SSN Identity Theft: What to Do When Your Parent's Social Security Number Is Stolen

Your mom just told you she gave her Social Security number to someone who called claiming to be from Medicare. Or maybe you found a phishing email in her inbox that she responded to. Or a data breach notification arrived for a company she didn't even know had her information.

However it happened, one thing is certain: a stolen SSN in a senior's name is not a minor inconvenience. It is a financial emergency that requires immediate, systematic action.

Here is what to do — and what not to do — when your parent's Social Security number has been compromised.

Why a Stolen SSN Is Especially Dangerous for Seniors

A Social Security number is the master key to a person's financial life. With it, criminals can:

• Open new credit cards and loans in your parent's name
• File a fraudulent tax return to steal their refund
• Claim Social Security benefits early or redirect payments
• Create "synthetic identities" that combine your parent's SSN with a different name, building fraudulent credit profiles that can go undetected for years
• Access medical records and commit Medicare or Medicaid fraud

For older adults, the consequences are compounded. Seniors are less likely to monitor their credit regularly, which means fraudulent accounts can accumulate for months before anyone notices. And because they typically have stronger credit histories and higher balances in retirement accounts, the "return" for a thief is much higher than it would be from a younger victim.

The FTC estimates that older adults lost over $2.4 billion to fraud in 2024, with identity theft being one of the top categories. The real figure is likely several times higher, since most cases go unreported.

Step 1: Place a Credit Freeze at All Three Bureaus (Do This First)

This is the single most important action you can take, and it should happen within hours of discovering the compromise — not days.

A credit freeze prevents any new creditor from accessing your parent's credit report. That means even if a thief has the SSN, they cannot open a new credit card, get a car loan, or take out a mortgage in your parent's name. The freeze stays in place until you lift it, and lifting it is free and takes minutes.

You need to freeze credit at all three major bureaus separately:

• Equifax: equifax.com/personal/credit-report-services/credit-freeze
• Experian: experian.com/freeze/center.html
• TransUnion: transunion.com/credit-freeze

All three are free by federal law in the United States. You will need to create accounts at each bureau and toggle the freeze on. Write down the PINs or save them in a password manager — you will need them if you ever need to temporarily lift the freeze.

If your parent cannot manage this themselves, you may be able to do it on their behalf if you have financial Power of Attorney. Otherwise, you can sit with them and walk through the process together.

For Canadian families: TransUnion Canada allows online freezing at ocs.transunion.ca. Equifax Canada calls it a "credit lock" — log in to myEquifax to enable it.

For Australian families: Request a "credit ban" through Equifax Australia (equifax.com.au) and Experian Australia (experian.com.au). The initial ban lasts 21 days and can be extended to 12 months if needed.

Step 2: Pull a Free Credit Report and Audit It

Go to annualcreditreport.com and pull your parent's credit reports from all three bureaus. Look for:

• Accounts you do not recognize
• Hard inquiries from lenders your parent never contacted
• Addresses or employers listed that your parent has no connection to
• Any accounts showing as delinquent that your parent was unaware of

Make a list of everything suspicious. You will need it for the next steps.

If you find fraudulent accounts already opened, flag them immediately on the credit report through each bureau's dispute process. Under the Fair Credit Reporting Act, you have the right to dispute any inaccurate information, and the bureau must investigate within 30 days.

Step 3: Report to the FTC and Get a Recovery Plan

Go to identitytheft.gov. This is the FTC's official identity theft recovery portal. When you file a report here, you get:

• An official Identity Theft Report (which carries legal weight when disputing accounts)
• A personalized, step-by-step recovery plan based on the specific types of fraud that occurred
• Pre-filled letters you can send to creditors, debt collectors, and credit bureaus

This is not just a bureaucratic checkbox. The Identity Theft Report is what you will reference in every dispute letter you send. It signals to creditors and bureaus that this is a documented federal case, not just a vague complaint.

Step 4: Alert the Social Security Administration

Call the SSA at 1-800-772-1213 or visit ssa.gov/oig to report that your parent's number may have been compromised. The SSA can:

• Flag the account to watch for suspicious benefit claims
• Verify whether any fraudulent tax returns have been filed using the number
• In rare cases, issue a new Social Security number (though this is a complex, last-resort process)

Also contact the IRS Identity Protection Specialized Unit at 1-800-908-4490. If a fraudulent tax return is filed using your parent's SSN before they file their legitimate one, it will cause their return to be rejected and trigger a lengthy resolution process. The IRS can place an "Identity Protection PIN" (IP PIN) on your parent's account so that future returns require an additional 6-digit code that only your family has.

Step 5: Monitor for the Next 12 Months

After the immediate crisis is contained, the work shifts to ongoing vigilance. SSN fraud often unfolds slowly — a thief may sit on stolen information for months before using it.

Set up the following monitoring:

Bank transaction alerts: Log into your parent's bank accounts and configure alerts for any transaction over a threshold amount, any international transaction, and any account balance drop. Most banks have this under Profile > Alerts > Transaction Alerts.

Carefull or EverSafe: These apps connect to your parent's accounts in read-only mode and use pattern analysis to flag anomalies — sudden large transfers, new recurring payments, or unusual merchant categories. Carefull ($12.99/month) also includes identity theft insurance, which can be valuable in this situation.

Annual credit report review: Pull from annualcreditreport.com every four months, rotating through the three bureaus, so there is always a fresh check every 16 weeks or so.

Dark web monitoring: Services like Experian's free dark web scan or the monitoring features in identity theft protection services like Aura or LifeLock can alert you if your parent's SSN appears in known data breach databases or for-sale forums.

What Not to Do

Do not pay for "SSN removal" services. There is no legitimate service that can remove your parent's Social Security number from public records or the dark web once it has been exposed. Anyone claiming otherwise is running a recovery scam that preys specifically on identity theft victims.

Do not call back unknown numbers. If your parent received a call claiming to be from the Social Security Administration and provided their SSN, do not call the number back to "correct" the situation. Real government agencies do not call unsolicited and demand sensitive information. Calling back puts you in contact with the scammer again.

Do not use SSN for additional "verification." Scammers sometimes follow up after obtaining an SSN by calling again and asking for more information — date of birth, Medicare number, bank account — claiming they need it to "process your case." Hang up.

The Long View: Protecting the SSN Going Forward

Once you have dealt with the immediate crisis, take these longer-term steps to reduce your parent's exposure:

Remove the SSN from their wallet. Most seniors carry their Social Security card with them. It should be in a locked box at home, not in a wallet that can be lost or stolen.

Opt out of data broker sites. Services like Spokeo, WhitePages, and Intelius sell personal information including SSNs scraped from public records. You can request removal from each individually (time-consuming) or use a service like DeleteMe to automate opt-outs.

Set up the IRS IP PIN proactively. Even if there has been no confirmed tax fraud, your parent can request an Identity Protection PIN at irs.gov/identity-theft-central. This adds a mandatory verification step to any tax return filed using their SSN.

Dealing with SSN identity theft is exhausting. It involves multiple agencies, credit bureaus, and sometimes creditors who are slow to respond. If you are also navigating this while managing your parent's daily care, the documentation burden alone can feel overwhelming.

The Elder Scam Shield Guide includes a complete identity theft response checklist, credit freeze step-by-step instructions for all three bureaus, and dispute letter templates you can send directly to creditors and credit bureaus — so you are not starting from scratch when every hour counts. See what's included in Elder Scam Shield.