Security

What to Do If Your Social Security Number Is Leaked or Stolen

Q: What should I do first if my SSN is leaked?

Freeze your credit at all three bureaus — Equifax, Experian, and TransUnion — to block new accounts from being opened in your name. Then report the exposure at IdentityTheft.gov, the FTC's official site, which generates a personalized recovery plan and an official Identity Theft Report. These two steps address the most immediate risk in the first 24 to 48 hours.

Q: Should I freeze my credit or set a fraud alert?

For the strongest protection, do both. A credit freeze restricts access to your credit report so new accounts can't be opened, and is free at all three bureaus. A fraud alert requires creditors to verify your identity before approving new credit and only needs to be placed at one bureau, which must notify the other two. An initial fraud alert lasts one year; an extended alert lasts seven years for confirmed identity theft victims who filed an FTC report.

Q: How do I protect my tax refund after my SSN is stolen?

Request an Identity Protection PIN (IP PIN) from the IRS, a six-digit number that must be included on your tax return for it to be accepted — this blocks someone from filing a fraudulent return with your SSN. Filing your own return as early as possible each year also helps, since tax fraud relies on filing before you do.

Q: Can I lock my Social Security number?

You can limit misuse of your SSN in a few ways. You can block electronic access to your Social Security records by contacting the Social Security Administration, and you can help prevent someone using your SSN for employment through E-Verify's Self Lock feature. These reduce specific types of misuse but don't replace a credit freeze.

A leaked Social Security number is one of the more serious kinds of exposure, because unlike a password, you can't just change it. But panic doesn't help — a clear, ordered response does. Here's exactly what to do, starting with what matters most in the first 24 to 48 hours.

Quick answer

First, freeze your credit at all three bureaus (Equifax, Experian, TransUnion) to block new accounts. Then report the theft at IdentityTheft.gov, which creates a recovery plan and an official Identity Theft Report. Add a fraud alert, request an IRS Identity Protection PIN to protect your tax refund, and consider blocking electronic access to your Social Security records. Because you can't change your SSN, lasting vigilance matters more here than with other leaks.

First, understand what's actually at risk

A Social Security number is the master key to your financial identity. With it, someone can try to open credit accounts, file a tax return to steal your refund, claim government benefits in your name, or take over existing accounts. The goal of the steps below is to shut those doors — ideally before anyone walks through them.

The reassuring part: most of the highest-impact protections are free, and the most important ones take minutes. Speed matters more than perfection here, so work down the list in order rather than trying to do everything at once.

"You can't change your Social Security number like a password — so the response isn't to undo the leak, it's to lock every door the number could open."

The response, in priority order

Freeze your credit at all three bureaus This is the single most effective move. A freeze blocks new creditors from pulling your file, so new accounts can't be opened in your name. It's free and must be done individually at Equifax, Experian, and TransUnion. See our guide on how a credit freeze works. Do this first

Report it at IdentityTheft.gov The FTC's official site walks you through a personalized recovery plan and generates an official Identity Theft Report — the document you'll use to dispute fraud with creditors, banks, and agencies. This report is what unlocks several of your later rights, so don't skip it. Do this first

Place a fraud alert A fraud alert requires creditors to verify your identity before opening new credit. You only need to contact one bureau — it must notify the other two. An initial alert lasts one year; with an FTC Identity Theft Report, you can place an extended alert lasting seven years. For maximum protection, use both a freeze and a fraud alert. Within 24 hours

Protect your tax refund with an IRS IP PIN Tax fraud is one of the most common uses of a stolen SSN — criminals file a fake return early to grab your refund. Request an Identity Protection PIN (IP PIN) from the IRS: a six-digit code required for your return to be accepted. Filing your own return as early as possible each year also helps you beat a fraudster to it. Within a few days

Limit misuse of the SSN itself You can block electronic access to your Social Security records by contacting the Social Security Administration, and you can help prevent someone using your number for employment through E-Verify's Self Lock. These address specific misuse types the credit freeze doesn't cover. Within a few days

Monitor and document everything Review your credit reports for accounts you don't recognize, and watch bank and card statements closely. Keep a written log of every call and letter — dates, names, reference numbers — because disputing fraud often takes follow-up, and good records are what resolve it. Ongoing

Consider a police report if fraud has already happened

If your SSN has actually been used — not just exposed — a police report adds official documentation. Some financial institutions require one before reversing fraudulent charges. Bring your FTC Identity Theft Report, a government photo ID, proof of address, and any evidence of the theft. For a mere exposure with no misuse yet, the freeze-plus-FTC-report combination is usually the priority.

Why an SSN leak is different from other breaches

Most exposed data can be changed — you reset a password, you get a new card number. Your Social Security number is effectively permanent. That means a leaked SSN doesn't have a clean expiration date on its risk: the number can resurface in new data dumps, get bundled with other stolen information, and be misused years after the original leak.

This is why the durable protections matter most here. A credit freeze that stays in place, an IP PIN you renew, and ongoing attention to your accounts do more for an SSN leak than any one-time action. If your number was exposed as part of a larger breach, our guide on what to do after a data breach covers the wider response.

The quieter lesson

Identity protection is a classic quietly important thing: the freeze you set today protects you against a threat that may not materialize for years, with nothing prompting you to maintain it. The people who handle an SSN leak best are usually the ones who had protections in place *before* it happened — which is an argument for treating a credit freeze as a default state, not an emergency measure. If you have children, the same logic applies to freezing their credit, since their unused SSNs are especially attractive targets.

Frequently asked questions

What should I do first if my SSN is leaked?

Freeze your credit at all three bureaus to block new accounts, then report the exposure at IdentityTheft.gov, which generates a recovery plan and an official Identity Theft Report. These address the most immediate risk in the first 24 to 48 hours.

Should I freeze my credit or set a fraud alert?

For the strongest protection, do both. A freeze restricts access to your credit report so new accounts can't be opened, and is free at all three bureaus. A fraud alert requires creditors to verify your identity and only needs to be placed at one bureau, which notifies the other two. Initial alerts last one year; extended alerts last seven years for confirmed victims who filed an FTC report.

How do I protect my tax refund after my SSN is stolen?

Request an Identity Protection PIN (IP PIN) from the IRS — a six-digit number required for your return to be accepted, which blocks fraudulent returns filed with your SSN. Filing your own return as early as possible each year also helps, since tax fraud relies on filing before you do.

Can I lock my Social Security number?

You can limit misuse in a few ways: block electronic access to your Social Security records by contacting the SSA, and help prevent employment misuse through E-Verify's Self Lock. These reduce specific misuse types but don't replace a credit freeze.

How long does the risk from a leaked SSN last?

Potentially for life. Unlike a password or card number, you generally can't change your SSN, and leaked data can resurface or be sold years later. That's why lasting protections like a credit freeze and ongoing vigilance matter more for an SSN leak than for most other exposures.

From Attune

Join others catching what slips through the cracks

The quietly important things most people miss — money you're owed, exposure you didn't know about, costs that quietly add up. A few worth your attention, every so often. No noise.

The best protections are the ones already in place before you need them.

Attune is being built as a trusted awareness layer for modern adult life — a calmer way to notice overlooked risks, hidden financial leakage, forgotten responsibilities, unused benefits, privacy exposure, and quietly important things before they disappear from view.

Get Early Access Learn what Attune is →