I Gave a Scammer My Social Security Number: What to Do Now

Maybe a caller said your Social Security number was “suspended,” or a “recruiter” needed it before an interview. You can’t take the number back, but you can make it harder to misuse. Here’s what to do today, in order, using free official tools.

1. Stop talking to the scammer

Hang up and stop replying. Don’t send money or any more personal or financial information, and don’t click their links or open their attachments. These are the first steps in the IRS identity theft guide. If you already clicked something, the IRS says to run antivirus software.

Shared more, like a bank account, a password or your driver’s license? IdentityTheft.gov has steps for each type of information. If you sent money, the FTC says to tell the bank, app or company you used right away and ask it to reverse the payment (see paid a scammer through Zelle).

2. Freeze your credit at all three bureaus

While a credit freeze is in place, nobody can open a new credit account in your name, including you, according to the FTC. It’s free, it doesn’t affect your credit score, and it lasts until you lift it.

You have to contact each bureau yourself:

• Equifax security freeze
• Experian security freeze
• TransUnion credit freeze

Freezes became free nationwide under a federal law that took effect on September 21, 2018. The same law says that when you ask by phone or online, a bureau must lift your freeze within one hour (FTC). So you can still apply for credit, a job, an apartment or insurance: lift the freeze at the bureau being used, then put it back.

Walkthrough: how to freeze (and unfreeze) your credit. To keep track of all three, use the credit freeze tracker.

Freeze, fraud alert, or both?

The FTC says you can add a fraud alert even if you already have a freeze. Here’s how they compare:

	Credit freeze	Initial fraud alert	Extended fraud alert
What it does	Blocks new credit in your name until you lift it	Tells businesses to verify it’s you before opening new credit; they can still see your report	Same as an initial alert, plus the bureaus take you off their marketing lists for unsolicited credit and insurance offers for five years
Who can get it	Anyone	Anyone who is, or suspects they may be, affected by identity theft	Identity theft victims with an FTC Identity Theft Report or a police report
How long it lasts	Until you lift it	One year; you can renew it	Seven years
How to get it	Contact all three bureaus	Contact one bureau; it must tell the other two	Contact one bureau; it must tell the other two
Cost	Free	Free	Free

3. Check whether your number has been used

What comes next depends on one question: has anyone already used your number, for example to open an account, get a loan, file taxes or get a job?

• Yes, it was used. Report it at IdentityTheft.gov. You’ll get an FTC Identity Theft Report and a personal recovery plan. If you create an account, the site walks you through each step, tracks your progress and pre-fills letters for you. You can also call 1-877-438-4338 (SSA).
• No, or you’re not sure. The FTC says to follow the protective steps at IdentityTheft.gov/Databreach. Social Security’s fraud page says that if your number was shared but not misused, you don’t need to file an FTC Identity Theft Report.

Signs of misuse include accounts you didn’t open, a tax return the IRS rejects, a W-2 from an employer you never worked for, and wages you didn’t earn in your Social Security record (IRS). If someone opened a card or loan, see someone opened a credit card in my name.

4. Get an IRS Identity Protection PIN

An Identity Protection PIN (IP PIN) is a six-digit number that prevents someone else from filing a tax return with your Social Security number, according to the IRS. Anyone with a Social Security number or ITIN who can verify their identity can get one. You don’t have to be a confirmed victim.

• Fastest: request it in your IRS online account, in the IP PIN section of your profile. If you don’t have an account, you’ll register and verify your identity first.
• If you can’t verify online: the IRS offers a paper application (Form 15227) if your income is below its limit, or an in-person appointment at a Taxpayer Assistance Center. Both take longer.

You get a new IP PIN every year and must use it on every federal return you file that year. A missing or wrong one gets an e-filed return rejected. The IRS will never ask for your IP PIN; calls, emails or texts asking for it are scams.

If an IRS letter or a rejected return suggests someone filed in your name, follow the IRS identity theft guide. The IRS says most people don’t need to file Form 14039, its identity theft affidavit, and that you shouldn’t file it if you already did so through IdentityTheft.gov.

5. Secure your Social Security record

Social Security gives you two ways to protect your record.

Create your my Social Security account. Sign up at ssa.gov/myaccount through Login.gov or ID.me. SSA says opening your account takes away the risk of someone else creating one in your name, even if they have your number (SSA Publication 05-10220). Then review your earnings history: wages you never earned may mean someone is working under your number (IdentityTheft.gov). SSA’s scam page adds that you’ll get an alert if anyone tries to change your address or direct deposit without your permission.

Or block electronic access. Call 1-800-772-1213 (TTY 1-800-325-0778) and ask for the block. After that, no one, including you, can see or change your information online or through SSA’s automated phone service (SSA). To remove it later, you’ll need to prove your identity; SSA’s fraud page says to contact your local office.

If you get benefits, SSA also offers a Direct Deposit Fraud Prevention block. It stops anyone, including you, from signing up for direct deposit or changing your address or direct deposit information through my Social Security or a financial institution (SSA).

6. Lock your number in E-Verify

E-Verify is the online system that lets employers confirm you’re eligible to work in the U.S. Its free service for workers, myE-Verify, includes Self Lock. If an employer enters your locked number in E-Verify, it gets a mismatch (a “Tentative Nonconfirmation”) and must get more information from the person using it (IdentityTheft.gov).

• You need a myE-Verify account, which runs on a USCIS online account. To finish sign-up, you pass an identity quiz based on Experian information, which requires a U.S. credit history (E-Verify).
• To lock your number, you choose and answer three challenge questions.
• The lock stays on while your account is valid. Before you start a job with an E-Verify employer, log in and unlock it.

Two limits. Self Lock only helps with employers that use E-Verify. And E-Verify’s FAQ says a security freeze or certain fraud alerts can keep its identity quiz from being generated. If you get stuck, the myE-Verify page lists the E-Verify contact center: 1-855-804-0296.

7. Check your credit reports every week

The three bureaus have permanently extended free weekly credit reports at AnnualCreditReport.com, the FTC confirms. Checking your own reports there doesn’t affect your credit scores. If you see an account or debt you don’t recognize, contact the company and report the misuse at IdentityTheft.gov.

Type that address yourself. The FTC warns that imposter sites copy the name, and that AnnualCreditReport.com and the bureaus won’t email you asking for your Social Security number.

Optional: freeze specialty reports too

Some specialty reporting companies also freeze reports on request, according to the Consumer Financial Protection Bureau (CFPB):

• ChexSystems, used for checking account applications, openings and closures (CFPB listing).
• NCTUE, which covers phone, pay-TV and utility accounts. Its freeze is free; use its consumer page or call 1-866-349-5355.
• Innovis, which provides credit and identity verification data (CFPB listing).

What happens next

If nothing suspicious shows up, keep your freezes in place, keep checking your reports, and use your IP PIN each tax season.

If your number is misused, your FTC Identity Theft Report helps prove to businesses that someone stole your identity. IdentityTheft.gov explains that it lets you:

• place a seven-year extended fraud alert;
• have the credit bureaus block fraudulent information from your report;
• stop creditors and debt collectors from reporting fraudulent accounts after you give them the report;
• get copies of applications and other records linked to the theft.

IdentityTheft.gov also says that under most state laws, you’re not responsible for debts on new accounts opened in your name without your permission.

A new Social Security number is rarely the fix. SSA won’t issue one if your number was lost or stolen and there’s no evidence someone is using it. It may assign a new number if you’ve done all you can to fix the problems and someone is still using your number, and you’ll need proof (SSA). Even then, SSA warns that a new number won’t guarantee a fresh start. Agencies and businesses keep records under your old number, and having no credit history under the new one may make it harder to get credit (SSA Publication 05-10064).

How to report it

• The scam itself: ReportFraud.ftc.gov. The FTC can’t resolve individual reports, but it shares them with law enforcement.
• Misuse of your number: IdentityTheft.gov or 1-877-438-4338.
• Someone posing as Social Security or its Inspector General: SSA’s Office of the Inspector General at oig.ssa.gov/report.
• A scam that started online, such as a fake job post: the FBI’s Internet Crime Complaint Center. SSA lists it as a place to file a complaint (SSA Publication 05-10064).
• Local police: SSA suggests filing a police report (SSA FAQ). A police report can also qualify you for an extended fraud alert.

Watch for the follow-up scam

The FTC warns that people who’ve been scammed may be targeted again. Watch for these lines:

• “Your Social Security number has been suspended.” The real SSA won’t threaten you or suspend your number, and won’t call, email, text or message you on social media asking you to pay (FTC).
• “Move your money to keep it safe.” The FTC will never tell you to transfer money to “protect it,” withdraw cash or buy gold (IdentityTheft.gov). SSA lists the same trick on its scam page.
• “I’ll transfer your call to Social Security.” On July 29, 2026, SSA warned that companies and other agencies can’t transfer your call directly to SSA or its Inspector General. If they claim they can, it’s a scam (SSA).
• “We can get your money back for a fee.” Government agencies and legitimate organizations never ask for money to help you get a refund (FTC).
• Anyone asking for your number again. The IRS, your bank and your employer won’t call, email or text to ask for your Social Security number (FTC).

If you need to reach an agency or company, find its number on a website you know is real. Don’t use a number from caller ID or from the message itself (IdentityTheft.gov).

What varies

• Whether your number was used. That decides if you need an FTC Identity Theft Report now or only protective steps.
• Tax timing. The IRS says you can generally view your IP PIN online from mid-January through mid-November. The mail and in-person routes take weeks.
• Your Social Security choice. The electronic-access block shuts you out of online services too, so it doesn’t mix with using a my Social Security account.
• Your state. Responsibility for debts on fraudulent accounts depends on state law, as IdentityTheft.gov notes.