How to Know If Your Social Security Number Has Been Stolen

Social Security identity theft happens when someone uses your Social Security number to open accounts, file tax returns, or get medical care in your name. The most common sign is a tax return you did not file, a credit card bill for an account you did not open, or a notice from the IRS saying your number was used on multiple tax returns. You might also see unfamiliar accounts on your credit report or get calls from debt collectors about debts you did not incur.

Check your credit report for free once a year at AnnualCreditReport.com — this is the official site run by the three major credit bureaus (Equifax, Experian, and TransUnion). Look for accounts, inquiries, or addresses you do not recognize. If you spot something wrong, that is often the first real sign that your number has been compromised. You can also create a free account at IRS.gov and check "Get Transcript" to see if anyone filed a return using your Social Security number.

Key Takeaways

  • The IRS, the Federal Trade Commission, and your state's attorney general are the three main places to report Social Security identity theft.
  • File a report with the FTC at IdentityTheft.gov, which creates an official record and gives you a recovery plan tailored to what happened.
  • Place a fraud alert with the three credit bureaus (Equifax, Experian, TransUnion) to make it harder for a thief to open new accounts in your name.
  • If a tax return was filed in your name, call the IRS at 1-800-908-4490 to report it and file Form 14039 (Identity Theft Affidavit) with your own return.
  • Keep copies of every report, letter, and document you file — you will need them to dispute fraudulent accounts and prove the theft to creditors.

Report the Theft to the Federal Trade Commission

The FTC runs IdentityTheft.gov, where you can file a report online for free. This report is your official record of the theft and creates a recovery plan specific to your situation — for example, if a credit card was opened in your name, the plan will tell you which companies to contact and what to say. The FTC does not investigate individual cases, but the report gives you legal standing to dispute fraudulent accounts and ask creditors to remove them from your record.

When you file at IdentityTheft.gov, you will answer questions about what happened: whether accounts were opened, whether tax fraud occurred, whether medical identity theft happened, or whether other misuse occurred. Answer as specifically as you can. The site then generates a personalized recovery plan with the names and phone numbers of the companies you need to contact. You can print this plan and use it as your roadmap.

File a Report With Your State Attorney General

Your state's attorney general office also takes identity theft reports. This creates a second official record and may help if you need to dispute charges or prove the theft to a creditor later. You can find your state attorney general's office by searching "[your state] attorney general identity theft" or by visiting the National Association of Attorneys General website.

Some states have their own online reporting systems; others ask you to mail or email a form. The process is usually simpler than the FTC report and takes less time. Having both reports on file strengthens your position if a creditor or debt collector disputes your claim that the account is fraudulent.

Contact the IRS If Your Tax Return Was Filed in Your Name

If someone filed a tax return using your Social Security number, call the IRS at 1-800-908-4490 and tell them what happened. The IRS has a dedicated identity theft unit. They will flag your account so that future returns filed in your name trigger a review. You will also need to file Form 14039 (Identity Theft Affidavit) with your own tax return — this tells the IRS that you are the real taxpayer and that the other return was fraudulent.

Keep the IRS case number they give you. When you file your own return, include a copy of the Form 14039 and a copy of your FTC identity theft report. The IRS typically takes several weeks to several months to resolve tax identity theft cases, so do not expect an when ready resolution. If the thief received a refund, the IRS will work to recover it, though this can take time.

Place a Fraud Alert and Consider a Credit Freeze

A fraud alert tells the three credit bureaus to flag your account. When a fraud alert is active, creditors must contact you by phone before opening a new account in your name. This makes it harder for a thief to open new credit cards or take out loans. You place a fraud alert by calling one of the three bureaus — Equifax, Experian, or TransUnion — and they are required to notify the other two.

A credit freeze is stronger: it locks your credit report so that no one can open a new account without your permission, even with your Social Security number. You have to unfreeze it temporarily if you want to explore for credit yourself. A freeze is free and lasts until you remove it. Many people who have experienced identity theft use a freeze as long-term protection. You can place a freeze by contacting each of the three bureaus directly through their websites.

Dispute Fraudulent Accounts and Debts

Once you have filed reports with the FTC and your state attorney general, use those reports to dispute fraudulent accounts. Write to each creditor or debt collector in writing (certified mail, return receipt requested) and include a copy of your FTC identity theft report. Tell them the account is fraudulent and that you are a victim of identity theft. By law, they must investigate and remove the account if they cannot prove you opened it.

Also dispute the fraudulent accounts on your credit report. Contact each of the three bureaus in writing and include a copy of your FTC report. They are required to investigate and remove accounts that you dispute as fraudulent. Keep copies of everything you send and every response you receive. These documents are your proof if a debt collector tries to collect again or if a creditor refuses to remove the account.

Monitor Your Credit and Accounts Going Forward

After identity theft, check your credit report every few months for the next year or two. You can get free reports at AnnualCreditReport.com, or you can use a credit monitoring service (many are free, though some charge). Watch for new accounts, new inquiries, or changes to your address. The sooner you spot new fraud, the faster you can stop it.

You can also set up fraud alerts on your bank and credit card accounts directly through your financial institutions' websites. Many banks and card issuers offer free monitoring tools that alert you to suspicious activity. Check your bank and credit card statements every week, not just once a month, so you catch unauthorized charges quickly.

Frequently Asked Questions

How long does it take to fix identity theft?

It depends on what happened. Removing a fraudulent credit card account usually takes 30 to 60 days once the creditor investigates. Tax identity theft can take several months to a year to fully resolve with the IRS. Fraudulent accounts on your credit report must be investigated within 30 days, but removal can take longer. Keep checking your credit report and following up with creditors until everything is resolved.

Will identity theft hurt my credit score?

Yes, fraudulent accounts and missed payments (made by the thief) will lower your credit score. Once you dispute the accounts and they are removed from your credit report, your score should recover over time. The damage is temporary if you act quickly. This is another reason to check your credit report as soon as you suspect theft.

Can I get a new Social Security number?

The Social Security Administration can issue a new number, but only in rare cases and only after you have reported the theft and taken steps to resolve it. A new number does not erase the old one from records, so it is not a complete fix. Most people do not need a new number. Ask the Social Security Administration about this option only if the theft is ongoing and severe.

What if a debt collector contacts me about a fraudulent debt?

Tell them in writing that you are a victim of identity theft and include a copy of your FTC identity theft report. Send it certified mail, return receipt requested. By law, they must stop collection efforts once they receive proof of identity theft. Keep a copy for your records. If they contact you again, you can file a complaint with the Consumer Financial Protection Bureau.

Do I need to pay for identity theft protection services?

No. Everything you need to do — file reports, place fraud alerts, freeze your credit, dispute accounts — is free. Some companies sell identity theft protection or credit monitoring, but you can do all of this yourself at no cost. The FTC and your state attorney general provide free resources and guidance.