Social Security Number Stolen? What to Do Next

What to do first

Work in this order: stop any active fraud at the companies involved, protect the credit file, file the federal report, and then handle the tax and benefit side. The Social Security Administration comes later in the sequence and for a narrower purpose than most people expect.

1. Call any bank, card issuer, or company where you already see something wrong. Ask for the fraud department. Ask them to secure the account, stop pending transactions if they still can, and confirm in writing what you reported and when. If nothing is wrong yet, skip to the next step.
2. Freeze your credit at all three bureaus. A Social Security number is the key to opening new credit accounts, so this is the step that matters most for containment. The FTC says there is no cost to place or lift a freeze and that you must contact all three bureaus. Our freeze guide has the exact steps.
3. Report it at IdentityTheft.gov. The SSA itself directs people with a stolen number to report identity theft to the FTC. The report is free and produces a recovery plan and an FTC Identity Theft Report.
4. Read all three credit reports. The FTC says each report is free once a week at AnnualCreditReport.com. Read the accounts, the addresses, the employers, and the inquiries.
5. Protect your tax account. Request an Identity Protection PIN from the IRS, which is the tool that addresses a fraudulent return filed with your number.
6. Check your Social Security record. Sign in to your personal my Social Security account and look at the earnings history for work you never did.
7. Report misuse of the number itself. Suspected misuse of a Social Security number or of Social Security benefits goes to the SSA Office of the Inspector General.

Exposed is not the same as misused

There is a real difference between a number that was exposed and a number that is being used, and the response is not identical. Exposure means the information is out there. Misuse means someone has actually opened an account, filed a return, or taken a job with it.

The SSA makes this distinction directly: if someone has not misused your Social Security number but it has been lost, stolen, shared, or exposed in a data breach, you do not need to file an FTC identity theft report, though there are steps you can take to help protect yourself, including checking, freezing, and monitoring your credit.

The practical translation. If you only know the number was in a breach, freeze your credit, read your reports, get an IP PIN, and watch. If you have a sign of actual misuse, such as an account you did not open or a rejected tax return, file the FTC report, because that document carries the rights you will need. Our guide to what to do after a data breach covers the exposure-only case in more detail.

Either way, exposure is not something you caused. Social Security numbers leak overwhelmingly through companies and institutions that held them, and there is no version of personal caution that would have prevented most of these breaches.

What the Social Security Administration can and cannot do

The SSA does not investigate or resolve identity theft cases. Its own guidance says Social Security does not handle identity theft issues and points people to the FTC. Calling the SSA first is the most common wasted step in this whole process.

What the SSA does handle is the Social Security record itself: your earnings history, your benefit application, your card, and in narrow cases the number. Suspected misuse of a number or of benefits is taken by the SSA Office of the Inspector General, which accepts reports of misusing a Social Security number or Social Security benefits, false information to obtain or continue benefits, and misuse by a representative payee.

The SSA page for a stolen number also lists the steps it recommends around the rest of the system: report to the FTC, consider a police report, file an online report with the FBI at the Internet Crime Complaint Center, contact a credit bureau about a freeze or fraud alert, contact the IRS about a fraudulent return, and sign in to your my Social Security account to look for suspicious activity.

Replacing the card is also not a remedy. A new card carries the same number, and the card is not what a thief needs. The number is already out.

Can you get a new Social Security number?

Rarely, and it is not a fix. The SSA generally assigns one number for life and will consider a different number only in limited situations, one of which is a victim of identity theft who continues to be disadvantaged by using the original number.

The other limited situations the SSA describes include sequential numbers assigned to members of the same family causing a problem, harassment, abuse, or danger to life including domestic violence, and religious or cultural objection to certain digits in the original number. You have to apply, document the situation, and the decision is the SSA’s.

Here is the part the marketing around this subject tends to skip. A new number does not erase the old one. Your work history, tax records, credit history, and existing accounts are tied to the original number, and the SSA links the records. A new number can create its own problems, including a thin or missing credit history that makes it harder to rent, borrow, or get a job, and years of explaining why your file looks empty.

The tax risk, and what actually helps

A stolen Social Security number is primarily a tax risk, because a fraudulent return filed early in the season can claim a refund before you file. The IRS Identity Theft Central page is where this is handled, not the SSA.

The IRS guide for individuals lists the signs to watch for: a tax return rejected because one was already filed, a Form W-2 or Form 1099 from an employer you did not work for, an unreported income notice such as the CP2000 series, accounts created or accessed that you did not create or access, and a Social Security account showing wages you did not earn or expect.

Two IRS tools matter here. The Identity Protection PIN is a code that protects your tax account against a return filed in your name, and it is the preventive step to take before filing season rather than after. Form 14039, the Identity Theft Affidavit, is the report you file when there is an actual problem, and the IRS explains when to file it and when a letter from the IRS means you should follow that letter’s instructions instead.

One safety note while you are dealing with this. The IRS does not initiate contact by email, text message, or unsolicited phone call, so a message claiming to be the IRS about your identity theft case is a reason to stop and verify through irs.gov rather than to respond.

The benefit and earnings risk

Someone using your number to work creates a second, slower problem: wages that are not yours attached to your earnings record. That can distort the record used to calculate future Social Security benefits, and it can generate tax notices for income you never received.

Check your earnings history in your personal my Social Security account and read it year by year against what you actually earned. Unfamiliar employers, unexpected wage amounts, or earnings in years you did not work are the signals. The IRS also lists a Social Security account showing wages you did not earn as a sign of tax-related identity theft, so the two problems usually appear together.

If you find something, report suspected misuse of the number to the SSA Office of the Inspector General, and handle the tax consequences through the IRS. Keep copies of what you send and when, because correcting an earnings record is a paperwork process and can take time.

There is also a risk of someone claiming benefits in your name, which is why the OIG list includes providing false or misleading information to begin or continue receiving benefits, and misuse by a representative payee. If you are handling money for a parent or another person, the representative payee category is the one to know about.

Accounts opened with your number

If new credit accounts appear, the credit file is where you fight it, and being an identity theft victim gives you a faster route than a normal dispute. Both routes start with reading all three reports.

The Consumer Financial Protection Bureau says that with an identity theft report, proof of identity, and a letter identifying the fraudulent accounts, credit reporting companies must block fraudulent information from your credit report within four business days after receiving your request. It also says creditors are notified and cannot turn identity theft related debts over to debt collectors.

The ordinary dispute route runs on a different clock. The CFPB says to dispute with both the credit reporting company and the furnisher that supplied the information, and that furnishers generally must investigate and respond within thirty days.

Send everything to each bureau separately and keep the dated copies. Our hub on reporting identity theft and recovering covers the letters, the police report question, and what to do when a blocked entry comes back.

What to keep checking, and for how long

A stolen Social Security number does not expire. It can sit unused for a year and then appear in an application, so the watching period is long and the habits have to be light enough to sustain.

A workable routine: rotate one free credit report per month at AnnualCreditReport.com so you cover all three bureaus a few times a year; keep the freeze in place and lift it only when you apply for credit; keep the IRS Identity Protection PIN active and file your taxes early; check your my Social Security earnings record once a year; and keep transaction alerts on at every bank and card.

Watch the mail too. Statements or cards you did not request, a bill for an account you do not have, or a letter about a job you never took are all early signs, and they often arrive before anything shows up in a credit file.

Nobody can promise that a number, once out, is made safe again. What you can do is make it hard to use, notice quickly when someone tries, and have the documentation ready. If a service or a caller offers to remove your number from criminal hands or guarantee it is clean, that offer is not real, and people who have just been victimized are a specifically targeted audience for that pitch.

Stolen Social Security number FAQ