What to Do If Your Social Security Number Is Stolen or Compromised

Fact-checked by the The Credit Scout editorial team

Knowing what to do if your Social Security number stolen compromised starts with one hard fact: a data breach notice is not the same as confirmed misuse. In 2025 alone, the Identity Theft Resource Center tracked 3,322 data compromises across the U.S., a record, according to the ITRC’s 2025 Annual Data Breach Report. Most of those breaches exposed Social Security numbers. But exposure does not automatically mean a thief has opened accounts in your name. It means your number is out there, and you need to act before it gets used.

This guide lays out the exact sequence: confirm the compromise, lock down your credit, protect your tax records, scrub your financial footprint, and set up monitoring that actually works. You will also see why requesting a new SSN from the Social Security Administration almost never happens, and what to do instead. Every step references the agency or form that makes it enforceable, because thieves do not respond to good intentions. They respond to freezes, fraud alerts, and official reports.

How to Confirm Your SSN Has Actually Been Compromised

A breach notification letter telling you your data was exposed is not the same as finding a fraudulent account on your credit report. The first category demands caution. The second demands immediate triage. You confirm by looking at three things: your credit reports, your IRS transcript activity, and any mail or calls from creditors you never contacted.

Start by pulling your free credit reports from AnnualCreditReport.com. Federal law still guarantees one free report per bureau per week through 2026. Look for hard inquiries you did not initiate, those are the smoking gun. A soft inquiry from a pre-approval campaign means nothing. A hard pull from a lender you never applied to means someone tried to borrow money in your name.

Warning Signs That Your SSN Is Being Actively Misused

Here is the cheatsheet. A rejected tax return because the IRS already received one under your SSN. A Form 1099-G showing unemployment benefits you never claimed. A medical bill from a provider you have never seen. A notice from the Social Security Administration about wage discrepancies on your earnings record, this one matters because future retirement benefits are calculated from those earnings. If someone else’s W-2 wages are landing on your record, your eventual benefit calculation will be wrong until you fix it.

You might also get a debt collection call for an account you never opened. Do not ignore it and do not pay it. Ask the collector for a validation notice in writing. That notice gives you the account details you need to file a dispute and an identity theft report.

Free Tools to Check Without Alerting Thieves

You can check your Social Security earnings statement online at SSA.gov/myaccount. Look at the reported wages for each year. If you see income from an employer you never worked for, your SSN is in active misuse for employment fraud. Contact the SSA’s fraud hotline at 1-800-269-0271.

Also create an account with the IRS at IRS.gov/account and review your tax transcript for the last three filing years. A transcript showing a return you did not file is definitive proof of tax identity theft.

What to Do in the First 24–48 Hours

Move fast, but move in the right order. The first stop is IdentityTheft.gov. It is run by the Federal Trade Commission, and it generates a personalized recovery plan based on what you tell it. The plan updates as you check off steps, so you are not guessing what comes next. When you complete the process, you get an official Identity Theft Report. That document is the piece of paper creditors, credit bureaus, and even police departments need to take your dispute seriously.

Here is the sequence, in order: file the FTC report, place fraud alerts or credit freezes, contact the fraud department of every financial institution where a fraudulent account was opened, file a police report if the FTC plan tells you to, and request your IRS Identity Protection PIN. Do not reverse the order, the FTC report is what makes the other steps enforceable.

Why a Police Report Matters Downstream

Not every FTC recovery plan requires a police report. But here is when you should file one anyway: the thief used your name during a police encounter, opened utility accounts, committed tax fraud, or the fraudulent activity exceeds a few thousand dollars. A police report does something the FTC report alone cannot, it creates a sworn law enforcement record. Some creditors and debt collectors will only permanently remove a fraudulent account if you provide both the FTC Identity Theft Report and a police report.

Go to your local police department with your FTC report, a government-issued ID, and proof of your address. Tell them someone committed identity theft using your SSN and you need a report to dispute fraudulent accounts. Most departments will take the report even if the fraud happened online or across state lines.

Locking Down Your Credit Immediately

A credit freeze stops anyone from pulling your credit report to open a new account. A fraud alert tells lenders to verify your identity before extending credit. They are not the same thing, and USA.gov recommends doing both. A freeze is stronger, it blocks access entirely. A fraud alert is faster, it requires only one call to one bureau, and that bureau notifies the other two.

Here is the distinction that matters: a freeze does nothing once a thief already has access to an existing account. If someone compromised your SSN and used it to take over your checking account or your existing credit card, the freeze will not stop them. You handle that separately by contacting the bank’s fraud department and closing the compromised account.

How to Place a Freeze at All Three Bureaus

You must contact Equifax, Experian, and TransUnion separately. Each has an online freeze portal; each will ask for your name, address, date of birth, and SSN. You will create a PIN or password for each one. Store those PINs somewhere you will not lose them, because lifting a freeze without the PIN means a mailed verification process that takes days, not what you want when you are applying for a mortgage.

Equifax: equifax.com/freeze. Experian: experian.com/freeze. TransUnion: transunion.com/freeze. A freeze does not affect your credit score, does not block you from checking your own report, and does not stop pre-screened credit offers, you opt out of those separately at OptOutPrescreen.com.

Protecting Your Tax Records and IRS Account

Tax identity theft works like this: a thief files a fraudulent return using your SSN early in tax season and collects your refund before you even file. You find out when the IRS rejects your return because one was already processed under your number. The fix is an Identity Protection PIN, a six-digit code the IRS issues to verified taxpayers. Without the correct IP PIN, a return gets rejected, even if the SSN matches.

Request your IP PIN at IRS.gov/ippin. You must verify your identity, and once issued, the PIN changes every year. The IRS mails you a new one each December. You cannot opt out once enrolled without going through additional verification.

When the IRS Has Already Flagged Your Account

If you received a Letter 5071C or Letter 4883C from the IRS, they have already flagged your return as suspicious and are asking you to verify your identity. This is proactive, the IRS caught something before processing. Respond using the online verification tool or the phone number in the letter. If you received a notice that a return was already filed under your SSN, file Form 14039, the Identity Theft Affidavit, and attach it to your paper-filed return. The IRS’s Identity Theft Guide for Individuals walks you through both scenarios.

One gap most people miss: check your Social Security earnings record after a known tax fraud incident. A thief who filed a return with fake W-2 data may have also contaminated your lifetime earnings record. If the SSA shows wages from an employer you do not recognize, correcting it now protects your future retirement and disability benefit calculations. Call the SSA at 1-800-772-1213 and request a correction.

Reviewing Your Financial Footprint

Pull all three credit reports and look at every account, every inquiry, every address, and every employer listed. Dispute anything that is not yours. The dispute process at each bureau is online and free. Attach your FTC Identity Theft Report to every dispute, it forces the bureau to block the fraudulent information within four business days under the Fair Credit Reporting Act. Without that report, the bureau has 30 days to investigate. With it, the timeline collapses.

Contact the fraud department of every bank, credit card issuer, or utility where a fraudulent account was opened. Ask for the account to be closed and flagged as identity-theft-related. Request a letter confirming the account was not yours and the balance is not your responsibility. You will need that letter if a debt collector later buys the charged-off account. If you need a step-by-step framework for disputing accounts and rebuilding afterward, our DIY credit repair guide lays out the exact letters and response timelines.

Ongoing Monitoring and the Reality of Requesting a New SSN

The Social Security Administration rarely issues new Social Security numbers. The criteria are narrow: you must prove ongoing, severe harm that cannot be fixed by other means, and the misuse must be continuing despite freezes and fraud alerts. Even then, most requests are denied. A new SSN severs the link to your earnings history. Your old wages do not automatically transfer. You start with a blank record, which creates problems for retirement benefits, disability eligibility, and even employment verification. Our breakdown of Social Security changes in 2026 explains how benefit calculations depend on a continuous earnings record.

For most people, the answer is not a new SSN. It is ongoing monitoring. Free weekly credit reports from AnnualCreditReport.com remain available. Set a recurring calendar reminder every month to scan your reports. Bank and credit card account alerts are free, turn on notifications for every transaction over a dollar. The FTC testified in March 2026 that consumer-reported fraud losses keep climbing, and the most effective defense is early detection through account-level alerts, not passive monitoring.

Free vs. Paid Credit Monitoring

Free monitoring through your bank or credit card issuer usually covers one bureau and alerts you to new accounts or inquiries. Paid services from companies like LifeLock or IdentityForce monitor all three bureaus and scan dark-web databases for your SSN. Here is the tradeoff: paid monitoring often includes insurance reimbursement for stolen funds and access to resolution specialists, useful if you are dealing with complex credit damage that spans multiple account types. But it cannot stop fraud from happening. Only freezes and IP PINs do that.

When to Re-Evaluate

After six to twelve months with no new fraudulent activity, you can consider the immediate threat contained. Do not lift the freezes unless you have a specific reason, applying for a mortgage, a car loan, or a new credit card. When you do lift a freeze, lift it temporarily for a specific creditor rather than permanently. The minor inconvenience of scheduling a thaw window is worth it. If you are rebuilding credit alongside handling identity theft, knowing the difference between secured and unsecured cards helps you pick the right tool once your reports are clean.

Frequently Asked Questions

What is the first thing I should do if my Social Security number is stolen?

File a report at IdentityTheft.gov immediately. The FTC will generate a personalized recovery plan and provide an official Identity Theft Report. That document is the foundation for every dispute, freeze, and fraud alert that follows.

Does a credit freeze affect my credit score?

No. A freeze restricts access to your credit report but does not change the data inside it. Your score, your existing accounts, and your payment history stay exactly as they were. You can still check your own report anytime.

How long does a fraud alert last, and can I renew it?

An initial fraud alert lasts one year. If you provide an FTC Identity Theft Report, you can place an extended fraud alert that lasts seven years. You renew it by contacting any of the three bureaus before the alert expires.

Can a stolen SSN affect my Social Security retirement benefits?

Yes. If a thief uses your SSN for employment, their wages may appear on your earnings record. Since your future benefits are calculated from your lifetime reported earnings, incorrect wage data can distort the calculation. Check your earnings statement annually at SSA.gov and report discrepancies immediately.

Should I pay for credit monitoring or use free tools?

Free tools, credit freezes, fraud alerts, weekly credit reports, and IRS IP PINs, do the heavy lifting of prevention. Paid monitoring adds dark-web scanning and resolution services, which are useful if you are managing simultaneous fraud incidents. Start with the free tools. Add paid services only if the scope of damage justifies the cost.

What if a minor child’s Social Security number is compromised?

Freeze their credit at all three bureaus. Each bureau has a process for placing a freeze on a minor’s file, you will need to submit proof of your identity, your child’s identity, and your legal guardianship. A child’s clean credit file is valuable to thieves precisely because nobody checks it until the child turns 18 and applies for student loans. College financial aid eligibility can be affected if fraudulent accounts exist in the child’s name.

Can I ever get a completely new Social Security number?

The Social Security Administration approves new SSNs only in extreme, documented cases of ongoing harm that cannot be resolved through freezes, fraud alerts, or law enforcement intervention. Most requests are denied. Even if approved, a new number severs your connection to your earnings history, complicating retirement benefits and employment verification.