A Social Security number was designed to track earnings, not to prove identity. It ended up doing both, which is why a nine-digit number that you cannot rotate now unlocks credit in your name.

That constraint shapes the whole strategy. You cannot make your SSN secret again. You can reduce how often it circulates, and you can make it less valuable to whoever ends up with it.

Decide who actually needs it

Some requests are legitimate and non-negotiable — employers, banks and credit issuers, tax filings, Social Security and Medicare, state benefits agencies, and anyone reporting income to the IRS.

Many other requests are habit. Medical offices, gyms, schools, utilities and landlords often ask because a form has a box for it. When you are asked, four questions are reasonable:

  • Why do you need it?
  • How will it be stored and protected?
  • Can you use a different identifier?
  • What happens if I decline?

Often the answer is that a partial number, a driver's license, or a different account identifier will do. A private business can refuse to serve you for declining, but asking costs nothing and frequently works.

Rules for the online channel

  • Never send it in email, text, chat or a social media message. None of those are secure storage, and the copies persist.
  • Only enter it on a site you navigated to yourself, over HTTPS, when you initiated the transaction.
  • Never give it to an inbound caller. Agencies do not cold-call demanding Social Security numbers, and the Social Security Administration does not threaten to suspend your number.
  • Do not store it in notes apps, spreadsheets or photos. If you need it accessible, use the secure-note feature of a password manager.
  • Be careful with documents you upload. Tax forms, pay stubs and benefit letters carry the number even when the form you are filling in does not ask for it. Redact what is not required.

Make the number less useful

This is the part that actually limits damage, and all of it is free.

Freeze your credit at Equifax, Experian and TransUnion. A thief with your SSN mainly wants to open accounts. A freeze blocks the credit pull that a new account depends on.

Get an IRS Identity Protection PIN. With one, a return filed in your name without the PIN is rejected. It is available to any taxpayer who can verify their identity.

Create your my Social Security account at SSA.gov and review your earnings record for employers you do not recognize. Creating the account also prevents someone else from creating it using your details.

Consider blocking electronic access to your Social Security record, a control the SSA offers that prevents changes to your information through automated channels.

Reduce the paper trail

  • Keep your Social Security card in a locked place at home, not your wallet.
  • Shred documents showing the number rather than binning them.
  • Opt out of prescreened credit offers at OptOutPrescreen.com.
  • Ask your employer, school or medical provider how they store employee and patient numbers, and request a different identifier where one exists.

Data brokers rarely publish SSNs, but they do publish the surrounding details — addresses, relatives, dates of birth — that let someone answer identity-verification questions. Trimming that footprint helps; see how to remove personal information from the internet for the approach.

If your number is already exposed

Exposure through a breach is common and not, by itself, a catastrophe. What matters is whether anyone uses it.

  1. Freeze all three credit reports.
  2. Get an IP PIN from the IRS.
  3. Check your credit reports at AnnualCreditReport.com for accounts you did not open.
  4. Review your SSA earnings record.
  5. Watch for benefit statements, tax notices or medical bills that do not match your reality.

If you find actual misuse, report it at IdentityTheft.gov to get an official Identity Theft Report and a recovery plan. The Social Security Administration will assign a new number only in narrow, well-documented circumstances, and a new number creates its own problems — your credit history, employment record and existing accounts are all tied to the old one.

Related reading: how to know if your identity has been stolen and what to do after a data breach.

Sources and references

  1. Social Security Administration — Identity Theft and Your Social Security Number
  2. FTC Consumer Advice — What To Know About Identity Theft
  3. IRS — Get an Identity Protection PIN
  4. Social Security Administration — my Social Security account