Child identity theft and data breaches: what the pages say

Why a child’s details are a tempting target

The FTC’s guide says child identity theft happens when someone uses a child’s sensitive personal information to get services or benefits, or to commit fraud. It names the Social Security number, the name and address, and the date of birth, and lists what the stolen details can be used for: government benefits such as health care coverage or nutrition assistance, a bank or credit card account, a loan, a utility service, or renting a place to live. Experian’s page adds health insurance to that list.

Four of the pages say why a child is chosen. TransUnion says children cannot apply for credit on their own until they are 18 and likely have few financial assets, but do have valuable personal data. It calls children a tempting target because the theft may go undetected for years, and says that after a birth most parents apply for a Social Security number, which it describes as all that is required to open most credit accounts. The Identity Theft Resource Center (ITRC) says criminals often target children because their information is pristine and untouched, which makes fraud harder to detect, and that a child’s number is not typically checked when a fraudulent account is opened. The CFPB gives two reasons: children have no credit blemishes, and the fraud may go unchecked for years. Equifax calls children often “a blank slate” for fraudsters, because those under 18 typically have no credit reports, and says the misuse is often found only when the young adult tries to rent an apartment or get a credit card.

TransUnion lists three consequences. A child’s future credit and employment history can be affected if thieves, who it says sometimes turn out to be family members, obtain credit accounts or jobs using the identity. The thieves could also sign up for utility services or apply for government benefits. And if they are arrested for other crimes, those crimes could become associated with the child’s record. ITRC adds that it may take years to resolve the issue and restore the credit.

The CFPB cites one study, which it does not name or date: about 2.5 percent of households in the United States with children under 18 had experienced child identity fraud at some point. We could not trace the figure further, so treat it as second-hand. The pages we read do not say that a child’s details sell for more than an adult’s. What they describe is a file with no history, where misuse can go unseen for a long time.

How a breach can expose a child

TransUnion says children, like adults, can become victims of identity theft in several ways, such as by having their data exposed in a data breach incident. Experian is more specific. Its page on how child identity theft occurs gives three routes: phishing, hacking and theft in the family. On hacking, it says both small and large companies can be hacked, leading to a data breach, and that if a child has an account with a company that has been hacked, the child’s information may be exposed. It adds that browsing on an unsecure Wi-Fi network or downloading malware can make it possible for a device to get hacked. On theft in the family, it says relatives can steal important documents and open accounts in children’s names, and it advises keeping a child’s documents somewhere inaccessible even to extended family and friends.

ITRC’s fifth point is headed “Be Aware of Data Breaches and Scams”. It says to pay attention to any notices about breaches involving organizations where a child’s information may be stored, like schools or a doctor’s office, and that if you are informed a child’s data has been compromised, it suggests steps such as freezing the credit and monitoring the accounts. The same point asks for caution about phishing emails, calls or messages, because criminals may impersonate legitimate organizations or even family members.

IdentityTheft.gov, where the FTC tells readers to report child identity theft, has a page headed “What To Do if Your Information Was Lost or Stolen, or Part of a Data Breach”. It sorts its advice by the kind of information involved, and one entry is called Children’s personal information. That entry says to request a free credit freeze for the child, and to ask each credit bureau to check its records for a credit report in the child’s name. It adds that if a bureau has a report for the child, the bureau will send a copy, with instructions for removing fraudulent accounts.

Experian ties the freeze to breaches directly. Its answer on when to consider one says a freeze is a way to help prevent identity theft ahead of time, free at all three bureaus at any time, but that it is especially worth considering if a child’s information may have been compromised, for example if it was exposed in a data breach or the child fell victim to a phishing attack. The FTC’s guide and the CFPB page do not use the words data breach; they cover the same ground of checking, freezing and reporting without naming how the details got out.

The only lever the sources give for the places a breach usually comes from is to share less in the first place. The FTC says that if a child’s school asks for the Social Security number, ask why it is needed, how it will be protected, whether a different identifier will do, or whether just the last four digits will; Equifax gives the same advice for a doctor, and asks who can access the number if it must go to a school. None of the pages says this would have prevented a particular breach.

What to check first: does the child have a credit file?

The FTC says a good way to find out whether someone is using a child’s information to commit fraud is to check whether the child has a credit report, and adds that generally a child under 18 won’t have one. The CFPB’s tip box gives the same rule with three exceptions: someone with a similar name got credit and a file was created in error; an identity thief got a loan in the child’s name; or the child is an authorized user of an adult’s credit card or a joint account holder on an adult’s account. Experian names the authorized-user and victim cases. TransUnion says that a report the parent never created by adding the child as an authorized user may be a sign of identity theft. The CFPB also says errors can arise when a child’s name is the same as a parent’s, because credit information for the two can get mixed up.

The warning signs differ a little from page to page. The FTC lists four: a call about an overdue bill on an account you did not open, benefits denied because someone is already using the number, an IRS letter about unpaid income taxes, and a student loan denied because of bad credit. On the IRS letter it says this could happen if someone used the number on tax forms for a new job. Experian, TransUnion and the CFPB name offers of credit or suspicious mail addressed to the child, and Experian and the CFPB add contact from collectors.

How the request is made, and where it differs

The FTC says to contact the three credit bureaus and ask for a manual search for the child’s Social Security number. The bureaus may ask for a copy of your driver’s license or other government-issued identification, proof of your address such as a utility bill or a credit card or insurance statement, the child’s birth certificate and the child’s Social Security card. If you are not the child’s parent, the FTC says you may have to give documents that prove you are the legal guardian. Equifax says that if a report is found, you inform the bureau that it may be fraudulent.

The channel is different at each bureau, and the CFPB, in a page reviewed on 12 December 2024, says to check each bureau’s website for the latest. TransUnion has an online portal with a Child Identity Theft Inquiry form; it says it will respond by email to the address given, and the CFPB says a copy of the report may need a separate request by mail. Equifax requires contact by mail, the CFPB says. Experian has an online portal with forms to check whether a minor has a report, add a fraud alert for a minor, and add or remove a freeze. Instructions like these change over time, so the table below is a record of what the pages said on the day we read them.

The pages also differ on how often to look. Equifax says the FTC recommends checking for a report as the child’s 16th birthday nears, so that any problem can be addressed before the child applies for a job, an apartment or a vehicle loan. ITRC says to request the child’s report from the three bureaus at least once a year, then notes that this is only necessary if the child’s Social Security number has already been misused, and that monitoring should not be necessary if the credit was frozen in advance. Read together, the ITRC passage pulls both ways.

The freeze, which needs nothing to have gone wrong

The FTC’s guide says that if a child is under 16, you can request a free credit freeze to make it harder for someone to open new accounts in the child’s name. The freeze stays in place until you tell the bureaus to remove it, and the process for a minor is different from the one for an adult. Minors who are 16 or 17 may request and remove a freeze themselves. A consumer alert from the FTC and the CFPB, dated 5 July 2022, explains that a federal law in force since 21 September 2018 lets parents, child welfare representatives and legal guardians of people under 16 ask for the freeze, and makes it free to place and to lift at Equifax, Experian and TransUnion.

The same alert says a freeze will not affect anything already on a credit report; it restricts access to the report. If a bureau has no file on the child, it creates one so it can be frozen, and the alert says that record cannot be used for credit purposes. Equifax describes it the same way: a report will be created for the child, then frozen. Parents, the alert says, need to show proof of their authority, like a birth certificate, to freeze or unfreeze the file of a child under 16.

TransUnion calls it a Protected Consumer Freeze. A parent, guardian, conservator or person with a valid power of attorney can place it for a minor, it is free, and it stays until a parent or guardian asks for removal; a minor can ask for removal from the age of 16, and it can be lifted temporarily. The request must be written and mailed, with a copy of one document that proves authority, such as a court order, a power of attorney, a guardianship document or a government document showing parentage, including a birth certificate. It also needs proof of identity for you and the child, such as a copy of a Social Security card, a birth certificate or a driver’s license, as copies and not originals. TransUnion says a protected consumer freeze cannot be placed by phone or online at this time because of the documentation requirements, and that one must be placed with each bureau individually. If the child has no file yet, TransUnion says it will create one and freeze it; when the child turns 16, it says, the child can add a standard freeze by mailing a letter with the same documentation. For removal, TransUnion says a child who turns 16 can send a letter with identifying information, and that a freeze not removed by the age of 18 stays in place as a protected consumer freeze.

If an account already exists

The FTC’s guide gives three steps to take right away. First, contact the fraud department of each company where fraud happened, say someone opened an account using the child’s information, ask for it to be closed, and ask for written confirmation that the child is not responsible for it; then tell each credit bureau and ask it to remove the fraudulent accounts from the child’s credit report. Second, freeze the child’s credit report. Third, report the case to the FTC at IdentityTheft.gov, with as many details as possible.

Five more pages add pieces. The CFPB says to explain to each credit reporting company that the child is a minor and cannot legally enter into any type of contract, and to send a completed copy of the FTC’s Uniform Minor’s Status Declaration Form with a letter asking it to remove all accounts, account inquiries and collection notices from the file. TransUnion adds a report to the local police, which it says the company or bank where the fraud occurred may request, a letter to each company that includes the FTC Identity Theft Report, and free disputes with each bureau, for which TransUnion asks for the child’s Social Security number and a copy of the birth certificate. Equifax also lists a police report and says a birth certificate may be needed.

ITRC adds the tax side: if you suspect the child’s number was used to file a false tax return, or the child is claimed on someone’s taxes by a person who is not legally able to claim the child, contact the IRS, which it says can issue a formal identity theft report. It offers its own free and confidential help. Experian adds a step for accounts that were taken over: if usernames or passwords were taken, log in to the child’s online accounts and change the credentials, and check for fraudulent emails and messages sent from compromised accounts.

The order is not the same everywhere. The FTC puts closing the accounts before the freeze, while ITRC and Experian put the freeze first. The pages we read do not say which order is better.

What the pages do not say, and where to go on

The pages we read do not say what to do in the first hours after a breach letter that names a child. IdentityTheft.gov’s general steps include accepting free credit monitoring if a company offers it, and Equifax says to look for a monitoring product that lets you add children, but the pages do not say whether the monitoring a breached company offers suits a minor. They also give no count of children caught up in breaches, and they do not say whether a freeze limits what a breached company can do with data it already holds; the FTC alert says only that a freeze restricts access to the credit report. On time, the FTC does not say how long a case takes to resolve, and ITRC says only years. The steps IdentityTheft.gov lists for a stolen Social Security number, such as checking work history and locking the number with E-Verify, are written for adults, and we left them out.

The pages also differ in age: the FTC guide is dated October 2024, the CFPB page was reviewed on 12 December 2024, the FTC alert is from 5 July 2022, ITRC is dated 17 March 2026 and Experian 24 August 2026; TransUnion and Equifax show no date. Experian, TransUnion and Equifax are the bureaus themselves, so their pages describe their own procedures, and Experian’s ends with an offer of a family membership. We read the IdentityTheft.gov page on lost or exposed information, not its home page.

If someone is already using a child’s details, the adult version of the problem is on identity theft, and the wider picture of what a leak means is on data breach. For what happens to a stolen login afterwards, see credential stuffing.