What to Do If Your Social Security Number Is Stolen or Exposed
Two very different things send people to this page, and the advice for them is not the same. Almost every guide gives both the same nine-step list.
Work out which one you are first.
Your number was exposed. It turned up in a breach notification, or was on a document you lost, or you gave it to something that turned out to be a scam. Nobody has necessarily used it. You are getting ahead of a risk.
Your number is being used. Accounts you did not open. A tax return already filed in your name. Debts you do not recognise. A benefits claim you did not make. That is identity theft in progress, and it needs a different sequence.
If you are in the first group, and most people reading this are, the good news is that one free step does most of the work, and several of the things you have been told to do are not worth your afternoon.
Written for readers in the United States.
One note on where that split comes from, because we would rather be straight than sound more official than we are. This is our framing, not a federal doctrine. No government page sets out a clean two-track model; the FTC’s breach guidance sorts by the type of data exposed rather than by whether it has been used. The closest official version of the line is in the Social Security Administration’s own rules, where the distinction decides whether you can get a new number at all: SSA specifically excludes the case where a card “is lost or stolen, but there’s no evidence that someone is using your number.”
If your number was exposed but not used
1. Freeze your credit. This is most of the value.
A stolen number is worth the most for opening new accounts, and a freeze blocks exactly that. The FTC: while a freeze is in place, “nobody can open a new credit account in your name, including you.” It is free, and it “doesn’t affect your credit score.”
You place it at each of the three nationwide bureaus, and lift it temporarily when you need credit. It is a twenty-minute job worth doing properly.
2. Decide whether you also want a fraud alert.
An alert “tells businesses to check with you before opening a new credit account in your name.” Lighter than a freeze, and easier in one respect: contacting one bureau obliges it to tell the other two. Which suits you is covered in Fraud Alert vs Credit Freeze: Which One Should You Use?
3. Get an IRS Identity Protection PIN.
This is the step most people have never heard of, and it closes the one door a credit freeze leaves open: someone filing a tax return in your name.
The important change is that it is no longer only for confirmed victims. The IRS: “Anyone who has an SSN or individual taxpayer identification number (ITIN) and is able to verify his/her identity is eligible to enroll into the IP PIN program”, and you can get one “even if you are not required to file a tax return.” Parents and legal guardians can request one for dependents too.
Two practical points. An IP PIN “is valid for one calendar year,” and “A new IP PIN is generated each year”, so put a reminder in for next January rather than treating this as done. And if you have read that IP PINs are victims-only, that guidance is out of date.
4. Watch, at a low level.
Check your financial accounts and your credit reports over the next few months. Early detection is what keeps a problem administrative rather than serious. If you are wondering whether to pay for monitoring, Credit Monitoring vs Identity Theft Protection Explained covers what those services actually do.
5. Expect the calls, and recognise them.
Exposure is often followed by convincing phone calls. If someone rings claiming your Social Security number has been “suspended” or linked to serious crimes and wants you to act immediately, the FTC’s verdict is three words: “It’s a scam.” Real agencies do not work that way. The pattern is in How to Spot a Phishing Email or Text, and if an older relative is being targeted, How to Protect Elderly Parents From Scams.
What you can skip
This is the part no other guide will tell you, and it saves a wasted afternoon.
You probably do not need to file IRS Form 14039. The IRS is explicit that “Only victims of tax-related identity theft should submit the Form 14039,” and adds that “Most people don’t need to file this form.” Exposure alone is not tax identity theft. And if the IRS has already written to you asking to verify your identity (letters 5071C, 4883C or 5747C), then “there is no need to file a Form 14039”; follow the letter instead.
You do not need to file a police report for an exposure with no evidence of misuse. Nothing in it for you at this stage.
You almost certainly cannot get a new number, and would not want one. See below.
And you do not need to call SSA. See the next section: it is the most common wasted phone call on this topic.
If your number is already being used
Then you are dealing with identity theft, and the sequence matters more than any single step.
Start at IdentityTheft.gov. It is the federal government’s reporting and recovery service; it produces an official Identity Theft Report and a personalised plan, free. Everything else you will need to do (disputes, letters, follow-ups) is easier with that report in hand.
Then narrow by what is actually happening, because these diverge:
A tax return filed in your name. This is where Form 14039 does belong, unless the IRS has already sent you a 5071C, 4883C or 5747C letter, in which case follow the letter and skip the form.
Someone working on your number. A distinct case with its own trail. The IRS may send a CP01E notice, which it describes as “for informational purposes only”; it does not affect your tax account, so do not panic when it arrives. Get an IP PIN if you do not have one. Then check what SSA has recorded: its instruction is to “Review the earnings posted to your record on your Social Security Statement and report any inconsistencies to us.” Wages you never earned, sitting on your record, are the evidence.
Anything else (new credit accounts, medical treatment, an arrest in your name, an unemployment claim) has its own correct first move, and the ordered version of the whole response is a longer job than this page.
What Social Security will and will not do
This surprises almost everyone, which is why it needs saying plainly: if your number has been stolen, SSA is not where you report it.
SSA says so on its own page about stolen numbers, “We’re not involved in this process, but they’ll be able to support you”, and more bluntly in its FAQ: “Social Security does not handle identity theft issues.”
SSA issues and replaces cards, keeps your earnings record, and in narrow cases assigns a different number. It does not investigate misuse and it is not a reporting channel. It points you to the FTC instead.
Do not spend your first hour on hold.
Should you get a new number?
Almost certainly not, and SSA’s own material makes the case better than anyone else’s. SSA says it “can assign a different number only if” one of five specific situations applies, among them being an identity theft victim who has already tried to resolve the problem and is still being harmed, or facing harassment, abuse or danger to life. Exposure alone is not on the list; SSA explicitly excludes a lost or stolen card where there is “no evidence that someone is using your number.”
And even when it is available, SSA is candid: “So, using a new number won’t guarantee you a fresh start.” It adds that this is especially true if your name and address stay the same, and (the part people never expect) that “If the old credit information isn’t associated with your new number, the absence of any credit history under your new number may make it more difficult for you to get credit.”
A new number is not an escape hatch. A credit freeze does more, today, for nothing.
Living with it
Your number does not expire, so the vigilance is permanent, but it is light. A freeze in place. Accounts glanced at now and then. A fresh IP PIN each January. Healthy suspicion of anyone who phones asking you to confirm the number they claim to be protecting.
We are not going to tell you how long recovery takes if misuse does appear, because no federal source publishes a figure. Anyone quoting you an average is not quoting the government.
Questions that come up next
My number was in a breach. Is that identity theft? No. Exposed means it may be in the wrong hands; it does not mean anyone has used it. If you can already see accounts or filings you did not make, that is theft and the second half of this page applies.
Should I tell Social Security? SSA states it “does not handle identity theft issues” and that it is “not involved in this process.” Report through the FTC instead. The exception is wages on your earnings record that are not yours: SSA does want to hear about those.
Can I get an IP PIN if nothing has happened to me? Yes. Anyone with an SSN or ITIN who can verify their identity qualifies, including people who do not file a return. It lasts one calendar year and a new one is issued annually.
How long should I stay worried? Not worried: watchful, at a low level, indefinitely. The number does not expire. A freeze plus an occasional check is the whole ongoing cost.
Affiliate Disclosure
Current relationship: Nesswick does not currently use affiliate links in this article. Product and service references are included for editorial purposes.
Sources and Methodology
This is an official-documentation guide. No hands-on testing was performed. Everything procedural comes from current SSA, FTC and IRS material, verified 24 September 2026.
One transparency point. The exposed-versus-used structure that organises this article is Nesswick’s, not the government’s. We could not find a federal page that sets it out as a doctrine; the FTC’s breach guidance sorts by the type of data exposed. The closest official encoding is SSA’s rule that a lost or stolen card with no evidence of use does not qualify someone for a new number, and we cite it as that rather than presenting our structure as policy.
IRS IP PIN eligibility and the Form 14039 conditions are treated as dynamic and were re-checked in this pass. We give no recovery timeline because no federal source publishes one.
General information for US readers, not legal, tax or financial advice. No step is guaranteed to prevent misuse.
Sources Referenced
- Social Security Administration: “Report a stolen Social Security number”; FAQ on identity theft victims; FAQ “Can I change my Social Security number?”; FAQ on reviewing earnings records; publication Identity Theft and Your Social Security Number (EN-05-10064, March 2026 revision), verified 24 September 2026
- Federal Trade Commission: “Credit Freezes and Fraud Alerts”; consumer alert on Social Security impersonation scams (May 2024)
- Internal Revenue Service: “Identity Theft Guide for Individuals”; “Get an Identity Protection PIN”; “When to file an Identity Theft Affidavit”; “Understanding your CP01E notice”