In 2024, it’s hardly surprising that yet another company has fallen victim to a data breach, such as the recent hack that allegedly exposed the Social Security numbers (SSNs) of billions of Americans. At this point, we can probably all assume that a lot of our personal data is out there somewhere, and hope that malicious actors don’t manage to link enough of it to do serious damage. Unfortunately, there’s no way to know for sure if your Social Security number is being used until it happens—for example, to open a new line of credit in your name.
Of course, when this happens, you need to take it seriously. Here are the steps you need to take to lock down your data if you have become a victim of identity theft.
Collect information and document everything
First things first: Don’t panic. If you notice something suspicious on your credit report or bank statement, try to gather as much information as you can. Review all of your financial records from the past 12 months (or earlier if the fraudulent activity occurred further back), request your free credit report from each of the three credit bureaus, and keep an eye out for any unfamiliar collection notices, bills, or loan offers.
If you think someone is using your Social Security number, log everything in a running note or document in a folder on your desktop or a secure cloud service. Write down the date and time you discovered the problem(s) and any communication with your banks, lenders, credit bureaus, and federal agencies like the IRS, Social Security Administration (SSA), and Department of Education (DOE), as well as with attorneys and other professionals you bring in to help. Write down the numbers you call, the names of everyone you speak to, and make a few notes about the conversation. If you need to send documents, scan and save copies of everything (either take photos or use an app like Genius Scan), and use certified mail and/or have fax delivery confirmed. Take screenshots of all digital documents and add them to the file.
Freeze credit
If you haven’t already, contact the three major credit bureaus (Equifax, Experian and TransUnion) and get your credit frozen. Frankly, given how common data breaches are, there’s no reason to unfreeze your credit in 2024. Most people don’t apply for new credit that often, so the benefit of having a freeze on your file so no one can open a line of credit without your knowledge far outweighs the minor inconvenience of having to unfreeze the freeze when you apply for a card or loan. You don’t even have to talk to anyone—just set up an account so you can turn freezes on and off online. Credit freezes are free, and you don’t have to subscribe to a paid service from the credit agency or third-party provider.
Note that not all forms of fraudulent activity related to your SSN will be prevented by a credit freeze. Even if your credit is frozen, you should set up credit alerts (often offered for free by credit card issuers) and/or regularly check your credit report to quickly identify errors.
Submit identity theft reports
If you have evidence that someone opened an account with your SSN or otherwise used your identity fraudulently, file a report with the Federal Trade Commission (FTC) at identitytheft.gov. You’ll need to summarize your claim, provide information about specific fraudulent activity, and sign a statement. You’ll need this report to support any further claims you make to other agencies, so download and save it.
You should also file a report with your local police department (in most cases, you can do this online) and add it to your file so you can present it when disputing charges with other agencies and creditors. You may need your completed FTC report to file a police report.
Finally, you can submit a report to the SSA Office of the Inspector General, either online or by phone at 1-800-269-0271.
Set up credit fraud alerts
All three credit bureaus offer one- or seven-year extended fraud alerts on credit files, which cause lenders to take extra steps to verify the identities of people who apply for credit using your information. Anyone can set up an initial one-year alert, but if you’re a victim of identity theft and have your report with the FTC and/or police, you can extend it to seven years. You only need to do this with one bureau, and it will contact the other two. You can request an initial alert online, but for an extended seven-year alert, you’ll need to send in documentation by mail.
Under the Fair Credit Reporting Act, you can file a dispute and/or send a letter to the credit reporting agencies outlining the fraud and requesting that they remove any inaccurate information from your credit report. The FTC has a template you can follow. Note that they won’t remove anything they’ve verified to be accurate, but that claim is part of your paper trail.
Report fraudulent activity to your bank and lenders
If you see any unknown charges on your bank account or credit card statements, report them immediately. Credit card issuers generally won’t hold you responsible for purchases you didn’t make and will cancel your card and send you a new one if fraud has occurred. If you know someone has taken out a loan in your name or otherwise misused your Social Security number, it won’t hurt to request updated cards, even if there has been no fraudulent activity. You could even transfer your accounts to another bank as an extra precaution.
If the fraud is related to a federal student loan, you may also need to contact the Department of Education and/or the loan servicer listed on the account and follow their process for filing a claim.
Freeze your social security accounts
Aside from taking out loans with your information, criminals can also use your SSN for employment-related fraud, which can come back to haunt you when tax season rolls around. Go to the SSA’s mySocialSecurity site to apply for your account. There, you can view the income history associated with your number. You can also “self-lock” your SSN on e-Verify, which prevents anyone from using your number for employment, and set up an identity protection PIN with the IRS. This number changes every year and is required to file a tax return (anyone can request an IP PIN, even if you haven’t been a victim of identity theft). If you’ve discovered fraud related to your tax return, you may also need to file Form 14039.
As a reminder, the IRS generally only contacts people by mail, so do not give out personal information to anyone claiming to represent a federal agency over the phone, via text message, email, or social media.
Protect your data in the future
While social security number fraud isn’t necessarily the result of poor digital hygiene—data breaches are the failure of the companies we trust with our information—it doesn’t hurt to protect your information as best you can going forward. Update your passwords (starting with all bank accounts) and enable multi-factor authentication wherever it’s available. In extreme cases, you can even change your email address and phone number and request new identification documents, such as a driver’s license.
You should also ask questions any time a company asks for your SSN. If it is not essential to the service you are receiving, you can refuse to provide it.
Can you change your social security number?
It is possible to change your social security number as a victim of identity theft If You can show that you’ve tried to resolve the issue but are still affected by the fraud. (The SSA will issue a new number in a few other special cases.) To do this, you’ll need to schedule an in-person appointment at your local Social Security office. You’ll also need to provide evidence, including a statement about the theft, a police report, and documentation proving your name, age, citizenship, and current SSN. Keep in mind that this should probably be your very last resort, as changing your SSN has some significant drawbacks—at the very least, you’ll have to put in a lot of work to make sure you update it everywhere, and it could actually have a negative impact on your credit file.
