Child Identity Theft: More Common Than You Think

Your eight-year-old has a credit score. They might have three. They could be 30 days late on a car loan.

This sounds absurd until you understand the mechanism. A Social Security number is a nine-digit key that unlocks credit, employment verification, government benefits, and medical records. The system doesn't verify age before issuing credit. It verifies the number exists and hasn't been used to default on prior obligations.

A child's SSN meets both criteria. Clean history. No defaults. No late payments. No collections. To a lender's automated decision system, a seven-year-old with no credit file looks identical to a 25-year-old who's never borrowed money. Both are blank slates.

Child identity theft exploits that gap. Someone uses a minor's Social Security number to open credit accounts, apply for loans, rent apartments, or file fraudulent tax returns. The fraud compounds silently for years because children don't check credit reports, apply for credit cards, or receive collection notices. The victim discovers the damage when they turn 18 and try to rent their first apartment or finance their first car.

The scale is harder to measure than adult identity theft because detection lags so far behind the crime. Some experts estimate that around 1 million children have their identities stolen each year in the United States, but that figure relies on surveys and voluntary reports. The actual number could be higher. Many cases never get reported because the victim doesn't discover the fraud until years after it occurred.

Here's how it works, why it persists, and what you can actually do about it.

The Mechanism Behind Child Identity Theft

Identity theft targeting adults follows a predictable pattern. Breach exposes credentials. Criminal tests credentials against financial accounts. Victim receives fraud alert or notices unauthorized charges. Timeline from breach to detection: days or weeks.

Child identity theft operates on a different timeline. The attacker obtains a child's Social Security number through a data breach, a stolen document, or access to family records. They use that number to apply for credit. The application triggers a credit file creation at one or more of the three major bureaus: Equifax, Experian, and TransUnion.

Credit bureaus don't verify age during file creation. They verify that the SSN exists in Social Security Administration records and hasn't been flagged as deceased. A valid SSN belonging to a six-year-old passes the same checks as a valid SSN belonging to a 40-year-old. The system creates the file, assigns a credit score, and begins tracking payment history.

The attacker opens accounts. Credit cards. Auto loans. Utility services. Cell phone contracts. Each account reports payment activity to the bureaus. The child's credit file grows. Balances accumulate. Payment history develops. The file looks like any other consumer credit report.

The child has no reason to check their credit. Parents rarely think to check it either. The fraud continues until someone applies for credit using that SSN and discovers the file already exists, complete with years of payment history, delinquencies, and collection accounts.

Detection happens when the victim turns 18 and applies for their first credit card, or when they apply for student loans, or when they try to rent an apartment. The lender pulls the credit report and finds a file that shouldn't exist. That's when the victim learns they've been carrying debt since they were in elementary school.

Who Commits Child Identity Theft

Strangers commit some child identity theft, but family members and people with access to the child's documents commit the majority of cases. A parent struggling with debt opens a credit card in their child's name. A relative with access to family records uses a niece's SSN to get utilities turned on. A caregiver with access to school files steals student information.

The Federal Trade Commission's consumer guidance on identity theft notes that identity theft by family members creates unique challenges because the victim often has an ongoing relationship with the perpetrator. Reporting the fraud can mean accusing a parent, grandparent, or sibling. Some victims choose not to report because they don't want to involve law enforcement in family matters.

Data breaches expose children's information the same way they expose adults'. Verizon's 2024 Data Breach Investigations Report documents how breaches at healthcare providers, schools, and government agencies leak Social Security numbers for millions of people, including minors. Once that data enters criminal markets, it gets used.

Schools and healthcare providers collect detailed information on children: full names, dates of birth, Social Security numbers, addresses, parent contact information, medical history, and insurance details. A breach at a pediatric clinic or a school district exposes all of it. The data sits in criminal forums for years. Someone eventually uses it.

Why Detection Takes So Long

Child identity theft stays hidden because children don't interact with credit systems. They don't apply for loans. They don't receive credit card offers in the mail. They don't get collection calls. The fraud operates in a system the victim doesn't access until they reach adulthood.

Parents don't routinely check their children's credit because most parents don't know children can have credit files. The assumption is that credit bureaus only create files when someone applies for credit, and children can't legally apply for credit. That assumption is wrong. Bureaus create files when someone applies for credit using a Social Security number. The system doesn't verify the applicant's age matches the age associated with that SSN.

Even when parents suspect something is wrong, the signs are subtle. A child receives a credit card offer in the mail. A collection notice arrives addressed to a ten-year-old. A parent tries to claim a dependent on their tax return and discovers someone already filed using that child's SSN. Each of these events could indicate fraud, but they could also result from clerical errors or database glitches. Parents often dismiss the first warning sign.

The fraud compounds over time. One credit card becomes three. Three becomes six. Balances grow. Payments stop. Accounts go to collections. The credit file deteriorates while the child grows up unaware that their financial identity has been destroyed before they're old enough to use it.

In The Two Towers, Treebeard tells Merry and Pippin that Ents don't say anything unless it's worth taking a long time to say. Child identity theft works on the opposite principle. The crime happens quickly. The damage accumulates slowly. The victim doesn't speak until years later, when the damage is already done and the perpetrator is long gone.

The Credit File Paradox

Here's the part that confuses people: a child can have a credit file even if they've never applied for credit. Credit bureaus create files when they receive information about a Social Security number. That information can come from a credit application, but it can also come from a collection agency, a utility company, or a public record.

If someone uses a child's SSN to open a utility account and that account goes to collections, the collection agency reports the debt to the credit bureaus. The bureaus create a file for that SSN and record the collection. The child now has a credit file with a negative mark. No credit application required.

The FTC's guidance on credit freezes explains that you can freeze a child's credit even if they don't have a credit file yet. When you request a freeze for a minor, the bureau creates a file if one doesn't exist and immediately places a freeze on it. This prevents anyone from opening new credit in that child's name.

The freeze doesn't stop existing accounts from reporting activity. If someone already opened accounts using the child's SSN, those accounts will continue to report to the credit bureaus. The freeze only blocks new credit applications. To address existing fraud, you need to dispute the accounts directly with the bureaus and file a report with the FTC.

What Gets Stolen and How It's Used

Child identity theft isn't limited to credit cards. Attackers use children's Social Security numbers for:

Credit accounts. Credit cards, auto loans, personal loans, and retail financing. The attacker provides the child's SSN, invents an address and employment history, and applies. Automated systems approve the application based on the clean credit file.

Utility services. Electric, gas, water, internet, and phone service. Utility companies check credit before activation. A child's clean file passes the check. The attacker gets service turned on, runs up charges, and disappears. The utility reports the unpaid balance to collections. The collection appears on the child's credit report.

Government benefits. Someone files a fraudulent tax return using a child's SSN to claim a refund. Or they use the child's SSN to apply for unemployment benefits, food assistance, or housing subsidies. The fraud creates a government record that complicates the victim's future interactions with those agencies.

Employment. An undocumented worker uses a child's SSN to get a job. The employer reports wages to the IRS and Social Security Administration under that number. The child's earnings record shows income they never earned, which can affect future Social Security benefits or trigger tax issues.

Medical services. Someone uses a child's SSN to obtain medical care. The treatment gets billed to insurance under the child's identity. The child's medical records now contain information about conditions they don't have, treatments they didn't receive, and medications they were never prescribed. This can affect future insurance coverage and medical care.

Each type of fraud creates different consequences. Credit fraud damages the victim's credit score and creates debt collection liability. Tax fraud delays refunds and creates IRS disputes. Medical fraud corrupts health records and can lead to insurance denials. Employment fraud creates phantom income that affects tax filings and benefit calculations.

The Family Member Problem

When a stranger steals your child's identity, the path forward is clear. You report the fraud, dispute the accounts, file a police report, and freeze the child's credit. The criminal faces prosecution if caught.

When a family member steals your child's identity, every step becomes complicated. Do you file a police report against your mother? Do you press charges against your brother? Do you involve law enforcement when the perpetrator is your co-parent?

The FTC's consumer guidance acknowledges this dynamic but doesn't offer solutions beyond the standard fraud recovery process. The legal steps to clear fraudulent accounts require a police report. Creditors and bureaus demand documentation that proves the charges were unauthorized. A police report provides that documentation. But filing that report means accusing a family member of a crime.

Some victims choose not to report family-perpetrated fraud. They negotiate directly with creditors, pay off the fraudulent debts, or simply live with damaged credit rather than involve law enforcement. This decision has real consequences. Unpaid debts go to collections. Credit scores drop. Future credit applications get denied. The victim carries the financial burden of someone else's fraud.

Other victims report the fraud and let law enforcement handle the investigation. This can fracture family relationships permanently. The perpetrator may face criminal charges. Other family members may take sides. The victim has to weigh financial recovery against family cohesion.

There's no good answer here. Both paths create harm. The fraud created the harm. The victim just gets to choose which type of harm to absorb.

How to Check If Your Child Has a Credit File

You can request your child's credit report from each of the three major bureaus: Equifax, Experian, and TransUnion. The process differs slightly at each bureau, but all three require proof of your identity, proof of your relationship to the child, and proof of the child's identity.

What you'll need:

• Your government-issued ID (driver's license or passport)
• Your child's Social Security card or a document showing their SSN
• Your child's birth certificate
• Proof of your address (utility bill, bank statement, or similar)
• A signed letter requesting the credit report

Mail these documents to each bureau separately. Include a letter stating that you're requesting a credit report for your minor child to check for fraudulent activity. The bureaus will either send you a letter stating no file exists (good) or send you a credit report showing the file contents (bad, if the file shouldn't exist).

If no file exists, that's the expected result. Most children don't have credit files. If a file exists and contains accounts your child didn't open, you're looking at identity theft.

The FTC's guidance on child identity theft walks through the dispute process. You'll need to contact each creditor listed on the report, explain that the accounts are fraudulent, and provide documentation proving the account holder was a minor when the account was opened. You'll also need to file a report at IdentityTheft.gov and potentially file a police report.

Credit Freezes for Children

A credit freeze blocks access to a credit file. When a freeze is in place, lenders can't pull the credit report to make lending decisions. This prevents new account openings because most lenders won't approve an application without seeing a credit report first.

You can freeze your child's credit at all three bureaus. The freeze stays in place until you lift it. There's no cost to freeze or unfreeze a minor's credit file.

To freeze your child's credit, contact each bureau directly:

Equifax: Mail a request with the same documentation required for requesting a credit report (your ID, child's birth certificate, proof of address, signed letter). Equifax will create a file if one doesn't exist and place a freeze on it.

Experian: Similar process. Mail documentation and request a freeze. Experian creates the file and freezes it.

TransUnion: Same process as the other two bureaus.

Each bureau will send you a confirmation letter and a PIN or password to use when you need to lift the freeze. Keep these in a safe place. Your child will need them when they turn 18 and want to apply for credit legitimately.

The freeze doesn't affect existing accounts. If your child already has fraudulent accounts reporting to their credit file, those accounts will continue to report activity. The freeze only stops new accounts from being opened. You'll need to dispute the existing accounts separately.

What to Do If You Find Fraud

If you discover fraudulent accounts on your child's credit report, here's the sequence:

1. File a report at IdentityTheft.gov. This is the FTC's centralized identity theft reporting system. The site walks you through the reporting process and generates a recovery plan with specific steps for your situation.

2. Contact each creditor. Call the fraud department at every company that issued a fraudulent account. Explain that the account was opened using a minor's stolen identity. Ask them to close the account and remove all charges. Send a follow-up letter with copies of your child's birth certificate, the IdentityTheft.gov report, and any police report you filed.

3. Dispute the accounts with the credit bureaus. Contact Equifax, Experian, and TransUnion. Dispute each fraudulent account. Provide the same documentation you sent to the creditors. The bureaus have 30 days to investigate and respond.

4. File a police report. Some creditors and bureaus require a police report before they'll remove fraudulent accounts. Contact your local police department and file a report. Bring copies of the credit report, birth certificate, and any other documentation. Get a copy of the police report to send to creditors and bureaus.

5. Freeze your child's credit. Even after you've cleared the fraudulent accounts, freeze the credit files at all three bureaus to prevent new fraud.

6. Monitor for recurrence. Check your child's credit reports annually. Identity thieves sometimes retry after initial fraud is cleared. Ongoing monitoring catches new attempts early.

The process takes months. Creditors are slow to respond. Bureaus are slow to investigate. Some accounts get removed quickly. Others require multiple disputes and escalations. You'll spend hours on the phone, send dozens of letters, and navigate bureaucratic processes designed for adult victims, not parents representing minor children.

The FTC's step-by-step recovery guide provides detailed instructions for each step. The process is tedious, but it works. Fraudulent accounts get removed. Credit files get cleaned. The child's credit history gets restored to what it should be: blank.

The Tax Fraud Variant

Some attackers use children's Social Security numbers to file fraudulent tax returns. The IRS doesn't verify age before processing returns. Someone files a return claiming a child's SSN as the primary taxpayer, invents income and withholding, and requests a refund. The IRS sends the refund. The fraud succeeds.

The victim discovers the fraud when their parents try to claim them as a dependent and the IRS rejects the return because someone already filed using that SSN. Or the victim discovers it years later when they file their first tax return and the IRS has a record of prior filings they didn't submit.

The IRS has a specific process for resolving tax-related identity theft. You file Form 14039 (Identity Theft Affidavit) and submit documentation proving your child's identity. The IRS investigates, which can take months. During that time, legitimate tax refunds get delayed. Future returns get flagged for additional review.

The IRS guidance on identity theft walks through the resolution process. The key step is getting an Identity Protection PIN (IP PIN) for your child. The IP PIN is a six-digit code the IRS issues annually. You include it on your child's tax return (when you claim them as a dependent). The IRS won't process a return for that SSN without the correct IP PIN. This prevents future fraudulent filings.

Prevention Is Easier Than Recovery

You can't prevent all child identity theft. Breaches happen. Data leaks. Documents get lost. But you can reduce exposure and catch fraud early.

Freeze your child's credit at all three bureaus. Do this when they're young. The freeze stays in place until they need credit as adults. It's free. It takes a few hours of paperwork. It blocks most credit-based fraud.

Limit who has access to your child's Social Security number. Schools, doctors, and insurance companies need it. Sports leagues, summer camps, and after-school programs usually don't, despite what their forms say. Ask why they need it and whether you can provide an alternative identifier. Many organizations request SSNs out of habit, not necessity.

Shred documents that contain your child's personal information. Medical records, insurance statements, school enrollment forms, and tax documents all contain data that enables identity theft. Don't throw them in the trash intact.

Monitor for warning signs. Credit card offers addressed to your child. Collection notices for accounts they didn't open. IRS letters about tax filings you didn't submit. Any of these signals potential fraud. Investigate immediately.

Check your child's credit report periodically. You can't get free annual reports for children the way you can for adults, but you can request reports by mail. Check every few years, or whenever you see warning signs.

Talk to your child about Social Security number security. As they get older and start filling out forms themselves, make sure they understand that their SSN isn't something to share freely. Schools and employers have legitimate reasons to request it. Random websites and apps do not.

When to Use Identity Theft Protection Services

Identity theft protection services monitor credit files, dark web forums, and public records for signs of fraud. Some services include credit monitoring for children as part of family plans. These services can catch fraud earlier than manual checking, but they're not foolproof.

The services work by monitoring credit bureau databases for new account openings, credit inquiries, and changes to existing accounts. When something changes, they send an alert. You investigate. If it's fraud, you follow the standard dispute process.

For children, these services provide limited value because most children don't have credit files to monitor. If you've frozen your child's credit, new accounts can't be opened anyway. The monitoring catches fraud only if an account was opened before you placed the freeze, or if someone bypasses the freeze through identity theft at a creditor that doesn't check credit.

The services that scan dark web forums and data breach databases provide more value. They alert you when your child's information appears in leaked databases or criminal marketplaces. This gives you early warning that the data is circulating and might be used for fraud. You can freeze credit and monitor more closely in response.

Whether the monthly fee is worth it depends on your risk tolerance and how much time you want to spend on manual monitoring. The services don't prevent fraud. They just alert you when it happens. You still have to go through the full dispute and recovery process yourself.

NordProtect offers identity theft monitoring with credit alerts, dark web scanning, and recovery support. If you want automated monitoring rather than manual credit checks, it's an option worth considering.

The Long-Term Consequences

Child identity theft doesn't just create immediate financial damage. It creates long-term consequences that follow the victim into adulthood.

A young adult with a destroyed credit score can't rent an apartment without a co-signer. They can't finance a car. They can't get approved for credit cards. They can't qualify for student loans at reasonable interest rates. Their first years of financial independence are spent repairing damage they didn't cause.

The fraud also creates psychological consequences. The victim learns that their identity was stolen by someone they trusted, or that their parents didn't protect their information, or that systems designed to verify identity failed completely. That shapes how they think about trust, institutions, and their own vulnerability.

Some victims spend years clearing fraudulent accounts only to discover new fraud when they apply for a mortgage or try to refinance student loans. The original attacker sold the SSN to other criminals. The fraud spreads. Each new instance requires another round of disputes, police reports, and documentation.

The credit bureaus and creditors treat child identity theft the same way they treat adult identity theft: as a dispute to be investigated and resolved according to standard procedures. But the standard procedures assume the victim is an adult who can navigate bureaucracy, understand credit systems, and advocate for themselves. A parent representing a minor child faces additional documentation requirements and skepticism from creditors who aren't used to handling these cases.

What Actually Works

Credit freezes work. They stop new account openings. They're free. They stay in place until you lift them. If you do nothing else, freeze your child's credit at all three bureaus.

Early detection works. The sooner you discover fraud, the less damage accumulates. Check your child's credit periodically, especially before major life events like college applications or their 18th birthday.

Documentation works. Keep copies of everything: birth certificates, Social Security cards, credit reports, dispute letters, police reports, and creditor responses. You'll need this documentation repeatedly throughout the recovery process.

Persistence works. Creditors and bureaus don't always respond to the first dispute. You'll need to follow up, escalate, and sometimes file complaints with the Consumer Financial Protection Bureau or your state attorney general. The system is designed to make you give up. Don't.

What doesn't work: assuming it won't happen to your child. Assuming credit bureaus verify age before creating files. Assuming schools and healthcare providers adequately protect the data they collect. Assuming you'll notice fraud when it happens.

Child identity theft is common because the systems that should prevent it don't. Credit bureaus create files without age verification. Creditors approve applications without confirming the applicant's age matches the SSN. Schools and healthcare providers collect detailed information without adequate security. The fraud succeeds because the infrastructure enables it.

You can't fix the infrastructure. You can freeze your child's credit, limit who has access to their information, and check for fraud periodically. That's what's actually in your control.