Your Kid Has a Social Security Number They've Never Used — Here's Why That's a Risk (and How to Freeze Their Credit for Free)

Somewhere in a filing cabinet, a shoebox, or a scanned PDF in your cloud storage is a nine-digit number that belongs to your child. They have never used it. They probably don’t know it. They may not touch it in any meaningful way until they fill out a college form or a first job’s tax paperwork at seventeen. And that long silence — a decade or more of a number existing without anyone watching it — is precisely what makes a child’s Social Security number one of the most quietly valuable things a criminal can get hold of.

This is one of those money conversations parents skip, not because it’s awkward but because it never occurs to us. We talk about saving. We talk about screen time and in-app purchases. We rarely talk about the fact that our kids have a financial identity years before they have a bank account, and that it is sitting there completely unguarded unless we do something about it. The good news is that the single most effective protection takes about an hour, costs nothing, and is guaranteed to you by federal law in every state.

A Number That Sits Unused for a Decade

An adult notices identity theft because there’s something to notice. A statement looks wrong. A score drops. A card gets declined. Children have none of that scaffolding. There is no credit file to compare against, no monthly statement, no baseline. Misuse can run for ten or twelve years in total silence.

Why the Silence Is the Whole Problem

When a child’s SSN is misused, the discovery usually comes at the worst possible moment — a teenager applies for a first credit card, a car loan, an apartment lease, or a student loan, and gets denied for reasons that make no sense. By then the fraudulent history may be years deep, spread across multiple accounts, and genuinely difficult to unwind.

Here’s the useful mental model: a minor should have no credit file at all. A blank result from a bureau is the healthy outcome. Any file that exists for a child who has never applied for credit is itself the red flag — not proof of fraud in every case, but always worth investigating.

What the Research Actually Shows

The most-cited prevalence work comes from Javelin Strategy & Research. Their 2021 Child Identity Fraud Study, “A Web of Deception and Loss,” found that:

• Child identity fraud costs US families close to $1 billion per year
• Roughly 1 in 50 children is affected annually
• More than 1.25 million children were victimized in the study’s prior year
• The average affected family loses over $1,100

Javelin’s 2022 study put the figure at 915,000 US children defrauded in the prior year (about 1 in 80), with an average loss of $1,128 per victim. Separately, it found 1.7 million children exposed by data breaches between July 2021 and July 2022 — about 1 in 43. Javelin’s December 2024 Child & Family Cybersecurity Study added social media as a growing exposure vector and noted that risk correlates with household socioeconomic status. A secondary figure circulating from that work — that roughly 4 million US households had a child experience identity theft over a six-year window, and that 95% had no identity-theft protection in place — is worth knowing, though it’s worth treating as directional rather than precise.

Reading the Government Data Honestly

You will also see the FTC Consumer Sentinel Network Data Book 2024 cited in articles about child identity theft. It recorded 21,420 identity-theft reports in 2024 from people age 19 and under, out of 1,135,291 reports across all ages. The breakdown:

• Employment or tax-related fraud: 11,569
• Other identity theft: 2,969
• Government documents or benefits fraud: 2,771
• Credit card fraud: 2,447
• Bank account fraud: 1,830
• Loan or lease fraud: 1,062
• Phone or utilities fraud: 735

One important caveat, because it gets flattened constantly: these are complaint reports, not a prevalence study. They count people who knew something was wrong and chose to file. They also cover “age 19 and under,” which includes legal adults. Use the FTC data for its texture — notice how heavily employment and tax fraud dominate, which tells you a lot about how stolen child SSNs get used — and use Javelin’s survey work for the question of how common this actually is. Conflating the two produces numbers that sound authoritative and aren’t.

How It Actually Happens

Understanding the mechanics makes the protective steps feel less like paranoia and more like basic household maintenance.

Familiar Fraud: The Part Nobody Wants to Discuss

Child identity theft skews far more toward family-member fraud than adult identity theft does. The reason is unglamorous: relatives have easy, low-friction access to a child’s SSN, birth certificate, and mailing address. Sometimes it’s predatory. More often it’s a parent, step-parent, grandparent, or adult sibling in genuine financial distress who opens a utility account or a credit line “temporarily” and never unwinds it.

This is uncomfortable, and it is also why a credit freeze is such a clean solution. A freeze doesn’t accuse anyone. It simply removes the opportunity, quietly and permanently, for everyone.

Synthetic Identity Fraud and Fabricated “Credit Privacy Numbers”

The more sophisticated version is synthetic identity fraud: a criminal pairs a real, unused SSN with a fabricated name and date of birth, then patiently builds a legitimate-looking credit history over years. Because the SSN belongs to a child with no file, nothing collides and nothing triggers an alert. Experian, via secondary reporting, has warned that scammers marketing “Credit Privacy Numbers” or “CPNs” as a legal way to start fresh are frequently selling stolen children’s Social Security numbers. Buying one is fraud; the child whose number it is becomes collateral damage.

The School-Data Problem, and Why 2026 Feels Different

The freshest reason this topic is urgent is the PowerSchool breach — an intrusion in December 2024, disclosed January 7, 2025, and now regarded as the largest K-12 education data breach on record. Reported figures put exposure at roughly 60 to 62 million students and 9.5 to 10 million teachers across about 18,000 districts in the US and Canada, including names, addresses, dates of birth, Social Security numbers, and grades. A ransom reported at around $2.85 million was paid, and the data resurfaced anyway, used to extort individual districts. Multidistrict litigation (MDL 3149) remains active in 2026.

The lesson is not that schools are careless. It’s that your child’s most sensitive identifiers live in dozens of systems you don’t control — districts, pediatric practices, insurers, camps, sports leagues, tax software. You cannot secure all of those. You can make the stolen data useless.

The Four Warning Signs the FTC Tells Parents to Watch For

The FTC’s guidance, published at consumer.ftc.gov as “How To Protect Your Child From Identity Theft,” lists four concrete signals.

The Signals That Warrant Action

1. A bill collector contacts you about an account you never opened in your child’s name.
2. Your child is denied government benefits because someone else is already using their SSN to claim them.
3. The IRS sends a notice about unpaid income taxes tied to your child’s SSN.
4. Your child is denied a student loan because of bad credit that isn’t theirs.

Three of these four involve a formal institution putting something in writing. That’s the pattern to watch for.

What Doesn’t Count

Ordinary marketing mail addressed to a child is not evidence of identity theft. Kids end up on mailing lists through magazine subscriptions, school photo vendors, toy registries, and data brokers all the time. A preapproved-offer envelope is worth a raised eyebrow and nothing more. Save your energy — and your paperwork — for formal notices from collectors, the IRS, benefits agencies, or lenders.

How to Freeze Your Child’s Credit for Free: The Step-by-Step

This is the centerpiece, and it’s more straightforward than most parents expect.

The Law That Guarantees It

A 2018 amendment to federal law — 15 U.S.C. § 1681c-1(j), explained in an FTC Consumer Alert in March 2019 — requires every nationwide credit bureau to let a parent or guardian place a free security freeze for a “protected consumer,” legally defined as anyone under 16. In the statute’s language you are the “protected consumer’s representative.” This is not a state program, not a paid service, and not something a bureau can charge you for or decline. It applies everywhere in the US.

TransUnion brands its version the Protected Consumer Freeze and describes it plainly on its consumer page: “A parent, guardian, conservator or person with a valid power of attorney can place it for a minor or incapacitated adult. It is free and will remain in place until a parent or guardian requests its removal, or a minor can request its removal once they are 16 years or older.”

What You’ll Need Before You Start

Gather these once and the process goes quickly:

• Proof of your own identity — government ID plus a proof of address
• Proof of your authority — a court order, a valid power of attorney, or a government document proving parentage such as a birth certificate. For foster children, a written certification from a county welfare or probation department qualifies
• Your child’s information — full legal name, date of birth, Social Security number, and address

Families come together in many ways, and the statute accounts for that: adoptive parents, legal guardians, conservators, and foster parents all have a documented path.

The Seven Steps

1. Contact Equifax, Experian, and TransUnion separately. A request to one does not cover the others. This is the step people miss, and a freeze at two bureaus leaves a real gap.
2. Expect to pay nothing. It is free at all three, to place and to remove.
3. Know that it’s opt-in only. No bureau does this automatically. If you don’t request it, it doesn’t exist.
4. Submit your documents. If your child has no credit file — the normal case — the bureau will create a restricted record for the sole purpose of freezing it.
5. Leave it in place. A protected consumer freeze stays active indefinitely until someone removes it. At 16, your child can request removal themselves.
6. Don’t wait to be a victim. You do not need evidence of fraud to qualify. Freezing is preventive, and that’s the entire point.
7. Keep your confirmation records — and remember to thaw it. File the confirmation letters or PINs somewhere you’ll find them in six years. Your teen will eventually need the freeze lifted for a legitimate first credit card, a car loan, an apartment application, or a student loan.

That last step is worth flagging on your calendar rather than trusting to memory. If you’re already thinking about how your teen will build a file of their own, our guide to the authorized-user strategy and our age-by-age look at a first credit card both assume an unfrozen file, so plan the thaw a few weeks ahead.

The Full Parent Checklist: Prevention, Detection, Response

Prevention

• Ask before you give out the number. Schools, camps, sports leagues, and medical offices request SSNs by habit far more often than they actually need them. “Is this required, and what happens if I leave it blank?” is a completely reasonable question.
• Freeze at all three bureaus. Free, permanent, and the single highest-leverage step on this list.
• Watch the social media combination. A full legal name, exact birthdate, school, and hometown posted together is a starter kit. Any one of them alone is harmless.
• Secure the adult accounts that hold your child’s data — your email, cloud storage, tax software, and school and medical portals. Strong unique passwords and two-factor authentication on your accounts protect their identity.
• Shred paper and securely erase devices that carry your child’s information.

Detection

• Request a manual credit-file check for your child at all three bureaus periodically. A blank result is the normal, boring, excellent outcome.
• Watch for the FTC’s four warning signs — and ignore the junk mail.

If You Find Misuse

• Contact the creditor directly and get written confirmation that the account is closed and your child is not liable.
• Contact all three bureaus for a manual SSN search and dispute any fraudulent entries.
• File at IdentityTheft.gov, which has a dedicated child identity theft flow with step-by-step recovery checklists. It generates an official FTC Identity Theft Report and a personalized recovery plan. Use it only once fraud is confirmed — filing a false report is a crime. The FTC’s printable guide “Child Identity Theft: What to Know, What to Do” is a useful companion.
• Keep meticulous records. Recovery routinely takes months, and documentation is what shortens it.

Protection and Habits Are the Same Parenting Project

It’s tempting to file this under “administrative chores” and separate it from the actual work of raising financially capable kids. It isn’t separate. Teaching a child to pause before handing over personal information is the same instinct as teaching them to pause before tapping “buy now” — a healthy, unembarrassed skepticism about who’s asking and why. The habits that help a nine-year-old recognize a scam or a sketchy payment request are the same ones that will protect them at nineteen, and the same ones that make financial safety a whole-family conversation across generations.

So freeze the credit — this week, at all three bureaus, while it’s in front of you. Then keep doing the slower work: chores that connect effort to money, an allowance they actually track, conversations about what a subscription is and who gets your data. Tools like Isembl exist to make that ongoing habit-building easier and more visible for the whole family, in whatever language you speak at home. The freeze protects the identity your child hasn’t used yet. The habits prepare them for the day they do.