If your Social Security number was exposed in a data breach, it means the number reached people who should not have it. It does not mean anyone has used it yet. Federal law lets a consumer freeze their credit file for free, place a fraud alert, and, with an identity theft report, ask a consumer reporting agency to block information that results from identity theft.
This page sets out what exposure means, how misuse can show up, and the specific protections federal consumer-reporting law gives a person whose number has been exposed.
What It Means When a Social Security Number Is Exposed
A data breach is an event in which personal information held by a company or agency is accessed, taken or released without permission. SSN exposure means a person's Social Security number was part of that information. It is a disclosure, not yet a crime against that person.
Exposure and misuse are separate events. Misuse is what an identity thief does with the number afterward: opening credit accounts, filing a tax return, taking a job or applying for benefits in someone else's name. Misuse does not always follow exposure.
A breach notice tells a person what was exposed. It does not tell them whether anything has been misused, and the records described below can show whether it has.
How to Find Out Whether Your SSN Was Exposed
Breach notices are the most direct source. The notice from the company involved is where a person learns what was exposed. State law may add its own rules about breach notices and differs from state to state.
Credit reports are the next source. Federal law provides for a free credit report from each nationwide consumer reporting agency, Equifax, Experian and TransUnion, once during any 12-month period on request through the centralized source, which federal law identifies as AnnualCreditReport.com. The FTC notes on its credit freezes and fraud alerts page that "accounts in your name that you don't recognize could be a sign of identity theft."
Other signs can show up outside a credit report, including:
- an unfamiliar account, inquiry or address on a credit report
- a rejected tax return, or an IRS letter or notice about suspected identity theft on a return
- a Social Security account that shows wages the person did not earn or expect, or a Form W-2 or Form 1099 from an employer the person did not work for
- a collection letter for a debt the person does not recognize
No single check confirms or rules out exposure. A clean credit report shows only that no misuse has been reported there yet. When a report does show something unfamiliar, the situation shifts from exposure to an account that isn't yours, and different rules come into play.
Credit Freezes, Fraud Alerts, and What Federal Law Makes Available
A consumer reporting agency is a company that gathers information about people's credit and other history and sells it, in the form of consumer reports, to lenders and others. The three nationwide agencies carry most of the duties discussed here.
Security freeze. Federal law defines a security freeze as "a restriction that prohibits a consumer reporting agency from disclosing the contents of a consumer report that is subject to such security freeze to any person requesting the consumer report." Under 15 U.S.C. § 1681c-1(i), when a consumer directly asks a nationwide agency for a freeze and gives proper identification, the agency must place it "free of charge." It has 1 business day if the request comes by toll-free telephone or secure electronic means, and 3 business days if it comes by mail. Within 5 business days of placing the freeze, the agency must send confirmation and explain how to remove it.
A freeze stays until the consumer directly asks for it to be removed. The agency removes a freeze only on that request or if it was placed because of a material misrepresentation of fact by the consumer, and in the second case it must notify the consumer in writing before removing it. A consumer may also ask for a temporary removal for a set period. Removal is free: within 1 hour of a request by toll-free telephone or secure electronic means, or 3 business days by mail. The CFPB's credit freeze page adds that freezes "do not impact your credit scores in any way whatsoever." A freeze must be requested from each nationwide agency separately.
A freeze does not stop every use of a report. The statute lists exceptions, including existing creditors reviewing or collecting an account, certain government agencies acting under a court order, warrant or subpoena, child support agencies, credit monitoring services the consumer subscribed to, insurance underwriting, and "employment, tenant, or background screening purposes."
Fraud alerts. A fraud alert is a notice placed in a credit file telling anyone who pulls the report that the consumer may be a victim of fraud. The FCRA provides three kinds:
- Initial alert: for a consumer who asserts in good faith a suspicion of fraud or identity theft. It lasts not less than 1 year, and the agency must refer it to the other nationwide agencies.
- Extended alert: for a consumer who submits an identity theft report. It lasts 7 years and removes the consumer from lists used for unsolicited credit and insurance offers for 5 years.
- Active duty alert: for active duty military consumers. It lasts not less than 12 months and brings a 2-year removal from those lists.
The alerts work by limiting what lenders may do. With an initial or active duty alert in the file, a prospective user of the report generally may not establish a new credit plan or extension of credit, other than under an open-end credit plan, issue an additional card on an existing account requested by a consumer, or grant a credit limit increase requested by a consumer, unless it "utilizes reasonable policies and procedures to form a reasonable belief that the user knows the identity of the person making the request." If the consumer gave a phone number for verification, the lender must call that number or take reasonable steps to verify identity. With an extended alert, the lender must contact the consumer in person or through the contact method the consumer chose.
How the two differ. A freeze restricts a consumer reporting agency from disclosing the contents of the report to a person requesting it, subject to the exceptions above. An alert leaves the report visible but requires extra identity checks. The FTC notes that a consumer may use both at once.
A consumer reporting agency that is not one of the nationwide agencies is separate from them. When a consumer contacts such an agency to communicate a suspicion of fraud or identity theft, 15 U.S.C. § 1681c-1(g) requires it to tell the consumer how to contact the CFPB and the nationwide agencies to request alerts.
Tax Identity Theft and the IRS Identity Protection PIN
Tax identity theft happens when someone uses another person's Social Security number to file a fraudulent tax return and claim a refund. Among the warning signs the IRS lists are a rejected tax return and an IRS letter or notice about suspected identity theft on a return.
The IRS runs an Identity Protection PIN program, often called the IP PIN. The IRS describes an IP PIN as a six-digit number that prevents someone else from filing a tax return using the taxpayer's Social Security number; it is known only to the taxpayer and the IRS and helps the IRS verify identity when the taxpayer files. Who may enroll, how a person proves their identity, and how the PIN is used are set out on the IRS's official IP PIN page, which governs the program's details.
The IRS lists a Social Security account that shows wages the person did not earn or expect among its warning signs of identity theft, which the next section covers.
Tax problems fall outside this site's focus, so this page does not go into how tax notices are answered or resolved.
Employment Identity Theft and Benefits Fraud
The IRS says identity thieves can use a person's information to apply for a job, which can affect the person's taxes, Social Security benefits and work history. For a Form W-2 or Form 1099 from an employer the person did not work for, the IRS directs the person to contact the Social Security Administration.
The IRS also lists a Form 1099-G for unemployment benefits the person did not get or apply for among its warning signs of identity theft.
What the FTC's IdentityTheft.gov Provides
IdentityTheft.gov is the Federal Trade Commission's official website for identity theft. Federal law names it directly: 15 U.S.C. § 1681c-1(i)(6)(B) requires the FTC to establish, on "www.Identitytheft.gov, or a successor website," a single page linking to each nationwide agency's page for requesting freezes and alerts.
That statute also requires each nationwide consumer reporting agency to keep a webpage that allows a consumer to request a security freeze, an initial fraud alert, an extended fraud alert and an active duty alert, and to opt out of prescreened credit and insurance offers. The webpage may not be the only way to request a freeze.
Federal law defines an identity theft report, at a minimum, as a report that alleges an identity theft, is a copy of an official, valid report filed by a consumer with an appropriate Federal, State, or local law enforcement agency (including the United States Postal Inspection Service) or another government agency the Consumer Financial Protection Bureau deems appropriate, and subjects the person filing it to criminal penalties relating to the filing of false information. According to the FTC's guidance, an extended fraud alert is available to "people who have experienced identity theft and have completed an FTC identity theft report at IdentityTheft.gov or filed a police report." Renewing an extended alert, the FTC says, requires resubmitting that report.
The FTC is a federal agency, not anyone's representative. Filing a report through IdentityTheft.gov creates a record that the credit-reporting rules rely on, but it is not a lawsuit, and it does not by itself settle any dispute with a creditor, collector or bureau. The broader framework for identity theft under consumer law covers how that record is used.
When an Exposed SSN Leads to Fraudulent Accounts: What the Law Requires of Consumer Reporting Agencies
A person who finds a fraudulent account on a credit report has moved past exposure into a credit reporting problem, and different FCRA rules apply.
A furnisher is a company that sends information about a consumer to a consumer reporting agency, such as a lender reporting a balance or a collection company reporting an account.
Identity theft blocks. The FCRA section titled "Block of information resulting from identity theft," 15 U.S.C. § 1681c-2, requires a consumer reporting agency to block the reporting of information in a consumer's file that the consumer identifies as resulting from an alleged identity theft, not later than 4 business days after it receives proof of the consumer's identity, a copy of an identity theft report, the consumer's identification of the information, and a statement by the consumer that the information is not information relating to any transaction by the consumer. The agency may decline to block, or rescind a block, if it reasonably determines that the information was blocked or the block was requested in error, that the block rested on a material misrepresentation of fact by the consumer, or that the consumer obtained goods, services or money as a result of the blocked transaction. The section also sets separate rules for certain resellers and for check services companies.
Disputes and reinvestigation. Separately, a consumer may dispute inaccurate information in a consumer report. The agency must then conduct a reasonable reinvestigation, meaning a fresh look at whether the information is accurate, and furnishers have their own duties to investigate when they are notified of a dispute. How that process runs is covered in detail on the page on credit reporting disputes.
A related problem is a mixed credit file, where another person's accounts land in a consumer's file without any theft at all. If a debt collector contacts a person about a fraudulent account, the Fair Debt Collection Practices Act may apply to that collector under its own definition of the term and its own rules, which are separate from the FCRA's.
Whether a particular agency's or furnisher's handling of a dispute may violate the FCRA depends on what was disputed, what the company received and what it did with it. The remedies Congress set for each statute are covered on the page on consumer rights remedies.
Keeping Records and Understanding the Timeline
Fraud alerts have set lengths: an initial alert lasts not less than 1 year, and an extended alert lasts 7 years.
Records that may be relevant include:
- the breach notification letter and its envelope
- credit reports from each nationwide agency, which show when an account was opened
- letters to and from consumer reporting agencies, creditors and furnishers, with dates
- confirmations of freezes and fraud alerts
- any identity theft report or police report
- IRS and Social Security Administration notices
Where a debt collector is involved, the CFPB's page on debt collector harassment says it is important to keep a record of "any letters, documents, or communications" a collector sends and to "write down dates and times of conversations."
If You'd Like a Consumer Rights Case Review
This page covers Social Security number exposure and the federal credit-reporting protections it can bring into play. It does not cover every form of identity theft or any state's breach notification law.
If fraudulent information tied to your number has reached your credit reports, you can request a consumer rights case review through Federal Consumer Rights.
