First, take a breath
Learning that someone may have your Social Security number is alarming. But having your SSN doesn’t mean a scammer can immediately destroy your finances or steal your identity. There are concrete steps you can take right now to protect yourself, and many forms of fraud can be caught and reversed if you act quickly.
This guide is organized by priority. Start at the top and work through each section. You don’t need to do everything in one sitting—what matters is getting the most important protections in place first.
How to know if your SSN was actually compromised
Before taking action, consider how certain you are that your SSN is in the wrong hands. Common situations include:
Confirmed exposure: You entered your SSN on a website you later realized was fake, gave it to someone impersonating a government agency, or received official notice of a data breach affecting your records.
Likely exposure: You shared documents containing your SSN with someone who turned out to be a scammer, or you lost your Social Security card or documents containing the number.
Possible exposure: You received a suspicious call or email that referenced your SSN (scammers sometimes have partial numbers from data breaches), or you’re seeing unfamiliar activity that suggests someone is using your identity.
Even if you’re only in the “possible” category, the protective steps below are free and cause no harm. When in doubt, proceed as if exposure occurred.
Step 1: Freeze your credit (do this first)
A credit freeze prevents anyone—including you—from opening new credit accounts in your name. It’s the single most effective protection against identity theft, and it’s free.
You must freeze your credit at all three major bureaus separately:
Each bureau will give you a PIN or password. Store these securely—you’ll need them to temporarily lift the freeze when you legitimately apply for credit. The process takes about 10-15 minutes per bureau.
Step 2: Place a fraud alert
A fraud alert tells creditors to verify your identity before opening new accounts. Unlike a freeze, you only need to contact one bureau—they’re required to notify the other two.
An initial fraud alert lasts one year and is free. If you’ve confirmed identity theft, you can request an extended fraud alert lasting seven years.
A fraud alert provides less protection than a freeze but is a good backup. Creditors are supposed to take extra steps to verify identity, though compliance varies.
Step 3: Check your credit reports
Review your credit reports for accounts you don’t recognize. You’re entitled to free weekly reports from all three bureaus at AnnualCreditReport.com.
Look for:
- Accounts you didn’t open
- Addresses where you’ve never lived
- Employers you’ve never worked for
- Hard inquiries you don’t recognize (these indicate someone applied for credit in your name)
If you find fraudulent accounts, you’ll need to dispute them with each bureau and file an identity theft report (covered below).
Step 4: Monitor your existing accounts
While a credit freeze protects against new accounts, it doesn’t protect existing ones. Review your bank accounts, credit cards, and investment accounts for unauthorized transactions.
Set up transaction alerts if you haven’t already—most banks can text or email you for any transaction over a threshold you choose. Some people set this to $1 to catch small “test” charges scammers use before making larger fraudulent purchases. For more on protecting your accounts, see our guide on how to secure your online accounts.
Step 5: Consider an IRS Identity Protection PIN
Tax refund fraud is a common use of stolen SSNs. Scammers file fake tax returns early in the season, claim your refund, and leave you to sort out the mess with the IRS.
An IRS Identity Protection PIN (IP PIN) is a six-digit number that prevents anyone from filing a tax return with your SSN unless they have the PIN. You can request one at irs.gov/ippin.
Once you opt in, you’ll receive a new PIN each year by mail. You’ll need this PIN to file your own taxes, so store it securely.
Step 6: File official reports
If you’ve confirmed fraudulent use of your SSN (not just exposure), file these reports:
FTC Identity Theft Report: File at IdentityTheft.gov. This creates an official identity theft report and generates a personalized recovery plan. The report can be used when disputing fraudulent accounts.
Local Police Report: Some creditors require a police report to remove fraudulent accounts. Bring your FTC report and any documentation of the fraud.
Social Security Administration: If you believe someone is using your SSN for work (you receive W-2s from employers you don’t recognize, or your Social Security earnings statement shows income you didn’t earn), contact the SSA at ssa.gov or 1-800-772-1213.
What you don’t need to do
You don’t need to pay for credit monitoring services. Free monitoring is available through many banks, credit cards, and at the credit bureaus themselves. Paid services rarely offer protection beyond what you can do yourself for free.
You generally cannot get a new Social Security number. The SSA only issues new numbers in extreme cases of ongoing, documented harm despite taking all protective steps. The bar is very high, and a new number creates its own complications (no credit history, employment verification issues). Focus on the protections above instead.
Ongoing protection
Identity protection isn’t one-and-done. After completing the steps above:
- Check your credit reports every few months for the first year
- Review your Social Security statement annually at ssa.gov/myaccount
- Keep your credit frozen by default—only lift it temporarily when you need new credit
- Watch for government impersonation scams that reference your SSN to create false urgency
Taking these steps puts you ahead of most people. Scammers prefer easy targets—the protections you’ve put in place make your identity much harder to exploit.