Industry
Social Security Number Stolen? Steps US Residents Should Take First
A stolen SSN needs a fast, ordered response: report at IdentityTheft.gov, freeze all three credit files, and tell the IRS. Timelines for each stage, in order.
What to take away
- Report the theft at IdentityTheft.gov first. The recovery plan and identity theft report it produces are the documents the credit bureaus and the IRS ask for by name.
- Freeze your credit at all three bureaus, not only the one you bank with. Federal law requires bureaus to place, lift and remove a freeze on request.
- File IRS Form 14039 and request an Identity Protection PIN if a return may be filed in your name.
- Ask the Social Security Administration about a replacement card, and expect a new number only in narrow cases.
- Log every date, reference number and name. Recovery runs on what you can document.
The short version
A stolen Social Security number is a slow problem, not an emergency. The first week of work decides how the next six months go.
The FTC's identity theft resources walk you through a recovery plan and produce a signed identity theft report. Nearly every later step leans on that document.
A credit freeze is the other anchor. It blocks a lender from pulling your file at all, while a fraud alert only asks the lender to check who is applying.
Stage by stage
- File the report at IdentityTheft.gov. Same day, usually 20 to 60 minutes.
- Freeze all three credit files. Same day to one business day each when done online, and a bureau that wants documents by mail adds 3 to 5 days.
- Read all three credit reports for inquiries you do not recognize. One to three days.
- Add a fraud alert if a freeze is impractical. One day to place, one year of coverage, or seven years in the extended version.
- Notify the IRS with Form 14039 and the tax identity theft guidance. Two to six weeks, because the PIN arrives by mail.
- Request a replacement card from the Social Security Administration. Two to four weeks by mail.
If the number leaked from a company, that company owes you notice under your state's breach notification law. Every state has one, and the timing is set by statute rather than by the company's schedule.
What has to exist before what
The freeze is the blocker, not the dispute. Nothing downstream holds until all three files are frozen, because one open file is enough for an account to be opened in your name.
| Step | Needs first | Why it waits |
|---|---|---|
| Extended seven year fraud alert | Signed identity theft report | Bureaus grant the longer alert only with the report attached |
| Block under FCRA 605B | Identity theft report and a police report | The block is a statutory remedy, not a goodwill gesture |
| IRS Identity Protection PIN | Confirmed address with the IRS | The PIN is mailed, so a stale address adds weeks |
| Dispute of a fraudulent account | Freeze already in place | New accounts can open during the 30 day reinvestigation |
The police report is the step most people skip and the one that unlocks the block. The definition of an identity theft report requires an official report filed with a law enforcement agency, which the FTC affidavit alone does not satisfy. If the number escaped through a shared login rather than a form, the account security lessons from staff departures are worth reading before you write your own timeline.
Where it stalls
The verification loop: a dispute comes back marked verified while the account stays on the file.
The cause is procedural. An online dispute filed as an accuracy complaint goes to the furnisher, the furnisher confirms the data it originally sent, and the entry survives.
Filing under the 605B block instead requires the identity theft report, proof of identity and a police report. Without those attachments the loop can run three to six months and end where it started. Watch for account security warning signs when several accounts were touched at once, since that pattern points to a reused password rather than a leaked number.
What to do while waiting
- Save the FTC report as a PDF with its confirmation number.
- Log every call: date, representative, reference number.
- Recheck all three credit reports 30 days after a dispute.
- Watch the mail for IRS letters, including a 5071C notice about a return you did not file.
- Ask about ChexSystems if a deposit account was opened in your name.
Waiting is not idle time. Each item takes minutes and builds the record that decides later disputes. What changed in account security is a short read if the leak traced back to a platform rather than a paper form.
Common questions
Does a stolen Social Security number mean I get a new one? The Social Security Administration assigns a new number only in narrow cases, such as ongoing misuse tied to crimes. Most people receive a replacement card for the same number.
How long does recovery take? The FTC has estimated that a victim with several fraudulent accounts spends about six months and 200 hours on recovery. A frozen file that stops new accounts shortens the tail.
Do I need a police report? For a block under FCRA 605B, yes. The definition of an identity theft report requires an official report filed with a law enforcement agency. Ask for the report number and a copy.
What about the breach email that told me? Do not use its links. Open the company's site yourself and confirm the notice is real. A phishing scam detection tool helps you judge a suspicious message, but typing the address yourself is faster and safer.
