Synthetic Identity Theft: The Scam Using Your Kid's SSN

Synthetic Identity Theft: The Scam Using Your Kid's SSN

Somewhere right now, a stranger is quietly building a person. He's got a steady job (fake), a decent apartment (fake), and a credit card he's paid on time for the last two years (very real). The only true thing about him is a nine-digit number he's wearing like a borrowed jacket — and it belongs to your nine-year-old, who has never applied for so much as a library card.

That's synthetic identity fraud, and it's not the same crime as somebody stealing your identity. Nobody's pretending to be you. They're building a whole new person out of spare parts — a real Social Security number stitched to a made-up name, a made-up birthday, a made-up everything else — and that Frankenstein identity is patient enough to look boring for years before it cashes out.

How Synthetic Identity Theft Actually Works

It runs in three phases, and none of them look dramatic while they're happening.

Build. A fraudster gets hold of a real SSN — usually a child's, a senior's, or anyone else with a "clean" number nobody's watching — and pairs it with a fabricated name, birthdate, and address. They apply for credit. Most applications get rejected, which sounds like a win, but it isn't: even a rejected application creates a credit bureau file for that fake person. Congratulations, the synthetic identity now technically exists.

Nurture. Over six months to a couple of years, the fraudster keeps applying, gets approved for a secured card or a store card here and there, and pays every bill on time. Sometimes they'll get added as an authorized user on someone else's account just to borrow a little credit history. To a lender's algorithm, this looks like a normal, cautious, creditworthy person slowly building a track record — because that's exactly what it's engineered to look like.

Bust out. Once the credit lines are fat enough, the fraudster maxes every single one out at once — cash advances, purchases, balance transfers — in the span of one billing cycle, then disappears. The accounts go from perfect payment history to total default overnight, and there's no angry customer calling the bank to dispute it, because the customer was never real to begin with.

The scale of it is not small. TransUnion found that U.S. lenders carried more than $3.3 billion in exposure to synthetic identities across auto loans, credit cards, retail cards, and personal loans by the end of 2024, according to TransUnion's own research.

Why Kids and Seniors Are the Perfect Donors

Here's the ugly logic: a synthetic identity needs an SSN that's real (so it passes basic verification) but unused (so nobody notices it's being borrowed). A working adult with active credit cards and a mortgage is a terrible donor — they'd spot a strange new account fast. A kid who's never had a bank account, or a senior who hasn't opened a new line of credit in twenty years, is close to perfect. Nobody's checking their credit report, because why would you check a seven-year-old's credit report?

Carnegie Mellon's CyLab put a number on exactly how much more attractive kids are as targets: in a study of more than 40,000 children, researchers found that 10.2% had their SSN used fraudulently by someone else — a rate roughly 51 times higher than the 0.2% rate among adults in the same dataset. The math is simple. A child's number can sit quietly building a fake credit history for a decade before anyone applies for a first credit card, a car loan, or federal student aid and discovers the number's already "in use."

Why This Is Harder to Spot Than Regular Identity Theft

Normal identity theft leaves a real, angry victim: your card gets used, your bank flags it, you call and cancel it. Synthetic identity theft doesn't touch your existing accounts at all — it opens new ones under a name that isn't yours, attached to a person who doesn't exist. There's no transaction on your statement to notice. No fraud alert fires, because none of your real accounts were touched. The only fingerprint it leaves is buried in a credit file that nobody — least of all a kid or a senior who was never expecting to have one yet — has any reason to check.

That's what makes it so much more durable than a stolen credit card number. A stolen card gets canceled in a day. A synthetic identity can operate for years, and the first anyone finds out is usually the worst possible way: a real 18-year-old applies for their first credit card and gets denied because "their" file already shows a defaulted loan and a collections account from a bust-out scheme that happened when they were in third grade.

The Red Flags Hiding in Plain Sight

• Preapproved credit offers addressed to your kid. If a "congratulations, you're preapproved" letter shows up in the mail with your child's actual legal name on it, that's not a marketing mistake — a lender's data broker has that name paired with a credit file.
• Collection calls for accounts you never opened. For your child, this is an unambiguous red flag at any age. For yourself, a collections call about an account you don't recognize is the bust-out phase showing up on your own file.
• An IRS notice that your SSN — or your dependent's — was already used on a filed return. Synthetic identities sometimes double as tax fraud vehicles, since a filed return with a fabricated income history can also trigger a refund.
• A denial for something you never applied for. "Too many recent inquiries" on a credit check you don't recall requesting means someone else requested it.
• Your child gets a real piece of financial mail before their 16th birthday. Jury duty summonses, court notices, or debt collection letters addressed to a minor by full legal name are the kind of thing that should never happen — and almost always means a synthetic identity is operating under that SSN.
• Your own credit file mentions an "authorized user" account you never added anyone to. Fraudsters sometimes hitch a fabricated identity to a real person's good credit this way to speed up the nurture phase.

If This Already Happened to You

Don't panic, but move with purpose.

1. Pull the credit report. For an adult, use annualcreditreport.com — it's the only site authorized by federal law to give you all three bureau reports free. For a child, most kids won't have a file at all; if they do, that itself is the red flag, since a minor generally shouldn't have any credit history.
2. Freeze the credit — yours and your kid's. A freeze is free and blocks new accounts from opening under that SSN. You'll need to contact Equifax, Experian, and TransUnion separately for a minor, and each one wants proof of guardianship (your ID, the child's birth certificate) — Experian's minor freeze process and Equifax's minor freeze FAQ walk through what each bureau needs.
3. File the report. Report it at IdentityTheft.gov, the FTC's official recovery site — it builds a personalized, step-by-step recovery plan based on exactly what happened.
4. Get an IRS Identity Protection PIN. Parents and guardians can request one for a dependent, though minors can't use the IRS's online tool — you'll need Form 15227 or an in-person appointment, and the PIN arrives by mail in about three weeks.
5. Check what else is exposed. Run your email through Cautellus's breach checker to see whether the same data that fed a synthetic identity has shown up anywhere else.

If you're still holding onto a scanned copy of a driver's license or ID document you're worried a scammer got their hands on, our guide on what to do after sharing a driver's license covers the fast-moving version of this same problem.

How to Not Become the Next SSN Donor

The single most effective move is also the most counterintuitive one: freeze your kid's credit before anything happens, not after. There's no minimum age. A freeze on a file that shouldn't exist yet means any application that tries to use that SSN gets rejected automatically — the fraud dies in the build phase instead of nurturing for a decade.

Beyond that: don't hand out a Social Security number just because a form has a blank for it. Schools, sports leagues, and pediatric offices ask for SSNs constantly, and most of them don't actually need it — ask what happens if you leave it blank before you fill it in. Keep Social Security cards and birth certificates in a locked, non-obvious place at home, since data breaches aren't the only way this data leaks — plenty of synthetic identity fraud starts with paperwork stolen from a house, a mailbox, or a relative's belongings after they've passed away. If you're managing an aging parent's affairs or watching for scams targeting a senior in your life, our guide to scams targeting seniors covers the broader landscape of what to watch for, since the same "clean, unused SSN" logic that makes kids attractive targets makes retirees attractive too.

For a broader look at how identity fraud has become the most-reported scam category overall — not just the synthetic variant — see our identity fraud overview.

FAQ

Is synthetic identity theft the same as someone stealing my identity? No. Regular identity theft uses your real, complete identity to impersonate you. Synthetic identity theft only borrows one real piece — usually your SSN — and welds it to a completely made-up name and history. That's exactly what makes it harder to detect: there's no real "you" for the fraud to visibly attach to.

Can a baby's Social Security number really be used for this? Yes, and it's one of the most common targets, because a newborn's SSN is guaranteed to be unused for at least 16-18 years. Fraudsters specifically look for numbers nobody's checking, and a baby's number is about as unwatched as it gets.

How would I even know if my child's SSN is being used? In most cases, you wouldn't — not until they turn 18, apply for their first credit card or student loan, and get flagged for a credit history they never built. That's why a proactive freeze matters more here than almost anywhere else in fraud prevention.

Does freezing credit hurt my or my kid's credit score? No. A freeze doesn't affect your credit score, and it doesn't stop you from using existing accounts. It only blocks new accounts from being opened while it's active, and you can lift it temporarily any time you actually need a lender to check your file.

I got a preapproved credit offer for my 6-year-old. What do I do first? Don't ignore it as junk mail. Pull a credit report request for your child through each bureau's minor-specific process — if a file exists, freeze it immediately at all three bureaus and file a report at IdentityTheft.gov.

Is this different from someone just using a stolen credit card number? Completely. A stolen card number gets used and canceled within days, and the damage is capped at whatever the card issuer eats. A synthetic identity can operate under a fabricated name for years, building real credit history before bursting into thousands of dollars of default that lands on a real person's SSN once the fraud is discovered.

Nobody's going to call you pretending to be your kid — this scam doesn't need a phone call, a fake voice, or a single conversation with you at all. It just needs nine quiet digits and enough patience to wait until you're not looking, which is exactly why the fix is to freeze the file before there's anything for a scammer to build on.

---

Sources: TransUnion Research, "Uncovering the $3.3B Synthetic Identity Threat" (2025) · Carnegie Mellon CyLab, Child Identity Theft study · Federal Reserve, Synthetic Identity Payments Fraud initiative · Experian and Equifax minor credit freeze guidance · IRS Identity Protection PIN program