What to Do If Your Social Security Number Is Compromised: A Step-by-Step Guide

You got a Social Security number for a campus job, an internship or OPT, and you used it on a handful of forms. Then a breach email lands, a wallet goes missing or a caller reads your number back to you. Now that nine-digit number feels like a loose key to your whole American life.

The good news is that you can act fast, and most of the steps are free. This guide walks you through what to do in the first hour, how to freeze your credit, how to protect your work and tax records, what to do if the number has already been misused and how to keep it safer from now on.

College Life, the global club for young internationals, is working with Bitdefender to help moved-abroad 18 to 35s keep their devices, data, money and identity safe while they live their whole lives online in a new country. In line with this mission, Bitdefender is providing College Life Club members with 50% off the first year for young professionals and graduates, and a free-trial option for students. Become a member of College Life Club (free) to get this benefit right now.

Key Takeaways

• Start by working out what was exposed and checking for signs that someone has already used it.
• Freeze your credit at Equifax, Experian and TransUnion; it is free and blocks new accounts in your name.
• Check your earnings record, consider locking your number for job checks and get an IRS identity protection PIN.
• If someone has used your number, report it at IdentityTheft.gov to get a personal recovery plan.
• Share your number less often, store the card safely and never confirm it to an unexpected caller.

What to Do If Your Social Security Number Is Compromised: The First Hour

Spend the first hour on facts, not panic. A compromised number is not the same as stolen money, and most damage happens later, when someone tries to open an account or claim a refund in your name. Ongoing monitoring helps from this point on: Bitdefender Digital Identity Protection says it monitors the public web and the dark web for your personal data and sends real-time breach notifications when it finds a problem.

Confirm what was exposed

Read the breach notice or think back to what you lost. Was it only your number, or your number with your name, date of birth and address? A full set is more useful to a criminal than the number alone. Note which company or organisation had your details, the date of the incident and what they say they are doing about it. If you lost a wallet, list every card and document that was inside it, because each one may need its own step.

Check for signs of misuse

Look for clues that someone has already used your details. IdentityTheft.gov's warning signs include bank withdrawals you cannot explain, missing bills or mail, debt collectors calling about debts that are not yours, unfamiliar accounts on your credit report and an IRS notice about a second tax return or income from an employer you do not work for. If you see any of these, skip ahead to the misuse section below. If you see none, carry on with the protection steps.

Ignore unexpected callbacks

A breach often triggers a second wave of scams. Criminals know your details are out there and call, text or email pretending to help. The same IdentityTheft.gov guidance warns that scammers often pose as the Social Security Administration, the IRS or a business you know, and it says not to click links in unexpected messages. Contact the organisation through a website you trust, never through the number or link in the message.

Keep a written record

Open a note on your phone or laptop and log every step: who you contacted, when, what they said and any reference numbers. Save copies of breach notices and letters. If you used your number for an on-campus job, note your employer and start date too, because your real work history makes fake jobs easier to spot. This record saves hours later if you need to dispute an account or prove when you took action.

Freeze Your Credit at All Three Bureaus

A credit freeze is the single most useful step for most people. USAGov explains that when you place a security freeze, creditors cannot access your credit report, which keeps them from approving any new account in your name, fraudulent or legitimate. A freeze stops new credit, but it does not tell you when your details turn up somewhere new. That is where identity monitoring alerts fill the gap, so you hear about fresh exposures instead of finding out from a debt collector.

Know why it matters

Many internationals have a short or thin credit file, so a fake account can do outsized damage. One fraudulent card or phone contract with missed payments can drag down a score you have spent years building. It can also turn up when you apply for an apartment, a car loan or a job that runs a background check. A freeze protects that file even if you leave the US for a while, because it stays in place until you lift it.

Place each freeze separately

You need to contact all three major credit bureaus: Equifax, Experian and TransUnion. Each one holds its own file, so a freeze at one does not cover the others. USAGov says freezing and lifting is free, and you can ask online, by phone or by mail. Online and phone freezes must be in place within one business day; mail requests take up to three business days. Create an account with each bureau if you can, and save the login or PIN in a password manager.

Add a fraud alert

A fraud alert is a lighter extra layer. IdentityTheft.gov's breach checklist says you can place a free, one-year fraud alert by contacting just one of the three bureaus. With the alert in place, a business has to verify your identity before it opens a new credit account in your name. A fraud alert and a freeze can work side by side, and the alert is useful if you ever need to lift the freeze for a short time.

Lift it when needed

A freeze does not damage your credit or lower your score. When you apply for a credit card, a phone contract or a lease that needs a credit check, lift the freeze for that bureau or all three. USAGov says online and phone requests to lift a freeze must be processed within one hour. Ask the lender which bureau it uses so you only lift the one you need, then let the freeze return.

Check your reports weekly

A freeze does not hide your existing accounts, so keep checking them. IdentityTheft.gov says you can check your credit reports online every week for free at AnnualCreditReport.com. Look for accounts, addresses and hard inquiries you do not recognise. If a company offers you free credit monitoring after a breach, IdentityTheft.gov says to accept it, because it alerts you to activity such as a new loan, a new card or a late payment.

Lock Down Your Work and Tax Records

Your number is not only a credit key. In the US it also ties you to your work history and your tax account, and criminals use both. IdentityTheft.gov lists opening accounts, taking out loans, filing taxes and getting a job as common ways a thief uses a stolen number. Ongoing breach monitoring watches for new exposures of your data while you deal with the official records below.

Check your earnings record

The government keeps a record of the earnings reported under your number. IdentityTheft.gov suggests reviewing your Social Security work history by creating an account at socialsecurity.gov/myaccount. Compare the employers and amounts with your own record. A job you never had, or income in a year you were not working, is a clear sign that someone is using your number for work. If you find errors, the guidance says to contact your local SSA office.

Lock it for job checks

E-Verify is an online system that lets employers confirm someone is eligible to work in the US. According to IdentityTheft.gov, it also lets you lock your Social Security number so others cannot use it to get a job. The service is run by the Department of Homeland Security and the Social Security Administration. When someone tries to use a locked number, employers that use E-Verify must get more information from that person. Unlock it before you start a new job of your own.

Get an IRS IP PIN

Tax identity theft is a real risk for anyone with a refund due. The IRS describes the IP PIN as a six-digit number that stops someone else filing a tax return with your SSN or ITIN. Anyone with an SSN or ITIN who can verify their identity can get one, even if they are not required to file. The fastest route is through your IRS online account. The PIN is valid for one calendar year, a new one is generated each year and it works on Form 1040-NR, which many international students use.

Answer IRS letters quickly

IdentityTheft.gov says to try to file your taxes early, before a scammer can, and to respond right away to letters from the IRS. A letter about a return you did not file, or income from an employer you never worked for, needs action the same week. Use the contact details from IRS.gov, never from a message you were not expecting. Keep your annual return and any forms from your employers, because they prove which income is really yours.

What to Do If Your Social Security Number Is Compromised and Misused

If you found a strange account, a tax notice or a job you never had, you are past prevention and into recovery. You are far from alone. The FBI's 2024 IC3 report logged 21,403 identity theft complaints with losses of more than $174 million, plus 17,367 government impersonation complaints with losses of more than $405 million.

Report at IdentityTheft.gov

Start at IdentityTheft.gov, the Federal Trade Commission's recovery site. You answer questions about what happened, and it builds a personal recovery plan. If you create an account, it walks you through each step, tracks your progress and pre-fills forms and letters for you. The site warns that filing a false report is illegal, so stick to the facts. If a bank or landlord asks for one, a police report from your local station may also help; our guide to a formal report explains how.

File Form 14039 if needed

If someone filed a tax return with your number, the IRS needs to know. USAGov's identity theft page points victims to IRS Form 14039, the Identity Theft Affidavit, when someone has filed a tax return in their name. Keep filing your own return as normal, and keep copies of everything you send. Once you are a confirmed victim, the IRS says it mails you a new IP PIN each year in a CP01A notice.

Dispute fake accounts

For every account or debt you do not recognise, contact the company directly. Explain that it is fraud, ask them to close the account and ask for a letter confirming that you are not responsible. Then dispute the entry with each credit bureau that shows it. IdentityTheft.gov provides sample letters for this. Keep your freeze in place while you work through the list, so no new accounts appear while you close the old ones.

Ask about a new number

A new Social Security number sounds like a clean fix, but it rarely is. IdentityTheft.gov says that in most cases of a lost or stolen number, you cannot get a new one without evidence that someone else is misusing it. It adds that a new number likely will not solve all your problems, because agencies and companies still have records linking you to the old one. For most people, a freeze, a lock and close monitoring do more.

How to Protect Your SSN After a Scare

Once the urgent steps are done, the goal is to make the next incident smaller. That means giving out your number less, storing it better and treating every unexpected request as a test. These habits matter for internationals in particular, because you often hand documents to new employers, landlords and offices in quick succession.

Share it less often

Many forms ask for your number when they do not need it. Ask why it is required, how it will be stored and whether another ID will do. Employers, banks and the IRS have real reasons; a gym, a store loyalty scheme or a club sign-up usually does not. When you start a job, your onboarding forms will ask for it, so hand it over in person or through the employer's official portal, never by email or text.

Store the card safely

Do not carry your Social Security card in your wallet. Keep it at home with your passport and visa documents, somewhere locked if you share housing. Never photograph it and leave the image in your camera roll, where a cloud breach or a lost phone can expose it. If you need a digital copy for paperwork, store it in an encrypted vault, and delete it from email attachments and downloads folders once you have used it.

Spot government impersonators

Government impersonation is one of the most expensive scams in the US. Treat any caller who threatens arrest or deportation, or asks for gift cards, crypto or a wire transfer, as a scammer. The IRS says it will never ask for your IP PIN, and that calls, emails or texts asking for it are scams. If a message claims your number is "suspended" or linked to a crime, hang up and contact the agency through its official website.

Keep monitoring running

Your number does not expire, so the risk does not end after a month. Keep your freezes in place, check your credit reports regularly, look at your earnings record once a year and retrieve your new IP PIN each year. Turn on two-step login for your email, because a hacked inbox is where many resets begin. If you move home or leave the US, update your contact details with the bureaus and the IRS so their letters still reach you.

Conclusion

Knowing what to do if your Social Security number is compromised turns a frightening moment into a checklist. Confirm what was exposed, freeze your credit at all three bureaus, protect your work and tax records with a lock and an IP PIN, and report any misuse at IdentityTheft.gov to get a recovery plan. After that, small habits keep you safer for years. The purpose of this guide was to help you keep your devices, data, money and identity safe while you live your whole life online in a new country. To help you on this journey, College Life has partnered with Bitdefender to make your life easier. Join College Life Club for free and start taking advantage of this today.

FAQ

What should I do first if my SSN is compromised?

Check for signs that someone has already used it, such as unknown accounts on your credit report or an IRS letter about a return you did not file. Then freeze your credit at Equifax, Experian and TransUnion. Freezing is free and blocks new accounts in your name.

Can I get a new Social Security number?

Only in limited circumstances. In most cases of a lost or stolen number, you need evidence that someone is misusing it, and a new number will not erase records linked to the old one. A credit freeze, an E-Verify lock and an IRS IP PIN usually protect you better.

Does a credit freeze hurt my credit score?

No. A freeze stops lenders from seeing your report for new applications, but it does not change your score. You can lift it for free when you apply for credit, and online or phone requests to lift it must be processed within one hour.

I am leaving the US. Do I still need to act?

Yes. Your number and credit file stay active after you leave, and a thief can still use them. Freeze your credit, keep an IP PIN if you file US taxes and keep an email address and phone number the bureaus and the IRS can reach.

How do I know if someone is using my SSN for work?

Review your earnings record through your my Social Security account and look for employers you never worked for. An IRS notice about income from an unknown employer is another sign. You can also lock your number through E-Verify so it is harder to use for a job.