employment Fraud to the SSA
If someone is working under your SSN, you may discover it through unexpected tax documents, an IRS notice about unreported income, or earnings on your Social Security statement that don’t match your work history. Report it to the Social Security Administration’s Office of the Inspector General at oig.ssa.gov, or call the fraud hotline at 1-800-269-0271 (10 a.m. to 2 p.m. ET, weekdays).9Office of the Inspector General. Other Ways to Report Fraud
Employment fraud is worth catching because incorrect earnings on your Social Security record can distort your future retirement or disability benefits. Review your earnings history through your my Social Security account at ssa.gov and flag any jobs or income you don’t recognize. Provide the SSA with your FTC Identity Theft Report and any IRS correspondence that shows the discrepancy.
Check for Medical Identity Theft
A thief with your SSN can also use it to get medical care, fill prescriptions, or bill your health insurance. The damage isn’t only financial. If the thief’s health information ends up in your file, it can affect future treatment decisions or exhaust your insurance benefits. Contact every doctor, clinic, hospital, pharmacy, and insurer where the thief may have used your information and request copies of the records.10Federal Trade Commission. What To Know About Medical Identity Theft
Review them for visits, procedures, or prescriptions you never received. Report errors in writing to each provider, with a copy of the record and the incorrect entries flagged. Providers must respond within 30 days and notify other providers who may hold the same erroneous information. Also check your credit reports for unfamiliar medical collection notices and dispute them the same way.
If the Compromised SSN Belongs to a Child
Children are attractive targets because their SSNs have no credit history attached, so fraud can go undetected for years. A parent or legal guardian can place a free credit freeze on a child’s file by contacting each of the three bureaus directly. Federal law requires bureaus to freeze a minor’s file on the same terms as an adult’s: free, and within one business day of a phone or online request.2Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts You’ll need to prove your authority over the child, typically with a birth certificate.
If the child doesn’t already have a credit file (most shouldn’t), the bureau will create one for the sole purpose of freezing it. Report identity theft involving a child’s SSN at IdentityTheft.gov just as you would for an adult. If anyone charges you a fee to “get a Social Security number for your child,” it’s a scam. SSN assignment is a free service from the SSA.11Social Security Administration. Fraud Prevention and Reporting
Getting a New Social Security Number Is a Last Resort
The SSA will assign a new SSN only in extreme situations. You have to show that you’ve already tried other remedies like freezes and fraud alerts and that they haven’t stopped the harm. The SSA’s policy allows a new number when evidence shows the existing number is causing ongoing harassment, abuse, or life endangerment, or that someone is continuing to misuse it despite your protective steps.12Social Security Administration. New Social Security Numbers for Domestic Violence Victims The SSA won’t issue a new number for a lost card alone, or after a data breach if no actual misuse has occurred. You need documented third-party evidence: police reports, medical records, court restraining orders, or letters from shelters or counselors describing the harm.
Understand the trade-offs before pursuing this. A new SSN doesn’t erase your old one from every database. Your credit history doesn’t transfer to the new number, so you’re effectively starting over when applying for loans, credit cards, or housing. Employment records, payroll systems, and Social Security benefit calculations are all tied to your original number, and untangling them takes time. For most people, the steps above are far more effective and far less disruptive than obtaining a new number.