What a thief can do with your Social Security number

A thief with your Social Security number can open credit card accounts in your name, take out loans, file a false tax return to steal your refund, open utility accounts, rent an apartment, or get a job using your number. They can also drain your existing bank accounts if they have other identifying information, and sell your number to other criminals. The damage spreads because your Social Security number is the master key to your financial identity — it connects to your credit history, your tax records, your employment history, and your benefits accounts.

The speed of the damage depends on what else the thief has. If they only have your number, they can still open accounts, but they may need your address or date of birth to complete the fraud. If they have your number plus a copy of your driver's license or a utility bill, they can move much faster. If they have your number and your mother's maiden name, they can often reset passwords on your existing accounts.

The financial harm is real but often recoverable. Credit card fraud is usually capped at $50 of your liability under federal law. Tax refund theft requires you to file a police report and then work with the IRS to reclaim your refund — a process that takes weeks or months. Loan fraud in your name can damage your credit score for years, even after you dispute it, because the false accounts stay on your credit report during the investigation.

Key Takeaways

  • A thief can open credit accounts, take out loans, file a false tax return, or get a job using only your Social Security number, especially if they also have your address or date of birth.
  • You are not liable for most credit card fraud, but you are responsible for disputing it and proving it was not you — a process that can take months.
  • Tax refund theft requires you to file a police report and contact the IRS directly; the IRS does not contact you first.
  • Freezing your credit with the three major credit bureaus (Equifax, Experian, and TransUnion) stops most new account fraud before it happens.
  • You cannot change your Social Security number unless you can prove you are a victim of identity theft and have already taken steps to stop it.

How to know if your Social Security number has been misused

The first sign is often a credit card offer or collection notice for an account you did not open. Check your credit report for accounts you do not recognize. You can get a free credit report once a year from each of the three major bureaus — Equifax, Experian, and TransUnion — at AnnualCreditReport.com. This is the official government site; do not use other sites that claim to be free.

Another sign is a letter from the IRS saying you have already filed a tax return, when you have not filed yet. The IRS sends these letters when someone files a return using your Social Security number before you do. If you receive this letter, do not ignore it — contact the IRS at 1-800-908-4490 and follow their instructions to report the fraud.

You may also notice that your tax refund is smaller than expected, or that your employer says you have already earned income at another company. If you receive a W-2 form from an employer you never worked for, that is a sign someone used your number to get a job.

What to do when ready if you suspect fraud

First, place a fraud alert with one of the three credit bureaus. A fraud alert tells lenders to contact you before opening new accounts in your name. You only need to contact one bureau — they are required to notify the other two. The alert lasts one year and is free. Here is how to contact each bureau:

  • Equifax: 1-800-525-6285 or www.equifax.com/personal/credit-report-services
  • Experian: 1-888-397-3742 or www.experian.com
  • TransUnion: 1-833-969-9403 or www.transunion.com

Second, get a copy of your credit report from all three bureaus and look for accounts you do not recognize. Dispute any fraudulent accounts in writing. The bureau must investigate within 30 days and remove the account if they cannot verify it is yours.

Third, if the fraud involves a tax return, file a police report and send a copy to the IRS along with Form 14039, Identity Theft Affidavit. You can read Form 14039 from IRS.gov or call 1-800-829-1040 to request it. The IRS will then flag your account and require additional verification before processing future returns.

Freezing your credit to prevent new fraud

A credit freeze stops lenders from pulling your credit report, which means they cannot open new accounts in your name without your permission. This is different from a fraud alert — a freeze is stronger but requires you to unfreeze your credit temporarily whenever you want to open a legitimate account yourself.

You can freeze your credit for free with all three bureaus. Here is how:

  • Visit each bureau's website (Equifax.com, Experian.com, TransUnion.com) and select the option to freeze your credit.
  • You will need your Social Security number, date of birth, address, and a form of ID.
  • Each bureau will give you a PIN or password to unfreeze your credit later.
  • Write down the PIN and store it somewhere safe — you will need it to unfreeze.

A freeze takes effect within one business day for online requests. If you freeze with all three bureaus, most new account fraud stops when ready because lenders cannot verify your identity. The freeze stays in place until you unfreeze it, so you only need to do this once.

When you can change your Social Security number

The Social Security Administration does not change your number easily. You can request a new number only if you can show that you are a victim of identity theft and that you have already taken steps to stop the fraud — such as filing a police report or placing a fraud alert. Even then, the SSA will only issue a new number if the fraud is ongoing and a new number is necessary to resolve it.

To request a new Social Security number, visit your local Social Security office in person with a police report, a fraud alert letter from a credit bureau, and a government-issued ID. You cannot request a new number by phone or mail. The process takes several weeks, and you will receive a new card in the mail.

A new number does not erase the old one — creditors and employers may still have records under your old number. Changing your number is a last resort, not a quick fix. Most people who freeze their credit and dispute fraudulent accounts never need a new number.

Protecting your Social Security number going forward

Do not carry your Social Security card in your wallet. Leave it at home in a safe place. You rarely need to show the physical card — most organizations only need the number.

Do not give your Social Security number over the phone unless you initiated the call and you know the organization is legitimate. Scammers call pretending to be from the IRS, Social Security Administration, or your bank. The real IRS and Social Security Administration do not call you first — you call them.

Shred documents that contain your Social Security number before throwing them away. This includes old tax returns, W-2 forms, and bank statements. Use a cross-cut shredder if possible, not a strip shredder.

Use strong, unique passwords on financial accounts and email. If a data breach exposes your email and password, a thief can use that password to reset accounts that have your Social Security number on file. A password manager like Bitwarden or 1Password can help you create and store strong passwords.

What to do if your Social Security number was exposed in a data breach

Data breaches happen regularly at companies that store Social Security numbers — hospitals, insurance companies, employers, and government agencies. If you receive a letter saying your information was exposed, do not panic. Exposure does not mean fraud has already happened.

Place a fraud alert with one of the three credit bureaus when ready. Many companies that experience breaches offer free credit monitoring for a year, but credit monitoring only alerts you after fraud has occurred — a fraud alert prevents it from happening in the first place.

If the breach involved a specific company, check whether they are offering credit monitoring or identity theft insurance. Read the terms carefully — some offers are limited to a certain dollar amount or require you to pay out of pocket first and then seek reimbursement.

Frequently Asked Questions

Can someone open a bank account with just my Social Security number?

Most banks require more than just your Social Security number — they also need your name, address, and date of birth. However, if a thief has your number plus information from a data breach or a stolen document, they can often complete an process online. Once the account is open, they can drain it or use it to commit further fraud.

Will the IRS contact me if someone files a tax return using my number?

No. The IRS does not contact you first. You will find out when you file your own return and the system rejects it, or when you receive a letter saying a return has already been filed under your number. If this happens, file a police report and contact the IRS at 1-800-908-4490 when ready.

How long does it take to fix identity theft?

straightforward cases — like disputing a fraudulent credit card account — can be resolved in 30 to 60 days. Tax refund theft can take six months to a year. Loan fraud can take years to fully clear from your credit report, even after you dispute it. The timeline depends on how much fraud occurred and how quickly you report it.

Is a credit freeze the same as a fraud alert?

No. A fraud alert tells lenders to contact you before opening accounts, but they can still open them if they cannot reach you. A freeze stops lenders from pulling your credit report at all, which prevents most new account fraud. A freeze is stronger but requires you to unfreeze temporarily when you want to open a legitimate account.

What should I do if a company asks for my Social Security number but I do not think they need it?

Ask why they need it and whether they can use a different identifier instead. Many companies ask for your Social Security number out of habit, not necessity. If they insist and you do not trust them, you can refuse and take your business elsewhere. For government agencies and employers, you usually must provide it, but for retailers and service providers, you often have a choice.