Hackers Know Your Social Security Number: Here’s How to Stay Safe

For anyone trying to protect their personal information, recent headlines have been a grim kick in the butt. The worst came last month, when the National Public Data breach was revealed—the source of an alleged leak of 2.9 billion records onto the dark web. But that wasn’t the only significant data leak. In early September, Medicare contacted nearly 1 million beneficiaries about losing personal information linked to a third-party software vulnerability.

In other words, your Social Security number — crucial for filing taxes, applying for and maintaining credit, and receiving some U.S. government benefits — is very likely available for hackers and would-be criminals to exploit. And if it isn’t already, the unfortunate reality is that another data breach will inevitably change that.

But you don’t have to wait for trouble to find you. There are steps you can take to minimize the risk of identity theft or fraud in your name, since other details, such as your full name, date of birth, and place of residence, are also likely to be released. Here’s what to do.

Further reading: Data breaches happen everywhere, but you still need to pay attention to them

1. Check what details were leaked

This step isn’t absolutely necessary, as you can take precautions whether or not you’ve been caught in a major data breach. However, confirming whether your information has been leaked can be helpful—perhaps in convincing yourself or your loved ones to take action.

In general, you shouldn’t give your personal information to websites that claim to check if you’ve been caught in a data breach, especially if you don’t know who’s running it. But a few have been reviewed, and a few of them are specifically dedicated to domestic data breaches — and don’t require sensitive information for verification.

For more details on these two NPD sites, my former colleague Michael Kan digs into who runs them (one a cybersecurity firm, the other a data scraping company). The NPD Breach Check site returns multiple entries based on the full name, state, and year of birth you enter, while the National Public Data Breach Check & Search site returns more specific results based on full name + ZIP code, Social Security number, or phone number.

If you still don’t trust these sites or want broader, longer-term monitoring, you can also get alerts through Google’s Dark Web Report service and some paid antivirus software subscriptions. Have I Been Pwned is also a great source for data breach notifications, although your email address must be part of the lost data for it to work.

2. Freeze your credit reports

Freezing your credit costs nothing and prevents scammers from opening credit cards and taking out loans in your name — a smart move when your full name, date of birth, and Social Security number are floating around the internet.

You must run a security freeze on each credit bureau. In the U.S., the three main ones are Equifax, Experian, and TransUnion. For accuracy, you can also freeze your report on Innovis, a smaller fourth credit bureau.

Once frozen, your credit reports will become accessible only to you. If you need to allow a third-party credit check, such as when renting a new home or opening a new line of credit, you can temporarily lift the freeze through Equifax, Experian, and TransUnion websites or through their phone lines. You will need the PIN issued to you to request a temporary lift.

3. Check your credit reports

When reviewing your credit reports, you should also check them for any fraudulent activity. You can do this weekly through the official website (AnnualCreditReport.com) or request paper copies once a year by phone or mail.

If you find inaccurate details, you can dispute them. If you think you see signs of identity theft, you can report it and begin corrective action.

4. Request an IRS Identity Protection PIN

Tax fraud can be a serious problem. Fortunately, the Internal Revenue Service (IRS) has a way to prevent someone else from fraudulently filing tax returns on your behalf (even if you don’t have to file a return). If you request an Identity Protection PIN (IP PIN), each return you file must include the six-digit PIN in order to be processed.

Most taxpayers will need to request a new PIN each year—unless you’ve been a victim of tax-related identity theft. If so, you should already automatically receive a new IP PIN each year from the IRS.

If you forget your IRS Identity Protection PIN, the IRS has methods to help you recover it. You can also store your information in a good password manager — if you’re wary of cloud services, you can use one that saves your data to a local hard drive or flash drive.

5. Freeze your bank report

Similar to credit, you have access to your bank account activity data. If someone starts opening fake accounts in your name and bankrupts them, banks may not want to do business with you in the future.

You can prevent being blacklisted by also placing a security lock on ChexSystems, the primary company banks use to verify that you’re a trustworthy customer. Once you’ve placed a lock, only you will have access to your report. To temporarily lift the lock (such as when applying for a new bank account), you can apply online using the PIN issued to you when the lock first went into effect.