How Social Security identity theft works and what it means for you

Social Security identity theft occurs when someone obtains your Social Security number and uses it to open accounts, file tax returns, get a job, or explore for benefits in your name. The thief does not need to steal your physical documents — they only need the nine-digit number itself, which can be obtained from a data breach, phishing email, lost mail, or even a public record.

The damage varies widely. A thief might use your number to commit tax fraud by filing a false return before you file your own, leaving you unable to file until the IRS resolves the duplicate claim. They might open credit cards or take out loans in your name. They might use it to get a job, meaning your Social Security record will show earnings you never made. Or they might use it to claim Social Security benefits, unemployment insurance, or other government programs you are not may have access to to.

The common thread is that you discover the theft only after the damage is done — when the IRS rejects your return, a creditor calls about an account you did not open, or your employer reports a wage discrepancy. By then, the thief has already acted.

Key Takeaways

  • Social Security identity theft is discovered most often through a rejected tax return, a credit report error, or a call from a creditor about an account you did not open.
  • The IRS has a specific process for victims: file Form 14039 (Identity Theft Affidavit) along with your tax return, or separately if you discover the theft outside tax season.
  • You should also file a report with the Federal Trade Commission at IdentityTheft.gov, which creates an official record and generates a recovery plan.
  • Freezing your credit with the three major bureaus (Equifax, Experian, TransUnion) prevents a thief from opening new accounts in your name, though it does not undo existing fraud.
  • Recovery can take months or years depending on what the thief did and how quickly you act, so document everything and keep records of all communications.

Signs your Social Security number has been misused

The most common warning sign is a tax return rejection. The IRS will send you a notice saying it received a return under your Social Security number before you filed, or that you reported different income than what is in their system. This happens because a thief filed a fraudulent return using your number to claim a refund.

A second common sign is a credit report error. You might see accounts you never opened, inquiries from creditors you never contacted, or a sudden drop in your credit score. You can check your credit report for free once per year at AnnualCreditReport.com, which is the official site run by the three major bureaus.

Other signs include receiving a W-2 form from an employer you never worked for, getting a notice about unpaid taxes you did not incur, or receiving bills or collection notices for accounts in your name. Some victims discover the theft only when they explore for a loan and learn their credit is damaged, or when they receive a notice that someone claimed them as a dependent on a tax return.

What to do when ready after discovering the theft

Your first step is to contact the IRS if the theft involves taxes. Call the IRS Identity Theft Hotline at 1-800-908-4490 and explain what happened. They will tell you whether a fraudulent return was filed under your number and what to do next. Have your Social Security number, date of birth, and filing status ready.

Your second step is to file a report with the Federal Trade Commission at IdentityTheft.gov. This is a free federal service that creates an official record of the theft and generates a personalized recovery plan. The FTC does not investigate individual cases, but the report is important because it documents the theft and can be used as evidence if you need to dispute fraudulent accounts or charges.

Your third step is to contact the three major credit bureaus — Equifax, Experian, and TransUnion — and place a fraud alert on your credit file. A fraud alert tells creditors to verify your identity before opening new accounts in your name. You only need to contact one bureau; they are required to notify the other two. The alert lasts one year and is free.

Your fourth step is to freeze your credit with all three bureaus. A credit freeze prevents anyone, including you, from opening new accounts using your Social Security number until you unfreeze it. This is stronger protection than a fraud alert and is also free. You can freeze and unfreeze your credit online at each bureau's website.

Filing Form 14039 with the IRS

Form 14039 is the IRS Identity Theft Affidavit. You file it when you discover that someone used your Social Security number to file a tax return or claim a refund. The form tells the IRS that you are the real taxpayer and that the return filed under your number was fraudulent.

If you discover the theft during tax season, you can file Form 14039 along with your own tax return. Include a copy of your FTC Identity Theft Report (which you created at IdentityTheft.gov) and any other documentation showing the fraud. Mail everything to the IRS address listed in the Form 14039 instructions, not to your normal tax filing address.

If you discover the theft outside tax season, file Form 14039 by itself. Again, include a copy of your FTC report and any supporting documents. The IRS will use this to flag your account and prevent future fraudulent filings under your number.

Processing takes time. The IRS typically responds within 30 days, but if the case is complex it can take longer. You will receive a letter confirming receipt of your affidavit and explaining next steps. Keep this letter for your records.

Disputing fraudulent accounts and charges

If the thief opened credit cards, loans, or other accounts in your name, you will need to dispute them with the creditors and the credit bureaus. Start by sending a written dispute to each creditor, explaining that the account is fraudulent and that you have filed an identity theft report with the FTC. Include a copy of your FTC report with your letter.

Under the Fair Credit Reporting Act, creditors must investigate your dispute within 30 days. If they find the account is fraudulent, they must remove it from your credit report. Some creditors will do this quickly; others will drag out the process. Keep copies of all letters and emails you send, and follow up if you do not hear back within 45 days.

You should also dispute the fraudulent accounts directly with the credit bureaus. Send a written dispute to each bureau (Equifax, Experian, TransUnion) explaining that the accounts are not yours and that you have filed an identity theft report. The bureaus must investigate within 30 days and remove the accounts if they find them to be fraudulent.

Protecting your Social Security number going forward

After identity theft, your Social Security number is compromised and will remain so. You cannot change it — the Social Security Administration does not issue new numbers except in rare cases of ongoing harassment or abuse. Instead, you must manage the risk by monitoring your credit and tax records regularly.

Check your credit report at least once per year at AnnualCreditReport.com. Look for accounts you do not recognize, inquiries from creditors you never contacted, and errors in your personal information. If you find fraud, dispute it when ready with the creditor and the bureau.

Consider placing a permanent freeze on your credit. This prevents new accounts from being opened in your name without your permission, though you will need to unfreeze it temporarily if you want to explore for credit yourself. The freeze is free and can be lifted or reinstated at any time.

File your tax return early each year, before a thief has a chance to file a fraudulent return under your number. The IRS processes returns on a first-come, first-served basis, so filing early gives you the advantage. If you discover that a fraudulent return was filed, contact the IRS when ready.

How long recovery takes and what to expect

Recovery from Social Security identity theft is not quick. If the thief only filed a fraudulent tax return, you might resolve it within a few months. If they opened multiple accounts, took out loans, or committed crimes in your name, recovery can take a year or longer.

The IRS typically resolves tax-related identity theft within 120 days, though complex cases can take longer. You will receive letters explaining the status of your case and what you need to do next. Keep all letters and documentation in a safe place.

Credit-related fraud takes longer because you must dispute each fraudulent account separately with the creditor and the bureau. Some creditors are cooperative and remove accounts quickly; others require multiple disputes and may even sue you to collect on the fraudulent debt. If this happens, you will need to provide your FTC report and other documentation to prove the account is fraudulent.

Throughout the process, document everything. Keep copies of all letters, emails, phone calls, and disputes. Write down the date, time, and name of every person you speak with. This documentation is essential if you need to escalate a dispute or prove the fraud to a court.

Frequently Asked Questions

Can I get a new Social Security number after identity theft?

The Social Security Administration rarely issues new numbers. You must show that you are experiencing ongoing harassment or abuse, and that changing your number is necessary to prevent further harm. Most identity theft victims do not meet this standard. Instead, you manage the risk by monitoring your credit and freezing your accounts.

Will the thief be prosecuted?

Identity theft is a federal crime, but prosecution depends on whether law enforcement can identify and locate the thief. Many identity theft cases go unsolved because the thief is in another country or uses sophisticated methods to hide their identity. File a report with the FBI's Internet Crime Complaint Center (IC3) at ic3.gov if you want to report the crime, but do not expect prosecution in most cases.

Do I have to pay debts the thief incurred in my name?

No. If you can prove the debt is fraudulent — by providing your FTC report and disputing it with the creditor — you are not responsible for paying it. However, the creditor may sue you to collect, in which case you will need to defend yourself in court using your documentation. This is why keeping records is critical.

What if the thief used my number to get a job?

Contact the Social Security Administration and report that someone used your number to work. They will investigate and may contact the employer. You may also see earnings on your Social Security record that you did not earn. Contact the SSA to request a corrected earnings record. This can affect your future Social Security benefits, so address it promptly.

How do I know if my information was in a data breach?

You can check whether your information was exposed in a known breach at HaveIBeenPwned.com, a free service that tracks major data breaches. If your information was exposed, consider it compromised and take preventive steps like freezing your credit even if you have not yet discovered fraud.