I Gave My SSN to a Scammer — What to Do Now

Maybe it was a “fraud department” that called about a charge you didn’t make and needed to “verify” you. Maybe it was a text about a package, a form dressed up as the IRS, or a job application that asked for your Social Security number before you’d even had an interview. You read the nine digits out loud, or typed them in, and a minute later your stomach dropped.

First, breathe. Handing over your SSN is a real problem, but it is not the same as handing over your bank account, and it is rarely the end of the story. A Social Security number is a key, not a withdrawal. What matters now is changing the locks it opens — your credit, your taxes, your benefits — before anyone gets to turn it. Almost all of that work is free, and you can do most of it in an afternoon.

What can someone actually do with your SSN?

With your Social Security number — usually paired with your name and date of birth — a scammer can try to open new credit cards or loans in your name, file a tax return to grab your refund, claim government benefits, or run up medical bills on your identity. What the number can’t do on its own is drain a bank account you already have. That distinction is the whole strategy: your existing money is mostly safe, so the job is to slam the door on anything new being opened in your name.

This is also why an SSN leak plays out slowly. A stolen card gets used in hours; a stolen SSN might sit for months before someone tries to open an account with it — sometimes years, which is exactly what makes a child’s number so valuable. We watched that long fuse burn in our look at ghost-student fraud, where strangers take out college aid in someone else’s name. The upside of the slow timeline: you almost always have time to lock things down before the number gets used.

The first hour

You don’t need to do everything tonight, but a few moves are worth making right away, in this order:

1. Don’t pay anyone to “fix” or “protect” your number. Every real step below is free. Anyone charging a fee to secure your SSN or recover your identity is running the next scam, not solving this one.
2. If you gave more than the SSN, handle that first. A card number, a bank login, or an account password can be used immediately — a Social Security number can wait an hour. If a live account is exposed, our general scam-recovery guide walks the money steps in the order that matters.
3. Write down exactly what you shared, with whom, and when. The website or the caller, the phone number, the amount if any, the time. You’ll repeat it to the FTC, maybe your bank, maybe the police — and you will not remember it clearly tomorrow.
4. Start your report at identitytheft.gov. The FTC’s site asks what happened and builds a recovery plan tailored to your situation, with the specific letters and steps you’ll need. It’s the closest thing to a free case manager you’ll find.

Freeze your credit at all three bureaus

This is the single most useful thing you can do, and hardly anyone does it. A credit freeze blocks new accounts from being opened in your name — which is precisely what a stolen SSN is good for. It’s free, it takes about ten minutes, and it has no effect on your credit score. You have to do it three separate times, once each at Equifax, Experian, and TransUnion, because a freeze at one bureau doesn’t carry to the other two.

A freeze isn’t the same as a fraud alert, and it’s worth knowing which you want. A credit freeze fully locks new credit until you lift it; a fraud alert just tells lenders to take extra steps to verify it’s really you, lasts a year, and only has to be placed at one bureau, which notifies the others. After you’ve actually lost control of your SSN, the freeze is the stronger move. Lifting it later — when you apply for a card, a loan, or an apartment — takes about a minute online, and you refreeze when you’re done.

While you’re in there, pull your credit reports free at annualcreditreport.com. You can get them weekly now, from all three bureaus. Scan for accounts you didn’t open; if you find one, dispute it through the same identitytheft.gov flow that built your plan — the letter generator is the part most people don’t know exists.

Stop someone from filing taxes as you: get an IRS IP PIN

One of the most common uses of a stolen SSN is a fake tax return. The scammer files early, claims your refund, and you find out only when your real return bounces for a “duplicate” filing — then spend months untangling it. The clean fix is an Identity Protection PIN: a six-digit number the IRS ties to your SSN, without which an electronically filed return in your name is rejected on the spot.

You no longer have to be a confirmed victim to get one — any taxpayer can request an IP PIN as a precaution. The fastest route is through your online account at IRS.gov, in the profile’s IP PIN section. A new PIN is issued each year, so you grab the current one each filing season. And if a fraudulent return was already filed under your number, submit IRS Form 14039, the Identity Theft Affidavit, to get the real one processed.

Report it to the FTC and the Social Security Administration

You’ve already opened the FTC report at identitytheft.gov — that’s the one that builds your recovery plan and feeds the Consumer Sentinel database that state attorneys general and the FBI use to spot patterns. Two more places matter when it’s specifically your SSN.

Report the misuse to the Social Security Administration’s Office of the Inspector General at oig.ssa.gov. Then sign in to your own my Social Security account and check your earnings record for wages you never earned — that’s how someone using your number for work shows up. You can also call SSA at 1-800-772-1213 and ask them to block electronic access to your record, which stops anyone, including you, from viewing or changing it online until you turn access back on.

Should you get a new Social Security number?

Almost certainly not. The SSA issues new numbers only in rare, well-documented cases of ongoing harm, and a new number doesn’t wipe the slate — your credit history, tax records, and everything else still trace back to the old one, and a fresh number with no history creates fresh headaches (try renting an apartment with a two-week credit file). Locking your credit and watching your accounts protects you far better than swapping the number ever could.

The call that comes next is the second scam

Give it a few days and something else usually arrives: an offer to help. Treat it as part of the same attack, because it almost always is.

Why practice beats a printout

Here’s the uncomfortable part. Most people who give up a Social Security number knew, in the abstract, that they shouldn’t. The “fraud department” just sounded real. The form matched a login they’d used a hundred times. The pressure was built well enough that the careful part of the brain never got a turn. Information wasn’t the gap — catching it in the moment was.

That reflex isn’t built by reading. Workplace security teams figured this out fifteen years ago: people get sharp at spotting phishing only after they’ve safely walked into one and felt the click. The same thing works at the kitchen table. A few realistic, gentle practice runs a month — a fake bank verification, an IRS text, a too-good job offer — wires in the pause that reading an article can’t.

The short version

You can’t reissue a Social Security number, so you make it useless to whoever took it. Freeze your credit at all three bureaus, get an IRS IP PIN, file at identitytheft.gov, check your Social Security earnings, and ignore anyone who calls to “help” for a fee. An afternoon of boring, free steps is most of the difference between a stolen number and a stolen year.

And if you’re reading this before it’s happened to you — that’s the best time to be here. Freezing your credit today has no downside, and it’s already done on the day you need it.