MalwareZero

You gave out your Social Security number. Here's what actually matters now.

Updated August 6, 2026

The phone is still face-up on the kitchen counter where you set it down, and the call ended four minutes ago. Nine digits, gone. Here's what still works: freeze your credit at all three bureaus, then get an IRS Identity Protection PIN. Those two free steps close off most of what an exposed Social Security number can realistically be turned into. Everything else on the usual panic checklist matters less, and paid credit monitoring matters least of all.

First, the honest part about the risk

Your SSN is nine digits, it never changes, and it has been sitting in breached databases for years. That's not a reason to shrug, and it's also not a reason to lose a week of sleep. The number on its own is nearly useless to a criminal. The number bundled with your full name, date of birth and current address is what lets someone impersonate you, and you should assume that bundle is already out there for most American adults.

Most exposures produce nothing at all. Some produce a credit application four months later. A small number turn into a mess that takes a year to unwind. You can't pick which one you got. You can make the profitable version much harder to pull off, which is the entire point of the next two sections.

Step one: freeze your credit

Do this before anything else, tonight if you can. A freeze blocks new lenders from pulling your file, and a lender who can't pull a file won't approve a loan. It's free by law at Equifax, Experian and TransUnion, it has no effect on your score, and it doesn't expire. The step-by-step version with every URL and phone number is on the credit freeze walkthrough, and it's about fifteen minutes of work.

All three, not one. Lenders don't share a bureau, and thieves apply wherever approval is easiest.

Can't face three logins right now? Call any one bureau and place a fraud alert as a stopgap. It lasts a year, it's free, and that bureau has to notify the other two. It's a much weaker tool because it only asks lenders to verify you rather than blocking them. It also takes thirty seconds, so it's a reasonable thing to do at 11pm and finish properly on Saturday.

Step two: get an IRS Identity Protection PIN

Hardly anyone does this, and I'd argue it's the second most valuable thing on the list. An IP PIN is a six-digit number that stops anyone from e-filing a federal return using your SSN. Without the correct PIN, the return gets rejected. Refund fraud is the fastest way to convert a stolen number into actual money, and this shuts that door.

You request it at irs.gov/getanippin through your IRS online account, which verifies you through ID.me. The details that trip people up:

Worth holding onto: the Taxpayer Advocate Service states plainly that the IRS will never ask for your IP PIN, and that calls, emails or texts requesting it are scams. It belongs on your return and in your tax preparer's hands, nowhere else.

Step three: identitytheft.gov, but only if something happened

identitytheft.gov is run by the Federal Trade Commission and it's genuinely good, which I don't say about many government sites. You answer questions about what occurred and it builds you a personalized recovery plan with prefilled dispute letters. It also produces an FTC Identity Theft Report, and that report is the document that gets you the seven-year extended fraud alert and forces creditors to block fraudulent accounts. The phone line is 1-877-438-4338.

If nothing has actually happened yet, you don't need to file anything. Reporting a disclosure with no fraud attached to it doesn't buy you much beyond a record. Bookmark the site and use it the day something real shows up.

Already had a fraudulent tax return filed under your number? The specific form is IRS Form 14039, the Identity Theft Affidavit. Filing it invalidates the fraudulent return and gets your genuine one processed.

What credit monitoring does and doesn't do

It tells you afterward. That's the whole product. Monitoring watches for new accounts or hard inquiries and emails you once one appears, which is useful for cleanup speed and worth nothing for prevention. Freezes prevent. Monitoring narrates.

Free monitoring bundled with a breach notice is fine to accept since it costs you nothing but an email address. Paying twenty-odd dollars a month for it while three freezes are already in place is, in my opinion, buying a smoke alarm for a house you made out of brick. The "up to $1 million in identity theft insurance" line is reimbursement for expenses most people never incur, not a payout you'll ever see.

Cheaper and better: pull your own reports at annualcreditreport.com, the only federally authorized site, and read them for accounts you don't recognize. A few times a year is plenty.

The Social Security Administration part

SSA doesn't fix credit problems, and it won't issue you a new number because your old one leaked. New numbers get assigned in narrow circumstances, generally ongoing harm such as domestic violence or repeated documented misuse. Even then the new number stays linked to the old one in the records, so what you get isn't a clean slate. Don't build your plan around it.

Do this instead: create your account at ssa.gov/myaccount if you don't already have one, so that nobody else creates it first and redirects your benefits. While you're logged in, read your earnings record for employers you've never worked for. That's one of the few places SSN-for-employment fraud actually surfaces.

One permanent rule, no exceptions: your Social Security number cannot be suspended. There is no such process and never has been. Any call, voicemail or text claiming your number has been suspended over suspicious activity is a scam, one hundred percent of the time.

Where this usually started

A lot of people land on this page after typing personal details into a form they reached through a QR code, often the little card tucked inside a package they never ordered. If that's you, read what the card in the package is really doing and then the cleanup sequence in I scanned a scam QR code, because those forms usually harvest more than the SSN alone.

Expect a second attempt. People who've just been scammed get contacted again, sometimes by someone claiming to be your bank's fraud department calling about the very thing you just reported, sometimes by a voice that sounds like your daughter. Cloning a voice from a few seconds of audio is cheap now, which is why how voice cloning scams actually work is worth ten minutes. Nobody legitimate will ever ring you and ask you to confirm your Social Security number.

What I'd actually do tonight

Freeze all three bureaus. Set up the IRS online account and request the IP PIN if the tool is open this month. Pull one credit report and read the account list carefully. Then stop, because the next useful data point is weeks away and refreshing your credit report every morning will only make you feel worse.

Write down what you did and the date. If something surfaces in eight months, that note is the difference between a bad week and a single phone call. Now the limit of all of it: a freeze and an IP PIN block new credit and a fraudulent federal return, and that is the entire scope of what they block. Your number stays in the breached databases it's been sitting in for years. Nothing on this page removes it. Nothing here protects the accounts you already hold either, since those are a password problem, not a bureau problem. And I can't give you odds for your specific exposure. Anyone quoting a precise percentage is guessing.