Is a Credit Freeze Enough If Your Social Security Number Has Already Been Stolen?

Freezing your credit is one of the first recommendations you will hear after a Social Security number is stolen. It is free, relatively fast, and highly useful—but its familiar name can make it sound as though it freezes the stolen number everywhere it might be used.

A credit freeze actually restricts access to a particular consumer-reporting file. It can block many new-credit applications, but a stolen SSN can also be misused for taxes, employment, government benefits, medical care, deposit accounts, phone service, and takeovers of accounts that already exist.

Quick Answer

No. A credit freeze is one of the most important steps after a Social Security number is stolen, but it protects only part of the person’s identity. It can stop many creditors from opening new accounts that require access to Equifax, Experian, or TransUnion. It does not stop tax-return fraud, employment misuse, unemployment claims, medical identity theft, Social Security account changes, existing-account takeover, or every checking, utility, and cellphone application. Freeze all three credit files, then add an IRS Identity Protection PIN, secure financial and government accounts, review specialized records, and use IdentityTheft.gov if misuse has occurred.

A Credit Freeze Locks a File—Not the Social Security Number

A Social Security number does not work like a credit card number. You cannot normally cancel it, replace it through a quick fraud call, and make the old number useless. It remains connected to tax, employment, benefit, banking, medical, and government records for decades.

A credit freeze addresses one particularly dangerous use of that number: applying for new credit. It tells a nationwide credit reporting company not to release the frozen credit file to most prospective creditors. Because most lenders want to review that file before approving a new loan or credit card, the freeze can prevent many fraudulent accounts from being opened.

A thief does not necessarily need to present the victim’s name exactly as it normally appears for every system to associate activity with the number.

That is valuable protection. It is not a force field around the identity.

The Federal Trade Commission says a freeze is especially important when a Social Security number has been exposed or misused. The Consumer Financial Protection Bureau also warns that a freeze does not prevent an identity thief from taking over an existing account. Neither agency describes a freeze as a complete identity-theft remedy. See the FTC’s current credit-freeze and fraud-alert guidance and the CFPB’s August 2026 identity-theft guidance.

The correct answer is therefore:

Freeze all three nationwide credit files—but build additional protection around every other system that can use the stolen number.

First Determine What “Stolen” Means

The response should match what has actually happened. A missing Social Security card, a breach notice, a dark-web alert, and a fraudulent tax return are not the same event.

Situation	What is known	Immediate response
Physical card is missing	Someone may or may not have the number	Secure other stolen items, freeze credit, monitor records, and replace the card only if needed
Breach or exposure notice	The number may be in unauthorized hands, but no misuse is confirmed	Freeze credit, secure accounts, obtain an IRS IP PIN, and watch for targeted signs
Dark-web or monitoring alert	A service says the number appears in a dataset	Treat the number as exposed; verify the alert through the service’s official channel and add protective layers
Unknown inquiry or new account	Credit-related misuse may have begun	Freeze, report identity theft, close the account, block fraudulent information, and preserve evidence
Rejected tax return or IRS notice	Possible tax identity theft	Follow the IRS notice, secure the tax account, and follow current IRS identity-theft instructions
Unknown wages or employer	Possible employment misuse	Review the Social Security earnings record and request correction; address any IRS consequences
Unknown unemployment claim	Government-benefit misuse has occurred	Report it to the state workforce agency and follow federal tax and identity-theft steps
Unknown medical claim	Possible medical identity theft	Contact the insurer or Medicare and provider; review and correct the medical record
Existing bank, email, or phone account changed	Account takeover may be in progress	Contact the institution immediately, recover access, remove unauthorized changes, and strengthen authentication

The Social Security Administration draws a useful line. If a number was merely lost, shared, stolen, or exposed but has not been misused, SSA directs people to preventive steps such as checking, freezing, and monitoring credit. If someone used the number to open an account or make a purchase, SSA directs the victim to IdentityTheft.gov for an FTC Identity Theft Report and recovery plan.

Do not wait for proof of financial loss before freezing credit. A freeze is preventive and free. But do not file disputes claiming a particular account is fraudulent unless there is a factual basis for that claim.

What a Credit Freeze Does

A security freeze—commonly called a credit freeze—restricts access to a person’s credit file at a consumer reporting company.

For the three nationwide credit bureaus, a freeze:

• Is free to place, lift, and remove
• Does not lower the person’s credit score
• Remains until the person lifts or removes it
• Generally stops prospective creditors from accessing the frozen file
• Makes it harder for an identity thief to open a loan or credit card that depends on that file
• Also prevents the consumer from opening some legitimate credit until the relevant freeze is lifted

It must be placed separately with:

1. Equifax
2. Experian
3. TransUnion

Freezing only one or two files leaves a gap if a business checks an unfrozen bureau. A fraud alert works differently: the consumer contacts one nationwide bureau and that bureau must notify the other two.

A freeze does not erase existing fraud

If a fraudulent account already appears on a credit report, freezing the file does not close the account, remove the entry, cancel the debt, or return stolen money. The victim must contact the business, report the identity theft, and request that the fraudulent information be blocked or removed using the appropriate documentation.

The CFPB states that a consumer can ask the credit bureaus to block identity-theft information by submitting:

• An identity-theft report
• Proof of identity
• A letter identifying the fraudulent debts or information

When the required submission is complete, federal law imposes specific duties on the reporting companies. The CFPB says they generally must block the fraudulent information within four business days, although a block can be declined or rescinded in circumstances such as materially false information or a mistaken identity-theft claim. Follow the current instructions from IdentityTheft.gov and the reporting company.

A freeze is not the same as monitoring

A freeze restricts access. Monitoring watches for certain events and reports them after they occur.

Tool	Main job	Preventive or detective?	Important limitation
Credit freeze	Restricts access to a credit file for many new-credit decisions	Preventive	Does not cover most non-credit identity misuse or existing accounts
Fraud alert	Tells creditors to take steps to verify identity	Preventive warning	Does not block access to the report
Credit monitoring	Alerts the consumer to selected credit-file changes	Detective	Usually reports an event after it reaches a monitored file
Identity monitoring	Searches additional data sources for selected identity activity	Detective	Coverage varies; no service sees every type of misuse
Identity-recovery service	Helps with response paperwork and contacts	Corrective	Does not make the stolen SSN secret again

Paid monitoring is optional. Before paying, check whether a breach settlement, employer, insurer, bank, or credit-card issuer already provides a service. Read exactly which bureaus and identity events it covers, how long it lasts, whether it automatically renews, and what recovery help is included.

The FTC cautions that credit monitoring ordinarily will not alert someone when a thief withdraws money from a bank account or uses an SSN to file a tax return. That is why monitoring cannot replace direct bank alerts, an IRS IP PIN, or review of government and medical records.

What a Credit Freeze Does Not Stop

The same Social Security number can be presented to systems that do not make a standard new-credit inquiry. A freeze at the three nationwide bureaus may have no effect on those systems.

Possible misuse	Will a three-bureau freeze ordinarily stop it?	Additional protection
New credit card, auto loan, or personal loan requiring a frozen report	Often	Freeze all three files and consider a fraud alert
Fraudulent charge on an existing credit card	No	Issuer alerts, account review, immediate fraud report
Takeover of an existing bank account	No	Secure login, MFA, transaction alerts, bank fraud department
Fraudulent federal tax return	No	IRS Identity Protection PIN and tax-account vigilance
Employment under the stolen SSN	No	Review SSA earnings; consider E-Verify Self Lock
Unemployment-benefit claim	No	State workforce-agency report and tax follow-up
Medicare or medical-insurance claim	No	Review claims and medical records; report false services
Change to Social Security direct deposit	No	Secure my Social Security; ask SSA about available blocks
New checking account	Not reliably	Review deposit-account screening reports; targeted specialty freeze
New cellphone, cable, or utility service	Not reliably	Review telecom/utility reports; consider a specialty freeze
Email, phone, or password takeover	No	Unique credentials, MFA, carrier safeguards
Criminal use of the identity	No	Police/court record response and an identity-theft recovery plan

I cannot confirm that a freeze at any particular specialty reporting company will stop every checking, cellphone, utility, insurance, or rental application. Businesses use different reports, identity-verification services, internal records, and fraud controls. Specialty freezes should be targeted to the type of suspected misuse, not treated as another universal shield.

The Most Important Steps to Take Now

If the Social Security number is known to be exposed, the following order covers the largest preventable risks without requiring a paid service.

1. Freeze All Three Nationwide Credit Files

Begin from the FTC’s official credit freeze page, which links to the three bureaus. This reduces the risk of landing on a paid look-alike site or an unrelated credit product.

For each bureau:

1. Use the official online, telephone, or mail procedure.
2. Verify the identity information requested.
3. Confirm that the status says security freeze or credit freeze.
4. Save the confirmation and recovery method securely.
5. Record the date.
6. Repeat the process at the other two bureaus.

Do not pay to place or lift the federal security freeze. A bureau may offer optional paid services nearby, but the freeze itself is free.

Protect the freeze accounts themselves

An identity thief with enough personal information might try to impersonate the victim at a credit bureau. Use:

• A unique password for each bureau account
• Multifactor authentication where offered
• An email account that is itself strongly protected
• Accurate recovery information controlled by the consumer
• Secure storage for confirmation details and recovery codes

Never give a freeze credential or one-time code to an incoming caller. If someone claims a freeze must be removed to stop fraud, end the contact and reach the bureau or creditor independently. A request to unfreeze credit can itself be part of an attempted fraud.

Lift only what is needed

When legitimately applying for credit, ask which bureau the creditor expects to use. The FTC suggests lifting the freeze only at that bureau when possible and restoring it after the credit check. Procedures and timing can change, so confirm the current bureau process before an application deadline.

2. Add a Fraud Alert When the Facts Support It

A fraud alert and a freeze can exist at the same time.

An initial fraud alert:

• Is available to someone who believes they are or may become an identity-theft victim
• Is free
• Lasts one year and can be renewed
• Requires contact with only one nationwide bureau
• Tells businesses to take reasonable steps to verify identity before granting new credit

An extended fraud alert:

• Is for someone who has experienced identity theft
• Requires an FTC Identity Theft Report or qualifying police report
• Lasts seven years
• Requires contact with only one nationwide bureau
• Provides additional credit-report access rights
• Removes the person from prescreened credit and insurance marketing lists for five years unless the person asks otherwise

A freeze is generally the stronger barrier because it restricts access to the report. A fraud alert adds a verification instruction and can be particularly useful when the freeze is temporarily lifted or an exception applies.

Do not confuse the rules: freezes require separate action at all three bureaus; an alert placed at one bureau is transmitted to the other two.

3. Obtain and Read All Three Credit Reports

Use AnnualCreditReport.com, the federally authorized source for the nationwide reports. The FTC’s June 2026 free-credit-report guidance confirms that the three bureaus currently provide free online reports weekly through that site.

Checking a report does not lower the credit score. Review each bureau because the contents can differ.

Look for:

• An account that does not belong to the consumer
• A hard inquiry the consumer did not authorize
• An unfamiliar address, telephone number, or employer
• A new collection account
• A balance or late payment tied to an unknown account
• An account that was closed or changed without permission
• A name variation connected to unfamiliar activity

The presence of an old address or a minor name variation does not by itself prove identity theft. Compare the entry with known accounts and records before disputing it.

If fraudulent information appears, do not merely press a generic “dispute” button without documenting the identity theft. Create a recovery plan, identify the furnisher, keep copies, and use the identity-theft blocking process when it applies.

4. Use IdentityTheft.gov if Misuse Has Occurred

IdentityTheft.gov is the Federal Trade Commission’s identity-theft reporting and recovery site. It creates a plan based on what was misused and can produce an FTC Identity Theft Report, sample letters, and prefilled forms.

An Identity Theft Report can help a victim:

• Close accounts opened fraudulently
• Dispute and block fraudulent credit-report information
• Respond to debts caused by identity theft
• Request records from a business where the fraud occurred
• Document the event for future recurrences

Save:

• The FTC report and recovery plan
• Confirmation numbers
• Copies of letters and forms
• Statements showing fraudulent activity
• Screenshots or messages, when relevant
• A dated log of calls, names, departments, and outcomes
• Police reports or agency notices
• Delivery records for mailed documents

Do not include a full Social Security number in ordinary email or in documents that do not require it. Redact unnecessary account data from copies while preserving complete originals in secure storage.

Exposure alone and active misuse are different

SSA states that if an SSN was exposed but has not been misused, a person does not need to file an FTC Identity Theft Report solely because of the exposure. Preventive steps are still appropriate.

If an account, tax return, benefit claim, medical claim, purchase, or other transaction was made using the identity, a formal report becomes much more important.

5. Protect the Tax Identity With an IRS IP PIN

A credit freeze does nothing to stop a fraudulent federal tax return.

The IRS Identity Protection PIN is a six-digit number known to the taxpayer and the IRS. It authenticates federal returns filed using the taxpayer’s SSN or Individual Taxpayer Identification Number. The IRS’s 2026 IP PIN guidance says any eligible primary taxpayer, spouse, or dependent who can pass identity verification may opt in.

Important facts:

• The PIN is valid for one calendar year.
• A new PIN is issued each year.
• It must be entered on applicable electronic and paper federal returns.
• A missing or incorrect PIN can reject an electronic return or delay a paper return.
• It should be shared only when needed with the tax software provider or trusted tax preparer filing the return.
• The IRS does not call, text, or email to ask for the PIN.

An IP PIN protects federal tax-return filing. It does not stop a thief from using the SSN for work, credit, benefits, health care, or financial accounts. State tax agencies may have their own identity-theft and PIN procedures.

When tax identity theft may already have occurred

Warning signs include:

• An electronic return is rejected because a return was already filed with the SSN.
• The IRS sends a letter about a return the taxpayer did not file.
• An IRS account shows an unfamiliar filing.
• The taxpayer receives a notice about wages from an unknown employer.
• A dependent’s SSN was already used on another return.

Follow the instructions in the legitimate IRS notice and verify the notice through an independently obtained IRS channel. Form 14039 is an Identity Theft Affidavit, but it should be used according to current IRS instructions and the facts. Do not repeatedly submit it for the same incident. If the only known event is exposure and no tax misuse, an IP PIN may be the most direct preventive tool.

6. Secure the Personal Social Security Record

Create or sign in to the official my Social Security account and review:

• The earnings history
• Benefit status
• Address and direct-deposit information, if receiving benefits
• Notices or activity the person does not recognize

SSA encourages people to review their Social Security Statement and earnings history. Unknown earnings may indicate that another person used the SSN for work, although reporting delays or employer errors can also explain a discrepancy.

SSA updated its online guidance in August 2026 to state that a person may be able to request correction of earnings that are not theirs through the personal account. Follow SSA’s current process and keep W-2s, tax returns, pay records, and related notices.

If an adult child or other helper is assisting an older person with these steps, the parent should retain control of credentials and decisions whenever capable. How Can You Protect an Elderly Parent’s Identity Without Taking Away Their Independence? describes consent-based alerts, shared review, limited authority, and other safeguards.

Consider SSA account blocks for a beneficiary

SSA states that beneficiaries can ask about:

• An eServices block, which prevents anyone—including the beneficiary—from viewing or changing personal information online
• A Direct Deposit Fraud Prevention block, which prevents online or financial-institution auto-enrollment changes to address or direct deposit

These blocks also restrict the rightful beneficiary, who must contact SSA to make changes or remove them. They are not necessary for every exposed SSN. They may be appropriate when benefit redirection is a credible risk or attempted misuse has occurred.

Procedures can change, so use SSA’s current fraud prevention guidance or contact SSA through a number obtained from SSA.gov.

7. Address Possible Employment Misuse

Someone may use a stolen SSN to work. A credit freeze will not stop that.

Employment misuse may first appear as:

• Wages from an unfamiliar employer on a Social Security earnings record
• A W-2 or tax document from an unknown employer
• An IRS notice suggesting income was omitted
• An E-Verify case the person does not recognize

Review the earnings record and request a correction from SSA. If the unknown wages affect a federal tax account, follow IRS identity-theft instructions as well. Correcting the SSA earnings record and correcting an IRS tax issue are separate processes.

Consider E-Verify Self Lock

The federal myE-Verify service includes Self Lock, which allows a person to lock an SSN in E-Verify to help prevent its misuse in employment-eligibility verification. The July 2026 E-Verify Self Lock FAQ confirms that the feature is specifically intended to prevent an SSN from being misused in E-Verify.

Important limitation: Self Lock affects E-Verify. It does not prevent all off-the-books employment, identity misuse at an employer that does not use E-Verify, tax fraud, credit fraud, or benefit claims. A person who is legitimately starting a job may need to unlock the SSN for the employer’s E-Verify case.

8. Watch for Unemployment and Other Benefit Fraud

Fraudulent unemployment claims can be filed with stolen identity information even while the victim remains employed.

Warning signs include:

• A notice from a state workforce agency about a claim never filed
• An employer asking about an unemployment claim the employee did not make
• A benefit payment card that was not requested
• A Form 1099-G showing unemployment compensation never received
• A notice from a state where the person did not work or live

The U.S. Department of Labor directs victims to report unemployment identity fraud to the state agency where the fraudulent claim was filed. Its unemployment identity-fraud page provides state reporting links and tax guidance.

If a 1099-G is wrong, request a corrected form from the issuing state. Keep the incorrect form and confirmation of the report. Follow IRS instructions for reporting only the income actually received, and seek qualified tax help if the notice or return is complicated.

Other benefits—such as nutrition, housing, or state health assistance—use program-specific identity and eligibility systems. A freeze at the three credit bureaus does not guarantee protection. Report an unexpected denial, approval notice, card, or account directly to the administering agency through its official site.

9. Protect Medicare and Medical Records

Medical identity theft can involve an SSN, Medicare number, insurance information, or a combination of personal data.

Review:

• Medicare Summary Notices
• Medicare Advantage or private-plan Explanations of Benefits
• Provider bills
• Pharmacy records
• Online claim histories
• Collection notices for unfamiliar medical debts

Look for a provider never visited, a service never received, an impossible date, unfamiliar equipment, or a diagnosis or prescription that does not belong to the patient.

The 2026 Medicare handbook defines medical identity theft as the unauthorized use of personal information—including a name, SSN, or Medicare number—to submit false claims. Medicare directs beneficiaries to review notices, receipts, and statements and to call 1-800-MEDICARE if the Medicare number may have been used fraudulently. Current reporting instructions are available on Medicare’s fraud and abuse page.

Medical identity theft is not only a billing issue. If another person’s diagnoses, allergies, blood type, medications, or treatments enter the victim’s record, the false information may affect future care.

When a false claim appears:

1. Contact the health plan or Medicare through a verified channel.
2. Contact the provider shown on the claim.
3. Request the relevant billing and medical records.
4. Identify information that is not the patient’s.
5. Follow the provider’s and plan’s correction processes.
6. Preserve the uncorrected record, correction request, and outcome.
7. Add the incident to the IdentityTheft.gov recovery plan.

10. Secure Existing Financial Accounts

A credit freeze does not stop a thief from entering an account that already exists.

Contact banks, credit unions, card issuers, brokerages, payment applications, and retirement-account providers if:

• A transaction is unrecognized
• Contact or recovery information changed
• A new payee or linked account appeared
• A replacement card was ordered
• A password-reset message arrived unexpectedly
• A login occurred from an unfamiliar device
• A transfer is pending

Use the number printed on a card, statement, or independently located official website—not a number in a suspicious message.

Ask the institution to:

• Stop or recall a pending transaction if possible
• Lock or replace affected cards
• Remove unauthorized devices, payees, and external accounts
• Restore the correct address, email, and telephone number
• Issue new account credentials when appropriate
• Add high-risk transaction and profile-change alerts
• Explain which written fraud claim is required
• Provide a case or confirmation number

The time available to dispute an electronic transfer, debit-card transaction, credit-card charge, check, or wire can differ by transaction type and facts. Report it immediately and follow the institution’s written instructions. I cannot confirm a universal reimbursement rule without knowing the payment method, whether credentials were shared, the timing, and the account agreement.

Secure email before resetting everything else

Email often controls password recovery for financial, government, shopping, and medical accounts. If email may be compromised:

1. Use a clean, updated device.
2. Change the email password to a unique one.
3. Sign out unknown sessions and devices.
4. Remove unknown forwarding rules, filters, recovery addresses, and recovery phone numbers.
5. Turn on strong multifactor authentication.
6. Then reset dependent accounts.

Changing bank passwords while the thief still controls the email account may simply send the new reset link to the thief.

Protect the mobile number

An identity thief with an SSN, date of birth, address, and telephone number may try to impersonate the subscriber and transfer the number. The FTC explains that a successful SIM-swap attack can let the thief receive calls and texted login codes.

Ask the carrier about:

• An account PIN
• Port-out or number-transfer protection
• SIM-change notifications
• Restrictions on telephone or in-store account changes

Names and availability vary by carrier. I cannot confirm that every carrier offers a separate port lock. For important accounts, use an authenticator app, passkey, or hardware security key instead of texted codes where supported and manageable.

11. Check Deposit-Account and Telecom Reporting Systems When Relevant

The three nationwide bureaus are not the only consumer reporting companies.

The CFPB maintains a list of consumer reporting companies covering checking-account screening, utilities, employment, insurance, tenant screening, and other markets.

Checking and savings accounts

Banks and credit unions may use deposit-account screening reports when deciding whether to open an account. The CFPB says ChexSystems reports information about checking-account applications, openings, closures, and check-writing history, and currently offers both a free report and a consumer-report freeze.

If there is evidence of bank-account or check fraud:

• Request the relevant ChexSystems report.
• Review Early Warning Services or another screener identified by a bank.
• Dispute inaccurate information.
• Consider a ChexSystems freeze.
• Ask the bank where fraud occurred which screening service was used.

A ChexSystems freeze is separate from freezes at Equifax, Experian, and TransUnion. It does not freeze existing bank balances or stop transactions in an open account.

Cellphone, cable, and utility accounts

The National Consumer Telecom & Utilities Exchange collects information reported by participating telecommunications, pay-TV, and utility companies. The CFPB says NCTUE currently provides a report and offers a freeze. If the stolen identity is used or likely to be used for these services, review the CFPB’s current NCTUE listing and follow the official consumer process.

An NCTUE freeze is an additional, targeted layer. It does not guarantee that every carrier or utility will deny a fraudulent application, because not every provider uses the same report.

Do not freeze every obscure report automatically

The CFPB list is extensive. Freezing numerous specialty files can create administrative burdens when applying for insurance, housing, employment, utilities, or financial services.

Use the facts to prioritize:

• Checking-account fraud: deposit-account screening reports
• Utility or phone fraud: telecom and utility report
• Unfamiliar low-dollar or short-term loan: relevant subprime reporting company
• Insurance problem: insurer’s adverse-action notice and named report
• Rental or employment problem: the screening company identified in the notice

An adverse-action notice should identify the consumer reporting company that supplied information used in the decision. Request that report, review it, and dispute identity-theft information.

12. Reduce the Value of the Stolen Number

The SSN cannot normally be made secret again, but its usefulness to a thief can be reduced by strengthening the surrounding identity.

Use unique passwords or passkeys

An SSN is often combined with information from other breaches. Reused passwords, a compromised email account, and weak recovery questions can turn static personal data into account access.

Use a unique password or passkey for:

• Primary email
• Credit bureau accounts
• Banks and investments
• IRS and Social Security access
• Health insurance and Medicare
• Mobile carrier
• Password manager

Do not use the SSN, birth date, street name, pet name, or other discoverable facts in passwords or security-question answers.

Turn on multifactor authentication

MFA adds another factor beyond a password. Prefer phishing-resistant methods, such as passkeys or hardware security keys, where the service supports them and the user can manage recovery. An authenticator app is another strong option. Text codes can still help, but they depend on control of the mobile number.

Never read an unexpected verification code to a caller. The FTC warns that anyone asking for a login verification code is attempting to gain access; contact the institution independently instead.

Ask before sharing the SSN again

Some organizations legitimately require the number. Others may accept a different identifier or only the last four digits.

Ask:

• Why is the full number required?
• Is the request mandatory?
• Can another identifier be used?
• How will the number be protected?
• How long will it be retained?
• What happens if the person declines?

Do not type an SSN into a page reached through an unsolicited text, email, QR code, advertisement, or pop-up.

What If the Social Security Card Itself Was Stolen?

Replacing the physical card does not replace the number and does not deactivate the stolen card’s printed number.

SSA allows a person to request a replacement card when needed. Many routine tasks do not require carrying the physical card. SSA recommends keeping the card and other documents displaying the SSN in a safe place rather than carrying them routinely.

If a wallet was stolen, address every item in it:

• Notify card issuers
• Replace the driver’s license or state ID through the issuing agency
• Report health-insurance or Medicare cards if necessary
• Watch for address changes and new accounts
• File a police report when appropriate
• Freeze credit

The act of obtaining a replacement Social Security card is not an identity-theft recovery plan.

Should You Request a New Social Security Number?

Usually, a new SSN is not the first or easiest solution.

SSA’s March 2026 publication, Identity Theft and Your Social Security Number, says SSA may assign a new number when:

• The victim has done everything possible to resolve problems caused by misuse
• Someone continues using the number
• The victim can provide evidence of ongoing problems

SSA says it will not issue a new number merely because a card was lost or stolen without evidence that the number is being used.

A replacement number is not a clean slate. Government agencies, banks, credit bureaus, and other businesses retain records under the old number. SSA warns that:

• The old and new identity records may still be connected.
• Fraud involving the person’s name, address, birth date, or other data may continue.
• Credit history may not transfer cleanly.
• The absence of credit history under the new number may make legitimate credit harder to obtain.
• A person issued a new SSN should stop using the old one.

Requesting a different number requires an in-person SSA appointment and proof of identity, age, citizenship or immigration status, and the continuing harm. It is a last-resort administrative remedy, not a substitute for correcting credit, tax, benefit, bank, or medical records.

This dependence on many overlapping records is also why identity recovery can become difficult when an address, credential, or digital record is unavailable. Can You Prove Your Identity Without a Permanent Address? explains alternative evidence and verification paths.

What Not to Do After an SSN Is Stolen

Do not move money because a caller says the SSN is “suspended”

SSA does not suspend an SSN because of alleged criminal activity. Its current Social Security scam guidance identifies threats to suspend a number, demands for immediate payment, forced secrecy, and instructions to move money as scam signals. A caller may know real personal information and may spoof an official number.

Government agencies will not require a person to transfer money to a “safe” account, buy gift cards, purchase cryptocurrency or gold, hand cash to a courier, or keep the matter secret. End the call and contact the agency through its official website.

Do not unfreeze credit for an incoming caller

A caller may claim that the freeze is blocking an investigation or refund. Do not lift it from a link or number the caller provides. Verify the transaction independently.

Do not pay a company to “change” or “clean” the SSN

No private credit-repair or identity-protection company can erase the original Social Security number from legitimate government and financial records. A company also cannot lawfully remove accurate negative credit information merely because the consumer pays.

Do not rely on a single monitoring dashboard

A dashboard may show only one or two bureaus, or only events reported to credit systems. Confirm the scope. Directly review financial statements, tax records, Social Security earnings, health claims, and benefit notices.

Do not dispute accurate information

Identity-theft protections are for information created by misuse. Disputing a legitimate debt as identity theft can undermine a valid claim and may have legal consequences.

Do not repeatedly expose the number during recovery

Use secure upload portals, verified mailing addresses, or in-person processes requested by the institution. Avoid ordinary email unless the institution provides an approved secure method. Send only the identifying information required for that step.

How Long Must You Keep Watching?

There is no reliable expiration date for a stolen SSN. A thief may use information immediately, sell it, combine it with later breach data, or wait.

The freeze should generally remain in place whenever the consumer is not actively applying for credit. It does not expire unless the consumer removes it.

A practical review schedule is:

Immediately

• Freeze Equifax, Experian, and TransUnion.
• Secure primary email, mobile carrier, bank, and government accounts.
• Obtain an IRS IP PIN.
• Pull all three credit reports.
• Report confirmed misuse and stop active transactions.

During the first month

• Resolve unknown inquiries and accounts.
• Review bank, card, investment, medical, tax, and benefit records.
• Check Social Security earnings.
• Add a fraud alert when appropriate.
• Review specialty reports tied to the suspected fraud.
• Preserve a complete incident file.

During the first year

• Review credit reports regularly; free weekly access is currently available.
• Read every financial and medical statement.
• Investigate unexpected mail, tax forms, benefit notices, denials, and collection calls.
• Keep recovery contact information current.
• Obtain and use the new annual IRS IP PIN.

Long term

• Keep the freezes in place except for controlled lifts.
• Review the Social Security Statement at least annually.
• Continue using unique authentication and direct account alerts.
• Keep the FTC Identity Theft Report and correction records indefinitely if misuse occurred.
• Revisit specialty freezes when applying for a legitimate service.

This schedule is a risk-management approach, not a legal deadline. Specific dispute and reporting deadlines depend on the type of account and transaction.

Example: Taylor Freezes Credit but Finds a Second Risk

Taylor receives a breach notice stating that a database containing names, birth dates, addresses, and Social Security numbers was accessed. There is no evidence yet that Taylor’s information was used.

Taylor immediately freezes Equifax, Experian, and TransUnion and saves the confirmations securely. Taylor pulls all three reports through AnnualCreditReport.com and finds no unknown credit accounts.

At this point, it would be easy to assume the problem was solved. Instead, Taylor asks what the freeze does not cover.

Taylor then:

1. Obtains an IRS Identity Protection PIN and records how to retrieve the new PIN next year.
2. Secures the primary email account with a unique password and stronger MFA.
3. Reviews bank and investment accounts and enables alerts for new payees, transfers, address changes, and password resets.
4. Adds a carrier account PIN and the available number-transfer protection.
5. Signs in to my Social Security and reviews the earnings history.
6. Reviews health-insurance claims and recent medical bills.
7. Creates a calendar reminder to review credit reports and government records.

Four months later, Taylor receives a notice from a state workforce agency about an unemployment claim that Taylor never filed. The credit reports still look normal because the claim did not require a new credit account.

Taylor reports the fraudulent claim to the state, saves the confirmation, adds the event to an IdentityTheft.gov report, notifies the employer, and watches for an incorrect 1099-G. Taylor also reviews the IRS account and confirms that the IP PIN remains secure.

The credit freeze did exactly what it was designed to do. It did not fail. It simply was never designed to stop the unemployment claim.

A Complete SSN-Theft Protection Checklist

Credit protection

• Freeze Equifax.
• Freeze Experian.
• Freeze TransUnion.
• Protect each bureau account with unique credentials.
• Add an initial or extended fraud alert if appropriate.
• Obtain reports from all three bureaus.
• Identify unfamiliar accounts, inquiries, addresses, and collections.
• Report and block confirmed identity-theft information.
• Keep freezes active except for controlled legitimate applications.

Tax and employment protection

• Obtain an IRS IP PIN.
• Understand that a new PIN must be used each calendar year.
• Secure the IRS online account.
• Review the Social Security earnings record.
• Correct wages that do not belong to the taxpayer.
• Consider E-Verify Self Lock.
• Follow state tax-agency identity-theft procedures where relevant.
• Investigate an unfamiliar W-2, IRS notice, or rejected return immediately.

Benefits and medical protection

• Review unemployment notices and Form 1099-G.
• Report a false claim to the issuing state.
• Review Social Security benefit and direct-deposit information.
• Ask SSA about account blocks if benefit redirection is a serious risk.
• Review Medicare Summary Notices or plan Explanations of Benefits.
• Report services, equipment, or prescriptions never received.
• Correct false medical-record information.
• Investigate notices about other government benefits.

Financial and digital protection

• Secure primary email first.
• Use unique passwords or passkeys.
• Enable strong MFA.
• Remove unknown devices and recovery methods.
• Add bank and card transaction alerts.
• Add alerts for profile, payee, transfer, and password changes.
• Contact the carrier about a PIN and port protection.
• Never share an unexpected verification code.
• Contact institutions through independently verified channels.

Targeted specialty protection

• Review ChexSystems if checking-account fraud is suspected.
• Review other deposit-account screeners identified by a bank.
• Consider a targeted deposit-report freeze.
• Review NCTUE if cellphone, cable, or utility fraud is suspected.
• Use the CFPB company list to identify other relevant reports.
• Keep records needed to lift specialty freezes for legitimate applications.

Documentation

• Create an IdentityTheft.gov report if misuse occurred.
• Keep the recovery plan and FTC Identity Theft Report.
• Save statements, notices, and correspondence.
• Maintain a dated contact log.
• Keep proof that fraudulent accounts were closed or corrected.
• Store full-SSN documents securely.
• Redact unnecessary sensitive information from working copies.

Related Articles

• How Can You Protect an Elderly Parent’s Identity Without Taking Away Their Independence?
• Can a Deceased Person’s Credit Files Be Frozen?
• Could You Prove Who You Are If Every Digital Record of You Suddenly Disappeared?
• Can You Prove Your Identity Without a Permanent Address?

Frequently Asked Questions

Is a credit freeze the first thing to do after an SSN is stolen?

It is one of the first preventive steps, especially if no fraudulent account has appeared yet. Freeze Equifax, Experian, and TransUnion separately. If money is actively leaving an account, email has been taken over, or a tax or benefit filing is in progress, stopping that active misuse may be equally urgent or more urgent.

Can someone use my SSN while my credit is frozen?

Yes. A thief may try to use it for an existing-account takeover, tax return, job, unemployment claim, medical service, government benefit, cellphone account, checking account, or other purpose that does not depend on access to the frozen nationwide credit files.

Will a freeze stop someone from using my existing credit card?

No. A freeze does not stop charges on an existing account. Review transactions, enable alerts, and contact the issuer immediately about an unauthorized charge, card, user, address change, or login.

Should I place both a freeze and a fraud alert?

You may. The FTC says an alert can be added even when a freeze is in place. The freeze restricts access to the file; the alert tells creditors to verify identity. An initial alert lasts one year. A qualifying identity-theft victim can request a seven-year extended alert with the required report.

Do I have to pay to freeze my credit?

No. Federal freezes at Equifax, Experian, and TransUnion are free to place, lift, and remove. Optional monitoring subscriptions and other products may cost money, but they are not required to use the freeze.

Does freezing one credit bureau freeze all three?

No. Each freeze must be placed separately. This differs from a fraud alert, for which the nationwide bureau contacted must notify the other two.

Can I still use my existing credit cards after freezing my credit?

Yes. A freeze generally affects access to the credit report for new applications, not routine use of existing accounts. An existing creditor and certain other entities may retain permitted access. The card can still be lost, stolen, or taken over, so account monitoring remains necessary.

Will a credit freeze hurt my score?

No. The FTC and CFPB state that placing a security freeze does not lower a credit score. Checking one’s own report also does not lower it.

Should I get an IRS IP PIN if my SSN was exposed but not yet misused?

It is a strong preventive option. The IRS permits eligible taxpayers who can verify their identity to opt in even if tax identity theft has not occurred. The taxpayer must retrieve and use the current six-digit PIN on applicable federal returns each year.

Does an IRS IP PIN protect state tax returns?

Not automatically. It authenticates federal tax returns. State revenue agencies may offer separate identity-verification or PIN programs. Check the official state tax-agency instructions.

How can I tell if someone is working under my SSN?

Review the earnings history in the official my Social Security account and compare it with W-2s, tax returns, and pay records. Unknown earnings or an unfamiliar employer may indicate misuse, although reporting errors are also possible. SSA now provides an online correction route in some cases.

What does E-Verify Self Lock do?

It locks the SSN within E-Verify to help prevent someone else from using it in an E-Verify employment-eligibility case. It does not stop every kind of employment misuse and must be managed when the rightful owner begins a job involving E-Verify.

Should I freeze ChexSystems too?

Consider it when checking-account or check fraud is a credible concern. ChexSystems is a deposit-account screening company, and its freeze is separate from the three nationwide credit freezes. It will not stop transactions in an existing bank account or guarantee that every bank will reject a fraudulent application.

Will replacing my Social Security card change my number?

No. A replacement card ordinarily shows the same SSN. Replacing the card may restore the physical document, but it does not make the stolen number unusable.

Can I get a completely new Social Security number?

Only in limited circumstances. SSA may consider a new number when documented misuse continues after the victim has taken available corrective steps. A missing card or exposed number without evidence of use is not enough. A new number may also create credit and record-matching problems and does not guarantee a fresh start.

How often should I check my credit reports after a theft?

The three nationwide bureaus currently make free reports available weekly through AnnualCreditReport.com. The right schedule depends on the evidence and risk. Review promptly after exposure, more frequently during active recovery, and periodically thereafter while keeping the freezes in place.

Is dark-web monitoring enough to protect a stolen SSN?

No. It may report that information appears in a dataset, but it cannot retrieve every copy or stop the number from being presented elsewhere. Treat a credible alert as evidence of exposure and use preventive controls across credit, tax, financial, government, medical, email, and phone systems.

Do I need a police report?

Not for every exposure. A police report may be useful or required in some recovery situations, especially when money, physical documents, criminal impersonation, or local offenses are involved. IdentityTheft.gov can create an FTC Identity Theft Report and identify the documentation needed for the reported misuse.

How long should a credit freeze stay in place?

A freeze lasts until the consumer lifts or removes it. If the SSN is known to be compromised, leaving the freezes in place and temporarily lifting only the necessary bureau for a legitimate application is usually the safer long-term arrangement.

Quick Summary

A credit freeze is essential after a Social Security number is stolen, but it is not enough by itself. It restricts access to credit files at Equifax, Experian, and TransUnion, helping stop many new loans and credit cards. It does not deactivate the SSN, repair fraud already on a report, protect existing accounts, or stop tax, employment, unemployment, medical, benefit, phone, or utility misuse.

Freeze all three nationwide files and consider a fraud alert. Review the reports through AnnualCreditReport.com and use IdentityTheft.gov when actual misuse has occurred. Add an IRS Identity Protection PIN, secure email and financial accounts, review the Social Security earnings record, and watch medical and benefit notices. Use E-Verify Self Lock or specialty consumer-report freezes when the relevant risk exists. A new SSN is rarely issued and does not create a clean identity. The long-term goal is not to make the stolen number secret again; it is to make the number insufficient to open, access, file, claim, or change anything important without another form of verification.

Sources and References

• Federal Trade Commission, Credit Freezes and Fraud Alerts
• Federal Trade Commission, What To Know About Identity Theft
• Federal Trade Commission, Free Credit Reports
• Federal Trade Commission, IdentityTheft.gov
• Consumer Financial Protection Bureau, What Do I Do if I Am a Victim of Identity Theft?
• Consumer Financial Protection Bureau, List of Consumer Reporting Companies
• Consumer Financial Protection Bureau, ChexSystems
• Consumer Financial Protection Bureau, National Consumer Telecom & Utilities Exchange
• Social Security Administration, Identity Theft and Your Social Security Number
• Social Security Administration, Fraud Prevention and Reporting
• Social Security Administration, Protect Yourself From Social Security Scams
• Social Security Administration, my Social Security
• Social Security Administration, Correcting Earnings That Are Not Yours
• Internal Revenue Service Taxpayer Advocate Service, Get an IP PIN—2026 Update
• Internal Revenue Service, Form 14039, Identity Theft Affidavit
• E-Verify, Self Lock
• U.S. Department of Labor, Report Unemployment Identity Fraud
• Medicare, Reporting Medicare Fraud and Abuse
• Federal Trade Commission, What To Know About Medical Identity Theft
• Federal Trade Commission, SIM Swap Scams
• Cybersecurity and Infrastructure Security Agency, Secure Our World

Editorial Review

Reviewed by Claire Bennett, Managing Editor

Last reviewed: August 2026

Quick Answer Guide publishes practical, research-based answers to common questions about money, technology, health, travel, home improvement, and everyday life. Content is reviewed using official government resources, educational institutions, industry publications, and other authoritative sources when appropriate. Articles are updated periodically to improve accuracy and usefulness.