A Social Security number can be used with other personal information to apply for credit, file a fraudulent tax return, obtain employment, or impersonate someone when opening an account. Unlike a password, it cannot simply be changed after every security incident.
An exposed number does not necessarily mean identity theft has occurred. It does mean the affected person should take practical steps to make misuse harder and watch for warning signs.
Confirm That the Breach Notice Is Genuine
Scammers sometimes impersonate breached companies and offer fake protection services. Do not use a link or phone number in an unexpected message until the notice has been verified.
Contact the organization through its official website, a trusted account portal, or a phone number from an existing statement. Ask:
Whether your Social Security number was involved
What other information was exposed
When the incident occurred
When the company discovered it
Whether the information was encrypted
Whether there is evidence of misuse
What protection services are being offered
How long enrollment remains available
Save the breach notice. It may be useful if fraudulent accounts or tax problems appear later.
Change Passwords for Affected Accounts
A Social Security number cannot be reset, but passwords can. Change the password for the breached account and any other account using the same or a similar password.
Prioritize:
Email accounts
Bank and credit card accounts
Payroll and employee portals
Tax preparation accounts
Insurance accounts
Government benefit accounts
Mobile phone accounts
Cloud storage
Use a unique password for each important account and turn on two-factor authentication. An authentication app or security key may offer stronger protection than text messages when supported.
Review recovery email addresses, phone numbers, trusted devices, and security questions. An intruder may change these settings to preserve access after the password is reset.
Freeze All Three Credit Reports
A credit freeze restricts access to a credit report, making it harder for an identity thief to open a new credit account. Placing and lifting a freeze is free, does not affect a credit score, and remains in effect until the consumer removes it.
Contact each of the three nationwide credit bureaus separately:
Equifax
Experian
TransUnion
A freeze placed with one bureau does not automatically freeze the other two.
Store the account information needed to manage each freeze in a secure location. When applying for a loan, rental, insurance policy, or other service involving a credit check, the consumer can temporarily lift the necessary freeze and restore it afterward.
A credit freeze does not block fraud involving an existing bank account, credit card, government benefit, or tax return. The remaining steps are still important.
Consider Adding a Fraud Alert
A fraud alert tells businesses to take additional steps to verify identity before opening credit. An initial fraud alert is free, lasts one year, and can be renewed.
Unlike a credit freeze, a fraud alert does not prevent businesses from accessing the credit report. A consumer needs to contact only one of the three nationwide credit bureaus to place an initial alert; that bureau must notify the other two.
People who have experienced identity theft and completed an FTC Identity Theft Report or police report may qualify for an extended fraud alert lasting seven years.
A consumer can use both a credit freeze and fraud alert.
Review All Three Credit Reports
Check each credit report for:
Accounts you do not recognize
Credit inquiries you did not authorize
Incorrect addresses or employers
Collection accounts that are not yours
Unfamiliar loans or credit cards
Unexpected changes to account balances
Personal information belonging to someone else
An unfamiliar company name is not always fraudulent because lenders and collection agencies may appear under parent-company names. Investigate it before disputing it.
Continue checking reports after the initial review. Stolen information may be used months or years after a breach.
Monitor Existing Financial Accounts
Review checking, savings, credit card, investment, and payment-app activity. Turn on alerts for:
New transactions
Large purchases
Cash withdrawals
Password changes
New transfer recipients
Address changes
Login attempts from unfamiliar devices
Report unauthorized transactions promptly. Different accounts and payment methods have different reporting deadlines and consumer protections, so waiting may affect available remedies.
Do not rely solely on credit monitoring. It may notify a consumer after certain activity appears, but it generally does not prevent the activity.
Secure Your Social Security Account
Create or sign in to a personal Social Security account through the official Social Security Administration website. Use a unique password and available security protections.
Review:
Personal details
Benefit information
Direct-deposit information
Applications or claims
The earnings history on the Social Security Statement
Unfamiliar earnings may indicate that someone is using the Social Security number for employment. Report discrepancies to the Social Security Administration and preserve supporting wage and tax records.
Social Security will not call unexpectedly to threaten suspension of a Social Security number or demand payment. A Social Security number cannot be “suspended” because of a breach.
Protect Your Federal Tax Return
An identity thief may use a stolen Social Security number to file a fraudulent tax return and claim a refund. Consider obtaining an IRS Identity Protection Personal Identification Number, commonly called an IP PIN.
An IP PIN is a six-digit number known to the taxpayer and the IRS. It helps prevent someone else from filing a federal tax return using the taxpayer’s Social Security number. Eligible taxpayers can request one proactively, even if tax identity theft has not occurred.
A new IP PIN is issued for each calendar year. Keep it secure and provide it only to a trusted tax preparer when completing a return. The IRS does not call, email, or text to request an IP PIN.
File tax returns promptly once all necessary records are available. Contact the IRS if an electronic return is rejected because a return using the same Social Security number has already been filed, or if an unexpected tax notice arrives.
Use the FTC Recovery Process if Misuse Occurs
If someone actually uses the exposed information, report the identity theft through the Federal Trade Commission’s official identity-theft recovery service. The process can generate an FTC Identity Theft Report and a personalized recovery plan.
An Identity Theft Report can help when asking a business or credit bureau to:
Block fraudulent information
Close an unauthorized account
Correct an identity-theft-related record
Stop collection of a fraudulent debt
Provide records connected to the fraud
Do not file an identity theft report claiming misuse if the number was merely exposed and no fraudulent activity has been discovered. Consumers can still freeze credit and take preventive steps after a breach.
Contact the Affected Company
Ask the breached organization what assistance it will provide. It may offer:
Credit monitoring
Identity monitoring
Identity restoration assistance
Insurance for certain identity-theft expenses
A dedicated support line
Read the enrollment terms. Determine which credit bureau is monitored, how long the service lasts, what alerts it provides, and whether it renews automatically.
A free monitoring offer can be useful, but it should not replace a credit freeze or regular account review.
Document Every Sign of Misuse
Create a file containing:
The original breach notice
Credit reports
Fraud alerts and freeze confirmations
Account statements
Collection letters
Tax notices
Emails with businesses
FTC and police reports
Dates and summaries of phone calls
Receipts for related expenses
When calling a company, record the date, representative’s name, case number, and promised next step. Send important disputes in a trackable form and keep copies.
Report Fraudulent Accounts Directly
If an unfamiliar account appears, contact the company’s fraud department using verified contact information. Explain that the account resulted from identity theft and request that it be closed or blocked.
Ask what documentation the company requires. It may request proof of identity, an FTC Identity Theft Report, a police report, or a written statement.
Dispute the account with the credit bureaus as well. Correcting one company’s internal records does not always remove the item from every credit report automatically.
Watch for Employment and Benefit Fraud
Credit reports do not show every form of Social Security number misuse. Review:
Social Security earnings records
IRS wage and income records
Unemployment benefit notices
Health insurance explanations of benefits
Government benefit correspondence
Mail from unfamiliar employers or agencies
Contact the relevant agency if records show wages, benefits, or services that do not belong to you. Someone using a Social Security number for work can create tax and earnings-record problems even when no credit account is opened.
Be Alert for Follow-Up Scams
After a publicized breach, criminals may contact affected people while pretending to represent the company, a credit bureau, Social Security, the IRS, or a fraud-recovery service.
Do not provide a password, verification code, full Social Security number, bank information, or payment to an unexpected caller. Do not move money to a “safe” account or pay through cryptocurrency, wire transfer, gift card, or cash.
End the communication and contact the organization independently.
Continue Monitoring Over Time
A Social Security number can remain useful to criminals long after the original breach. Keep credit freezes active when not applying for credit, review financial accounts regularly, and check credit and Social Security records periodically.
Repeat these checks after a move, tax season, an unexpected account denial, or suspicious mail. Also update contact information with financial institutions so alerts and statements reach the correct address.
The most effective response combines prevention and monitoring. Freezing credit, securing important accounts, protecting tax filings, and keeping organized records can make misuse more difficult and reduce the time needed to correct it if identity theft occurs.
Disclaimer: This article provides general educational information and is not individualized legal or financial advice. Identity-theft protections, reporting deadlines, and available remedies may vary according to the account, type of misuse, state, and jurisdiction. Consumers dealing with active fraud may wish to contact the appropriate agency or a qualified attorney promptly.
