What Is Social Security Identity Theft? How It Happens and What to Do About It

Your Social Security number doesn’t expire. It doesn’t reset. Once it’s out there, it’s out there for good — which is exactly why it’s the single most valuable piece of paper a criminal can get their hands on.

Social Security identity theft happens when someone gets your nine-digit number and uses it as if it were their own — to open a credit card, file a tax return, get medical care, or even land a job. Your name stays out of it. Your number does the work.

This guide walks through how it actually happens, the warning signs most people miss, and the exact steps to take if you think your SSN has already been compromised.

How Someone Actually Gets Your Social Security Number

Movies make this look complicated. It usually isn’t.

Data breaches. This is the big one. A company you’ve never even dealt with — your employer’s payroll vendor, a hospital, a retailer — gets hacked, and your SSN goes with it. You don’t get a say in this. You just get a letter, months later, telling you it already happened.

Phishing. A call, text, or email pretending to be the IRS, a bank, or “Social Security Administration security.” The message creates panic — your benefits are suspended, your account is locked — and panic makes people hand over information they’d never give out on a calm afternoon.

Old-fashioned theft. A stolen wallet with your Social Security card in it. Mail lifted from an unlocked mailbox — W-2s and 1099 forms print your full SSN, which makes them a jackpot for anyone rifling through your mailbox. Mail theft is also a federal felony that can carry up to five years in prison, though that rarely stops it from happening.

Dumpster diving. Bank statements, old tax paperwork, pre-approved credit offers — thrown out whole, never shredded. If you want the mechanics on this one specifically, our breakdown of dumpster diving identity theft covers how thieves piece together a full identity from a single week of unshredded trash.

Synthetic identity fraud. This is the newer, quieter version. A criminal combines a real SSN — often a child’s, since it has no credit history to flag anything odd — with a made-up name and birthdate. The result is a “person” who doesn’t exist but builds real credit over years before disappearing with the debt.

Here’s the part that catches people off guard: you don’t have to do anything wrong for this to happen to you. Most victims never lost their card, never clicked a bad link, never fell for a call. Their number was just sitting in a database that got hit.

The Warning Signs People Miss

Nobody gets a notification that says “your SSN has been stolen.” You have to notice the fallout yourself, and the fallout is often small and easy to explain away — right up until it isn’t.

• A credit card or loan application gets denied, and you never applied for it
• Your credit report shows an account, inquiry, or address change you don’t recognize
• The IRS rejects your tax return because one was already filed under your SSN
• You get a bill for medical care you never received
• Your Social Security earnings statement shows income from a job you never had
• Debt collectors start calling about accounts you’ve never heard of

Any one of these on its own could be a clerical error. Two or three together, and it’s not a coincidence anymore.

What to Do the Moment You Suspect It

Speed matters here more than almost anywhere else in consumer protection. The longer a stolen SSN sits active, the more accounts get opened, and the harder each one is to unwind.

1. File a report at IdentityTheft.gov. This is run by the Federal Trade Commission, and it walks you through each recovery step, pre-fills the letters and forms you need, and tracks your progress as you go. Start here before you call anyone else — the report itself becomes documentation you’ll need later.
   
2. Freeze your credit at all three bureaus. Equifax, Experian, and TransUnion each require a separate freeze — one bureau won’t notify the other two automatically. A freeze is free, doesn’t touch your credit score, and blocks new accounts from being opened in your name until you lift it. If you’re not sure whether someone has already opened something in your name, check what accounts are tied to your SSN before you freeze, so you know what you’re dealing with.
   
3. Check your Social Security earnings record. Create or log into your account at ssa.gov/myaccount and look for income you didn’t earn. That’s often the first sign someone is using your number for work. This guide on spotting SSN misuse goes through exactly what to look for on that statement.
   
4. File your taxes early — and file Form 14039 if the IRS rejects you. Tax fraud tied to stolen SSNs is common enough that filing the moment your W-2 arrives can beat a fraudster to the refund. If your return gets rejected because one was already filed, the IRS’s Identity Theft Affidavit (Form 14039) starts the correction.
   
5. Lock your SSN for employment purposes. The Department of Homeland Security and SSA jointly run E-Verify’s “Self Lock” feature at e-verify.gov/mye-verify, which stops anyone from using your number to pass a work-eligibility check.
   
6. Report it to the SSA Office of the Inspector General. The Social Security Administration itself doesn’t resolve identity theft cases — it directs you to the FTC — but the OIG fraud hotline (1-800-269-0271) is where misuse of your number for benefits or employment gets logged on their end.
   

Skip any one of these and you’ll likely be back doing it in six months, after a second account surfaces.

Why This Is Different From Other Identity Theft

Losing a stolen credit card is annoying. You cancel it, a new one arrives in five days, and the problem is over. A stolen SSN doesn’t work that way — you can’t cancel it, and in almost every case, you can’t get a new one either. The SSA only issues a replacement number in narrow situations (ongoing, provable fraud after every other remedy has failed, or specific safety and religious exceptions), and even then, your old number stays linked to your history forever.

That permanence is what makes it worth understanding the legal side, not just the practical side. If your number was exposed through a company’s data breach rather than something you did, the effects can compound for years — credit damage, tax complications, and in some cases, criminal charges filed against the wrong person entirely. It’s also worth knowing that identity theft is treated as a federal felony in most states, which matters if you’re deciding whether to push for a police report or a federal referral.

If Your Child’s SSN Is the One at Risk

Kids’ Social Security numbers are attractive to thieves for one reason: nobody’s watching them. A child’s SSN can sit unused and unmonitored for a decade before anyone checks, which gives a fraudster years to build fake credit on a number that should be completely clean. If your child received a letter about a data breach, or you’re just being cautious, here’s how to check whether your child’s SSN is being misused and what to submit if it is.

Who Actually Investigates This

This is where a lot of victims lose momentum — they report the theft and then wonder why nothing seems to be happening. The honest answer is that enforcement is split across several agencies, and each one owns a different piece:

• The FTC, through IdentityTheft.gov, builds your recovery plan and logs your case into a national database used by law enforcement
• The IRS handles tax-related misuse specifically, through Form 14039
• The SSA’s Office of the Inspector General investigates misuse tied to benefits or employment
• Local police can take a report, though investigation depth varies a lot by department and case backlog
• The FBI, through IC3.gov, gets involved in larger organized rings — dark web SSN sales, multi-state synthetic identity operations — more than individual cases

Filing with all of them isn’t overkill. It’s how the paper trail gets built if you ever need to prove, to a lender or the IRS, that the fraud wasn’t yours.

How to Keep This From Happening Again

• Shred anything with your SSN before it goes in the trash — bank statements, old tax forms, pre-approved credit offers
• Never carry your physical Social Security card in your wallet
• Lock your mailbox, or switch to informed delivery through USPS so you know what’s coming
• Freeze your credit even if nothing’s happened yet — it costs nothing and doesn’t expire
• Be suspicious of anyone who calls asking you to “confirm” your SSN, especially if they created urgency to get it

None of this makes you untouchable. Data breaches happen at the company level, and no amount of shredding stops a vendor you’ve never heard of from getting hacked. But it closes off the low-tech routes, which are still how a lot of this happens.

Frequently Asked Questions

Can I get a new Social Security number if mine is stolen? 

Rarely, and only in narrow circumstances. The SSA’s own criteria require proof of ongoing harm after fraud alerts and credit freezes have already failed to stop it — a new number isn’t handed out just because your SSN was exposed in a breach.

Does a credit freeze hurt my credit score?

 No. A freeze restricts who can view your report to open new credit — it doesn’t lower your score, and you can lift it temporarily any time you need to apply for something.

Will the Social Security Administration investigate my case?

 Not directly. The SSA refers identity theft cases to the FTC, though its Office of the Inspector General does investigate misuse tied specifically to benefits or work history.

How long does it take to fix Social Security identity theft?

 It depends on how many accounts were opened and how many agencies are involved. Clearing a single fraudulent account can take weeks; unwinding tax fraud or years of synthetic credit history can take much longer.

Is stealing a Social Security number a federal crime?

 Yes. Using someone else’s SSN without permission to commit fraud is a federal offense under 18 U.S.C. § 1028, on top of any state identity theft statute that applies.

What’s the very first thing I should do if I think my SSN was stolen?

 File your report at IdentityTheft.gov first. It generates the documentation you’ll need for every other step — the credit freeze, the IRS form, the SSA report — so starting there saves you from repeating yourself five times.

Sources

• Federal Trade Commission — IdentityTheft.gov, Steps to Recovery: identitytheft.gov/Steps
• Social Security Administration — Identity Theft and Your Social Security Number (Publication EN-05-10064): ssa.gov/pubs/EN-05-10064.pdf
• Social Security Administration — Fraud Prevention and Reporting: ssa.gov/fraud
• Social Security Administration — Report a Stolen Social Security Number: ssa.gov/number-card/report-stolen-number
• Internal Revenue Service — Reporting Identity Theft: irs.gov/faqs/irs-procedures/reporting-identity-theft
• 18 U.S.C. § 1708 — Theft or Receipt of Stolen Mail Matter
• 18 U.S.C. § 1028 — Fraud and Related Activity in Connection With Identification Documents

This article is for informational purposes only and does not constitute legal advice. Laws vary by state and individual circumstances differ. For advice about your specific situation, consult a qualified attorney.

Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com.