Important: The National Public Data breach exposed personal information, including names, addresses, and social security numbers. Learn how to protect yourself and how Microsoft Defender is helping to prevent fraud. See: National Public Data breach: What you need to know.
If your Social Security number is exposed in a breach or leak, it's important that you act quickly to prevent identity thieves from doing more damage.
Tip: As you go through this process it's a good idea to keep documentation of any steps you take, calls you make, forms you fill out, or letters you send. If you have to dispute a fraudulent charge or activity, having these records can help smooth the way by establishing that you're dealing with an actual identity theft.
An identity thief who has your social security number and other personal information could do a number of things with it, including:
-
Open new credit accounts, like credit cards or car loans, in your name
-
Claim tax refunds that rightfully belong to you
-
Create a fake identity to get a job, apartment, or other services
-
Claim fraudulent unemployment benefits in your name
-
Get benefits like healthcare while pretending to be you
-
Create a fake identity to defraud other people or commit other crimes in your name
First step - Place a temporary fraud alert on your credit
Also known as an "Initial security alert" this tells the major credit bureaus that you're a victim of identity theft. If a business attempts to check your credit they're notified that a fraud alert has been placed on the account and that they should verify the identity of anybody attempting to open an account or get credit with your Social Security number.
It's free to place a temporary fraud alert on your account, it does not affect your credit score, and the temporary fraud alert will automatically expire in 1 year, though you can cancel it sooner if you want to.
You want to do this right away, to reduce the ability of thieves to open new accounts in your name.
To place a temporary fraud alert on your account
Go to the website of any of the three major credit bureaus and select that you want to add a fraud alert.
Note: You only need to do it at one credit bureau. Once you place the fraud alert at any of the three bureaus, they automatically notify the other two.
A temporary fraud alert doesn't require a reason or any documentation beyond confirming your identity.
Removing a fraud alert is a bit more involved than placing one. You'll have to contact all three of the bureaus and they will each need to verify your identity in order to lift the alert. In most cases it's probably easier just to let the alert expire after a year.
An extended fraud alert does the same thing a temporary fraud alert does, just for a longer period of time. It generally stays active for 7 years, unless you cancel it sooner.
An extended alert is also a little more difficult to get than a temporary one, it generally requires a police report showing that you're a victim of identity theft.
It doesn't prevent it the way a credit freeze does, but it does make it more difficult. Any business that has been approached to open an account in your name is supposed to take extra steps to verify the identity of the person opening the account. That means you can still open accounts, you'll just have to go through a couple of extra steps to prove that you are who you say you are.
It would be possible for a thief to open a fraudulent account too, but they'd have to put in more effort to impersonate you.
Second step - Get a copy of your credit report
Under U.S. Federal law you're entitled to a free copy of your credit report every 12 months from each of the three credit reporting companies. To request a free copy of your credit report, go to https://annualcreditreport.com. It generally takes just a minute or two to get the report which you can then save or print so you can review it carefully.
Tip: You can request up to 3 copies of your credit report, but we recommend requesting just 1 initially. Federal law says you can get 3 copies per year, and you will want to check your credit report one or two more times in the coming weeks or months to see if any new items have popped up.
When you're reviewing your credit report, you're primarily looking for any accounts or activity that are unfamiliar. Those could be credit cards that you don't recognize, or loans for cars or property that you never applied for.
Get monthly credit reports
With Defender's Identity theft monitoring feature, you can get an updated credit report monthly where you can identify the unknown credit activity. This feature helps monitor your credit reports and enables you to take an immediate action in case of a fraudulent activity.
If you find unrecognized accounts
Escalate that fraud alert to a credit freeze
If there's fraudulent activity on your credit report it means that criminals are trying to use your Social Security number so the time has come to go ahead and freeze your credit report. That will make it much harder for them to do any more damage.
For more information on placing a credit freeze see Placing a credit freeze.
Report it to Federal Trade Commission (FTC)
If you have fraudulent activity in your name, the FTC wants to know about it. Go to https://IdentityTheft.gov and follow the steps there to report the fraudulent activity.
Contact the companies with fraudulent accounts
Contact the companies for any accounts you don't recognize. Tell them you're a victim of identity theft and that you suspect the account is fraudulent. Ask when and how the account was opened and any information they can share on when and how the account has been used. That information will be helpful when you file a police report.
Tips:
-
It's always best to remember that the company you're contacting didn't realize the account was fraudulent and they're almost as interested in resolving this as you are. They're unlikely to get paid for the fraudulent account.
-
If they're having difficulty resolving the fraudulent account for you, ask if it would make things easier if you had a police report. If they agree that it would be, make a note to come back to them after step 3 (File a police report).
Contact Experian® restoration services available for Microsoft Defender customers
If you've set up identity theft monitoring in Microsoft Defender (for set up instructions, see Getting started with identity theft monitoring in Microsoft Defender), you can contact the Experian® restoration services through the telephone number found in app. Their restoration experts will advise you about the next steps to take and can guide you through the process of recovering your identity, closing any fraudulent accounts, and reporting fraudulent transactions.
Third step - File a police report
Even if you think the police are unlikely to make an arrest there's still a lot of value in filing a police report to establish an official record of your identity being stolen.
Contact your local police department and tell them that your identity has been stolen and that you'd like to file a report. They should provide you with a copy of the report when it's done, but if they don't offer you one, be sure to ask for it. It's an important tool to have as you take steps to resolve this and to protect you from any future fraudulent activity.
Fourth step - File a complaint with the Internet Crime Complaint Center
The Internet Crime Complaint Center (IC3) is a department of the Federal Bureau of Investigation (FBI) whose job is to handle reports of online crime like identity theft. When you file a complaint with them, they may share that information with other appropriate law enforcement agencies.
To file a complaint, go to https://www.ic3.gov.
Tip: It may sometimes feel futile to fill out so many reports, but if criminals open fraudulent accounts or do other things with your SSN that you have to deal with, it can be very helpful to be able to show that you've filed reports with all of the appropriate authorities.
Fifth step - Notify the Internal Revenue Service (IRS)
A common scam these days is for criminals to file a false tax return with your Social Security number and claim your tax refund for themselves. There are two things you can do to reduce the risk of that happening. The first is to file your taxes as early as possible and the second is to let the IRS know that your Social Security number was stolen.
You'll want to fill out and file Form 14039. It's a short form and probably won't take more than a minute or two to fill out. Start here: https://www.irs.gov/individuals/how-irs-id-theft-victim-assistance-works
This puts the IRS on alert to watch for any suspicious tax filings with your social security number and, if a fake tax return is filed in your name, makes it easier for you to dispute it and get it cleared up.
While you're on the IRS's website, get a PIN
The IRS offers a free, six-digit, identity protection PIN that you can get through their website. When you file your tax return you'll need to provide that PIN (which only you and the IRS should know) to verify your identity. That makes it a lot harder for somebody else to file a tax return in your name, since even if they have your Social Security number they shouldn't have your PIN.
To get the PIN just go to https://www.irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin. You'll need to go through a little process to verify your identity, then they'll issue you the PIN.
It's not a bad idea to do this proactively just to help limit the damage identity thieves could do later.
Going forward
Unfortunately, once your SSN is out there, criminals could use it at any time, so it pays to take some reasonable steps to protect yourself from future issues.
Get a credit monitoring service
To avoid any fraudulent credit transactions, set up a credit monitoring service such as Defender's Identity theft monitoring. This service helps monitor your credit reports and enables you to take an immediate action as soon as an unknown activity is identified.
Additionally, the subscribers of Defender's Identity theft monitoring can contact the Experian® restoration services in case of any fraudulent credit activity. This service is available only for the subscribers of this credit monitoring service.
For more information on how to set up this service, see Getting started with identity theft monitoring in Microsoft Defender
Filing taxes
Fraudsters will sometimes file fake tax returns with the name and Social Security number of an innocent person, then they claim the tax refund that is due to that person. When the real person later files their taxes they have a complicated process to go through to get the refund that is rightfully due to them.
To reduce the risk of this happening, try to file your tax return as early in the tax filing season as possible. If your legitimate return arrives at the IRS before any fraudulent returns do then it's the criminals who are frustrated, instead of you.
Keep an eye on your credit score
Unexpected changes in your credit score could indicate unauthorized activity using your Social Security number. Most banks and credit card companies these days offer you your credit score as an added perk of doing business with them. Sign into their website and take note of what your score is.
Small changes of a few points up or down are normal, but if it suddenly jumps or plunges unexpectedly you should get a fresh copy of your credit report to see why it changed.
Review your Social Security Statement
One thing criminals may do with a stolen Social Security number is take a job under a false name. This is often the case if the criminal would be prohibited from getting the job using their real identity, or if they're not legally allowed to work in the United States.
Tip: It's also possible that somebody could be working under your Social Security number as an honest mistake. They simple miswrote their Social Security number, or transposed a couple of numbers, and inadvertently gave their employer your number.
If they do take a job using your SSN their employer should be reporting their income to the Social Security Administration (SSA) and that income would appear on your Social Security Statement. Go to https://www.ssa.gov/myaccount/ and sign into (or create) your free account to check your Social Security Statement. Creating the account can be a bit of a process, but once you have the account it takes just moments to view your Social Security Statement online.
All the statement shows you is your total annual earnings in a given year, but if the earnings they show are substantially more than you know you earned that year that's probably reason enough to contact the SSA and investigate a bit further. They take identity theft seriously and are happy to work with you.
Check your Social Security Statement every year to make sure everything looks correct.
Tip: If the reported income looks too low that's something else you should investigate. The income reported by your employers is what factors into how much your Social Security payments will be when you retire so you want to make sure you're getting what you're owed.
Keep checking that credit report
Even if everything seems ok, it's a good idea to go to https://annualcreditreport.com every few months and request another copy of your credit report just to make sure everything still looks like it should.
Yes, you can but it's a fairly involved process and requires you to apply in person at a Social Security office and provide a valid reason for changing your Social Security number. Being a victim of identity theft is considered a valid reason, but only if you're having persistent and ongoing problems as a result of the theft and you will have to provide documentation to support your claim. You'll also be asked to provide documents proving your age and citizenship status (such as a birth certificate).
If you get a new number, the old number isn't deleted. The new number is connected to the old number and as a result this will often turn up on background checks, which may prompt additional questions.
If you're issued a new number, you'll want to be sure and update your employer to make sure they are correctly reporting your earnings under the new SSN.
