Protect your SSN and identity, and what to do if it's stolen

Step 1 — Keep your card at home and share your number only when you must

SSA warns that thieves can use your SSN to apply for credit in your name (SSA — Publication 05-10064). (To get a number, see our Social Security number guide.)

• Keep the card in a safe place, not in your wallet (USA.gov). Don’t routinely carry papers that show your number (SSA).
• Give it where it’s needed: to your employer, checking they have it right, and to your bank for tax reporting (SSA). The IRS, your bank and your employer need your SSN, but they won’t call, email or text you to ask for it (FTC).
• Ask first everywhere else. A medical provider, a company or your child’s school might not really need it. The FTC suggests asking: Why do you need it? How will you protect it? Can you use a different identifier, or just the last four digits? If the answers don’t satisfy you, don’t share it (FTC). SSA also suggests asking what happens if you refuse (SSA). For landlords, see renting your first apartment.
• Shred papers with personal or financial information before you throw them away (FTC), and collect your mail every day (USA.gov).

Lost or stolen card? A replacement is free, but SSA says you usually don’t need the physical card if you know your number (SSA — Replace card). If your number was exposed (lost, stolen or in a data breach) but not misused, you don’t need an FTC identity theft report; IdentityTheft.gov explains how to check, freeze and monitor your credit (SSA — Fraud).

Step 2 — Open your official online accounts before someone else does

• my Social Security. SSA says opening your own account at ssa.gov/myaccount prevents identity thieves from opening one in your name, and alerts you if anyone tries to change your address or direct deposit (SSA — Scams). You can also review your earnings record, signing in with Login.gov or ID.me (SSA).
• Strong log-ins. Use strong passwords and two-factor authentication where it’s offered (FTC).
• Your phone number. Scammers try to move (“port out”) your number to read the security codes your bank texts you; the FCC suggests asking your phone company about adding a PIN or password (FCC). More in our phone guide.
• Optional: E-Verify Self Lock. A free myE-Verify account, opened through a USCIS online account, lets you lock your SSN so no one else can use it for an E-Verify case (E-Verify; Self Lock). Unlock it before you start a job with an employer that uses E-Verify, or the check will show a mismatch (E-Verify — Self Lock).

Step 3 — Freeze your credit, for free

With a credit freeze, nobody can open a new credit account in your name, and the FTC adds (FTC):

• anyone can freeze their credit, for any reason; you don’t have to wait for a data breach;
• placing and lifting a freeze is free, and it doesn’t affect your credit score;
• it lasts until you lift it;
• you contact all three credit bureaus: Equifax, Experian and TransUnion.

The CFPB links to each bureau’s freeze page; during a freeze, you can still get your own reports (CFPB). When you apply for credit, a job, an apartment or insurance, you can lift the freeze for a while; the FTC suggests lifting it only at the bureau that will be used (FTC). Parents can request a free freeze for a child under 16 (FTC).

Step 4 — Add a fraud alert if you suspect a problem

A fraud alert makes lenders verify your identity before they grant new credit in your name, but it doesn’t stop businesses from seeing your report (FTC). You contact one bureau, and it must tell the other two (FTC).

• An initial fraud alert lasts one year, can be renewed, and lets you get a free credit report from each bureau (FTC).
• An extended fraud alert lasts seven years. It’s for identity theft victims who have completed an FTC report at IdentityTheft.gov or filed a police report (FTC).

You can have a fraud alert and a freeze at the same time (FTC).

Step 5 — Protect your tax account with an IRS Identity Protection PIN

An IP PIN is a six-digit number that stops someone else from filing a tax return with your SSN or ITIN (IRS — IP PIN). Anyone with an SSN or ITIN who can verify their identity can enroll, parents can request one for dependents, and you can get one even if you don’t have to file (IRS).

• How: fastest through your IRS online account. Otherwise, the IRS lists Form 15227 (below an income limit on its page) or a Taxpayer Assistance Center appointment; people under 18 must use one of these (IRS).
• Every year: it’s valid for one calendar year, and a new one is generated each year. If you enrolled online, you look it up online; no letter is mailed (IRS).
• Keep it secret: use it only in your tax software or with the professional preparing your return. The IRS will never ask for it; calls, emails or texts asking for it are scams (IRS).

See also your first U.S. tax return and our ITIN guide.

Step 6 — Watch for warning signs

USA.gov lists bills for things you didn’t buy, debt collection calls for accounts you didn’t open, unknown accounts on your credit report, denied loan applications, and missing mail (USA.gov). The IRS adds a rejected tax return, a W-2 or 1099 from an employer you never worked for, and Social Security wages you didn’t earn (IRS — Identity theft guide).

Check your credit reports for accounts you don’t recognize (FTC); our credit guide shows how, for free. Thieves may also use your information to get a job or medical care (FTC); for unexpected medical bills, see where to get medical care. A phone that suddenly goes dark, or can only call 911, is typically the first sign your number was hijacked (FCC).

Step 7 — If your identity is stolen, act in this order

1. Stop all contact with the thief: hang up, don’t send money or information, and don’t click links (IRS).
2. Report it to the FTC at IdentityTheft.gov (in Spanish, RobodeIdentidad.gov). For another language, call 1-877-438-4338 and press 3; interpreters work 9 a.m. to 5 p.m. ET (FTC). You get a free recovery plan and pre-filled letters for credit bureaus, businesses and debt collectors (FTC).
3. Contact the credit bureaus and ask for fraud alerts and a credit freeze (USA.gov).
4. Call the fraud departments of your bank, card companies and other places where you have accounts (USA.gov). Replace any password the scammer has with a new, strong one (SSA — Scams).
5. Tax problems: follow the instructions in any IRS letter. Most people don’t need Form 14039 (Identity Theft Affidavit); file it only if the IRS tells you to, if you can’t use its online verification service, or to report tax-related identity theft it doesn’t know about (IRS). Don’t put income from an unknown employer’s W-2 or 1099 on your return; contact SSA (IRS). Get an IP PIN, and keep filing and paying as usual (IRS).
6. Someone working under your number: report it to SSA, which will review your earnings with you (SSA).
7. Keep records of letters, calls and emails (IRS).

Phone number hijacked? Contact your phone company and bank, file a police report, and place a fraud alert (FCC).

A new SSN is a last resort. SSA may assign one only if you’ve done all you can and someone is still using your number, and it warns that a new number won’t guarantee a fresh start (SSA). A lost card with no evidence of misuse is not enough (SSA).