Discovering that yet another company has suffered a data breach, such as the recent hack that allegedly exposed the Social Security numbers (SSNs) of billions of Americans, is hardly surprising in 2024. At this point, we can probably all assume that much of our personal information is out there somewhere and hope that bad actors aren’t able to connect enough of it to do any serious damage. Unfortunately, there’s no way to know for sure whether your Social Security number will be used until it is—to open a new line of credit in your name, for example.
If that happens, you obviously need to take it seriously. Here are the steps to take to lock your stuff down if you’ve been the victim of identity theft.
Collect information and document everything
First things first: Don’t panic. If you see something suspicious on your credit report or bank statement, try to gather as much information as possible. Review all of your financial statements going back up to a year (or earlier, if the fraudulent activity goes further back), request your free credit report from each of the three credit reporting agencies, and keep an eye out for any unfamiliar debt collection notices, bills, or credit offers.
If you believe someone is using your Social Security number, track everything in a running note or document in a folder on your desktop or secure cloud service. Note the date and time you discovered the problem(s) and for every communication you have with your banks, credit issuers, credit reporting bureaus, and federal agencies like the IRS, Social Security Administration (SSA), and Department of Education (DOE) as well as attorneys and other professionals you hire to help. Write down the numbers you call, the names of everyone you speak with, and a few notes about the conversation. If you have to send documents, scan and save copies of everything (either take photos or use an app like Genius Scan), and use certified mail and/or get fax confirmations to ensure delivery. Take screenshots of everything digital and add them to the file.
Freeze your credit
If you haven’t already, contact the three major credit reporting agencies (Equifax, Experian, and TransUnion) and freeze your credit. Frankly, there’s no reason your credit should be unfrozen in 2024 given the frequency of data breaches. Most people aren’t applying for new credit that frequently, so the benefit of having your file frozen so that no one can open a line of credit without your knowledge greatly outweighs the minor inconvenience of having to unfreeze it when you are applying for a card or loan. You don’t even need to talk to anyone—simply set up an account so you can toggle freezes on and off online. Credit freezes are free, and you do not need to subscribe to a paid service offered by the credit agency or third-party provider.
Note that not all forms of fraudulent activity involving your SSN will be hampered by a credit freeze. Even if your credit is frozen, set up credit alerts (often offered for free through credit card issuers) and/or check your credit report regularly to identify errors quickly.
File identity theft reports
If you have proof that someone has opened an account using your SSN or otherwise used your identity fraudulently, file a report with the Federal Trade Commission (FTC) at identitytheft.gov. You will need to summarize your claim, provide information about specific fraudulent activity, and sign a statement. You will need this report to support any additional claims with other agencies, so download and save it.
You should also file a police report with your local police department (in most cases, you can do this online) and add it to your document file so you can provide it when disputing charges with other agencies and creditors. You may need your completed FTC report to file a police report.
Finally, you can submit a report to the SSA’s Office of the Inspector General, either online or by calling 1-800-269-0271.
Set up credit fraud alerts
All three credit bureaus offer one-year and seven-year extended fraud alerts on credit files, which prompt lenders to take extra steps to verify the identity of anyone applying for credit using your information. Anyone can set up an initial one-year alert, but if you are an identity theft victim and have your FTC and/or police report, you can extend this to seven years. You only need to do this with one bureau, and they will contact the other two. You can request an initial alert online, but a seven-year extended alert requires you to send documentation by mail.
Under the Fair Credit Reporting Act, you can file a dispute and/or submit a letter to the credit bureaus outlining the fraud and request that they remove any inaccurate information on your credit report. The FTC has a template to follow. Note that they won’t remove anything they’ve verified as accurate, but this claim is part of your paper trail.
Report fraudulent activity to your bank and credit issuers
If you see charges you don’t recognize on your bank account or credit card statements, report them immediately. Credit card issuers generally do not hold you accountable for purchases you didn’t make and will cancel your card and send you a new one if there has been fraud. If you know someone has opened credit in your name or otherwise misused your SSN, it doesn’t hurt to request updated cards even if there hasn’t been any fraudulent activity. You could even move your accounts to a different bank as an extra precaution.
If the fraud is related to a federal student loan, you may also need to contact the Department of Education and/or the loan servicer listed on the account and follow their process to file a claim.
Lock your Social Security accounts
Aside from taking out credit using your information, criminals may use your SSN for employment-related fraud, which can impact you when tax season rolls around. Head to the SSA’s mySocialSecurity site to claim your account, where you can view the earning history associated with your number. You can also “self lock” your SSN on e-Verify, which prevents anyone from submitting your number for employment, and set up an identity protection PIN with the IRS. This number will change each year and be required to file a tax return (anyone can request an IP PIN even if you haven’t been a victim of identity theft). If you’ve discovered fraud related to your tax return, you may also need to file Form 14039.
A reminder: The IRS generally contacts people by mail only, so do not give out any personal information to anyone claiming to represent any federal agency over the phone, text, email, or social media.
Protect your data going forward
While fraud involving SSNs may not be the result of poor digital hygiene—again, data breaches are the failure of companies we entrust with our information—it doesn’t hurt to lock down your information as tightly as you can moving forward. Update your passwords (starting with any financial accounts) and enable multi-factor authentication anywhere it’s available. On the extreme end, you can even change your email address and phone number and request new identity documents, such as a driver’s license.
You should also ask questions any time a company requests your SSN. If it is not essential for the service you are receiving, you can decline to provide it.
Can you change your Social Security number?
It is possible to change your Social Security number as a victim of identity theft if you can prove that you’ve tried to resolve the problem but continue to be impacted by the fraud. (The SSA will issue a new number in a handful of other specific circumstances.) To do so, you’ll need to set up an in-person appointment at your local Social Security office. You will also need to show evidence, including a statement about the theft, a police report, and documentation proving your name, age, citizenship, and current SSN. Know that this should probably be your very last resort, as changing your SSN has some significant drawbacks—at a minimum, you’ll have to do a lot of legwork to make sure you update it everywhere, and you could actually see negative impacts on your credit file.
