Child identity theft: A parent’s guide to protecting your child’s future

A child's identity is valuable long before they are old enough to open a bank account or apply for a loan. Because identity theft involving children can remain undetected for years, it may not come to light until the child is older and begins using their identity for financial or other official purposes.

Note: This information is for general educational purposes and is not financial or legal advice. The article primarily covers child identity theft in the U.S.; laws, reporting procedures, identity documents, and credit systems vary by country.

What is child identity theft?

Child identity theft is a form of identity theft in which someone uses a minor's personal information, such as a Social Security number (SSN), name, address, or date of birth, to commit fraud. Criminals may use that information to apply for government benefits, open bank or credit accounts, take out loans, sign up for utility service, or rent housing in the child's name.

Because most children have little or no credit history, misuse can go undetected for years. It may only come to light when their family applies for government benefits or when the child later applies for credit, a student loan, housing, or another service that uses their identifying information.

In its 2021 Child Identity Fraud Study, Javelin Strategy & Research estimated that child identity fraud affected roughly 1 in 50 U.S. children annually and cost families nearly $1 billion.

The consequences can be serious and slow to unwind. Fraudulent accounts, unpaid balances, false benefits claims, and incorrect tax or employment records can create problems before the child has ever legitimately used their SSN. That's why parents and guardians are encouraged to treat a child's identifying information as sensitive from birth, long before the child has any financial accounts of their own.

How child identity theft happens

Criminals can obtain a child's personal information through several channels. Data breaches and phishing attacks may expose sensitive data, including records held by schools, healthcare providers, insurers, and government agencies. Physical documents at home (Social Security cards, birth certificates, and tax paperwork) can also be misused by someone who has access to them.

Misuse by someone the child knows is particularly significant. Javelin's research on child identity fraud found that more than 70% of child identity fraud victims personally knew the perpetrator, who could be a relative, family friend, or another person with access to the child’s information.

Children's information is also collected in many everyday settings, such as school enrollment forms, sports leagues, healthcare intake forms, summer camps, and after-school programs. Each of these creates another record that must be stored and safeguarded, and any one of them can become a point of exposure.

Synthetic identity fraud is another risk. It has been reported as one of the fastest-growing forms of financial crime in the U.S. Federal Reserve research notes that when criminals use a valid SSN to construct a synthetic identity, it often belongs to a child or another person with little active credit history.

In this scheme, a criminal may combine a child’s real SSN with a fabricated name, date of birth, or address to create a new identity. The criminal can then use that identity to establish a credit history, open accounts, and borrow money.

Children’s information may also be used to claim health coverage, nutrition assistance, or other government benefits. Parents may discover the fraud only after an application is rejected because the child’s SSN is already being used by someone else.

Common examples of child identity theft

Large-scale data breaches at schools

In December 2024, education technology provider PowerSchool discovered a cybersecurity incident affecting its Student Information System (SIS). An attacker had used a compromised credential to access PowerSchool, the company’s customer-support portal, and obtain data from some customers’ SIS environments. PowerSchool notified customers and publicly disclosed the incident in January 2025.

PowerSchool said it contained the incident, engaged third-party cybersecurity experts and law enforcement, and paid a ransom because it believed doing so was “in the best interest of our customers and the students and communities we serve.” It also offered two years of complimentary identity protection services to affected students and educators, with credit monitoring available to affected adults.

Foster youth and children in institutional care

The Consumer Financial Protection Bureau (CFPB) has documented foster youth discovering fraudulent or inaccurate accounts on their credit reports as they leave care. In a 2014 example, one young man found someone else’s unpaid utility account on his credit report when he tried to set up service at his first apartment.

Children in foster care may face heightened identity-theft risks because they often move between homes, and their personal information may be shared among numerous caregivers, caseworkers, service providers, and agency databases.

Federal law requires child welfare agencies to obtain and review credit reports annually for foster youth aged 14 and older until they leave care. The Federal Trade Commission (FTC) has also published guidance for foster parents, service providers, and child welfare representatives on checking and freezing children’s credit and securing their personal information.

How can you check for child identity theft?

Child identity theft often surfaces when a minor unexpectedly appears in systems where they shouldn't have any record at all, for example, a collection notice, a benefits denial, or an Internal Revenue Service (IRS) letter. Because most minors typically have little or no credit history, unexpected activity is worth investigating. However, some children may legitimately have credit or tax records.

The FTC advises parents and guardians to watch for signs such as:

• Bills or collection notices in the child's name: An overdue notice for an account the family didn’t open may indicate that someone used the child’s information. It could also result from an administrative or billing error, so confirm the account directly with the business.
• Credit card or loan offers addressed to the child: Unexpected financial solicitations in a child’s name may indicate that their information has entered marketing or credit-related databases. They don’t prove identity theft, but repeated or unusually specific offers are worth investigating.
• Denial of government benefits: Being told the child is already receiving health coverage, nutrition assistance, or another benefit (when the family has never applied or is applying for the first time) may indicate that someone else used the child’s SSN.
• IRS notices tied to the child's SSN: A CP87A means the same SSN was used to claim a dependent or qualifying child on another tax return. This may result from identity theft, an error, or a dispute over who is entitled to claim the child. A CP01E means the IRS detected that someone may have used the child’s SSN for employment.
• Unexpected calls or letters from businesses: Contact from utility providers, mobile carriers, landlords, or banks about an unfamiliar account or service in the child’s name is a strong reason to investigate.
• A denied financial or housing application: Older teens may discover misuse when they are denied a student loan, apartment, utility service, or another credit-based application because of unfamiliar accounts or debts. Employment-related SSN misuse may instead surface through an IRS notice or an incorrect Social Security earnings record.

Also read: Signs of identity theft and how to spot them early.

Request your child’s credit reports

Any of these signs is a reason to check whether a credit file exists in your child's name. Most children under 18 will not have one, although a legitimate file may exist in some circumstances, such as when a child has been added as an authorized user.

The FTC recommends contacting Equifax, Experian, and TransUnion separately and requesting a manual search using your child's SSN. Requirements vary by bureau, but you may be asked to provide:

• Proof of your identity: A copy of a government-issued ID, such as a driver's license.
• Proof of your address: A utility bill, bank statement, insurance statement, or similar recent document.
• Proof of your relationship or authority: A copy of the child's birth certificate showing you as a parent, or legal guardianship documents.
• Proof of the child’s identity: A copy of the child’s Social Security card may also be required.

The bureaus will tell you whether they located a credit file. If one exists, review it for unfamiliar accounts, balances, addresses, names, or credit inquiries. A report may also contain employer names supplied in credit applications, although it will not contain a complete employment or wage history.

Review and document suspicious identity activity

A credit report won't reveal every kind of identity misuse. Review records that may show actual financial, medical, employment, tax, or benefits activity, including:

• Bank or savings account statements.
• Health insurance explanations of benefits.
• IRS letters and tax records.
• Social Security earnings records.
• Government-benefit notices.
• Utility, mobile, or other service correspondence.

School, medical, and extracurricular forms can also help identify which organizations collected the child’s SSN or other sensitive information, although they will not usually show whether that information has been misused.

Compare unfamiliar records with accounts and services the family knowingly opened. Save copies of anything suspicious before contacting the relevant organization, including letters, statements, screenshots, account numbers, dates, and the names of companies or agencies involved. A dated record can help establish the scope of the misuse and support later disputes.

Read more: How to check if someone is using my identity.

How to prevent child identity theft

Preventive measures can reduce the risk that a child's personal information will be exposed or misused.

• Protect your child’s SSN: Store the Social Security card and birth certificate in a secure location instead of carrying them. Before sharing the SSN, ask why it’s needed, how it will be protected, and whether another identifier (or only the last four digits) can be used. The FTC recommends asking these questions even when a school requests the number.
• Limit requests for your child’s information: When enrolling your child in activities, sports, camps, or clinics, provide only the information that is required and leave optional fields blank where appropriate.
• Secure devices, accounts, and documents: Use strong passwords or passkeys, and enable multi‑factor authentication (MFA) on any accounts containing your child's information. Keep software updated and securely store or shred physical records.
• Teach your child safe online habits: Talk with older kids about what not to share and walk through the privacy settings on any app or game they use. Parents' own sharing choices are part of protecting a child's privacy, too: what adults post about a child online (sometimes called sharenting) shapes the child's digital footprint from an early age, so it's worth involving older kids in decisions about what gets shared about them. A virtual private network (VPN) with built-in parental controls can also hide a child's IP address and approximate location from apps and websites they use, encrypt their connection on school or café Wi-Fi so login details and personal information can't be easily intercepted, and filter out unsuitable content.
• Reduce the household's overall exposure: Family privacy isn't only about what adults and kids choose to post. A lot of household information is aggregated on data broker sites and surfaces in breach dumps without anyone's say, often bundling home address, family members, phone numbers, and identifiers in one place. Removing that data and monitoring for breaches lowers the risk of the household being targeted as a unit. For eligible new U.S. customers on Advanced and Express Pro plans, ExpressVPN’s Identity Defender includes features such as data broker removal, dark web and SSN monitoring, credit alerts, and identity theft insurance*.

What to do if your child’s identity is stolen

Acting quickly can help limit further misuse and create the documentation needed to resolve the fraud.

• Report the identity theft and close fraudulent accounts.
• Freeze your child’s credit files.
• Contact or respond to the IRS if the child’s SSN was used on a tax return, to claim them as a dependent, or for employment-related identity theft. Contact the Social Security Administration (SSA) if fraudulent employment has created incorrect wages in the child’s Social Security earnings record or affected their benefits. Follow any instructions in official notices before submitting additional forms.

How child identity theft can affect your kids

Because child identity theft may happen years before the child begins using their own credit, tax, or employment records, the consequences often surface later, when they reach milestones involving financial or official checks.

Financial and credit consequences

By the time a child reaches adulthood, a fraudulent credit file may already contain unpaid debts, delinquent utility accounts, or unfamiliar credit inquiries. Because credit scores are shaped by borrowing and repayment history, fraudulent activity can lower the child’s score before they have applied for credit themselves.

The downstream effects may include a rejected apartment application, difficulty qualifying for a private student loan or other credit, or a car loan with a higher interest rate. In some cases, inaccurate information in an authorized employment background check could also affect a job application.

Emotional and practical challenges

The recovery effort is substantial. In the Identity Theft Resource Center (ITRC's) 2025 Consumer Impact Report, 83.3% of the identity-crime victims it surveyed reported feeling worried or anxious, while 75.4% felt vulnerable. Although these figures were not specific to child identity theft, parents handling a child’s case may also experience stress during the recovery process.

When the child is old enough to understand what happened, they may also experience a sense of betrayal, particularly when the person who misused their identity was a relative or another person they trusted.

Long-term recovery considerations

Child identity theft can be particularly difficult to resolve. An SSN that has been circulated among fraud rings can reappear in synthetic identities for years, and the SSA generally only assigns a new number to an identity-theft victim after the person has tried to resolve the misuse and continues to be disadvantaged by the original number. Even then, a replacement SSN may not eliminate every problem because records associated with the old number can remain linked to the individual.

If someone used the child’s identity when arrested or charged with a crime, the family may also need to work with law enforcement, the relevant court, and background-screening companies to correct wrongful records.

Also read: What to do if your SSN is on the dark web.

FAQ

*The insurance is underwritten and administered by American Bankers Insurance Company of Florida, an Assurant company, under group or blanket policies issued to Array US Inc, or its respective affiliates, for the benefit of its Members. Please refer to the actual policies for terms, conditions, and exclusions of coverage. Coverage may not be available in all jurisdictions. Review the Advanced Tier Summary of Benefits and the Express Pro Tier Summary of Benefits.