A Synthetic Identity Is a File That Was Manufactured, Not a Person in Hiding
Take one real identifier – very often the Social Security number of a child or of somebody who has died – attach an invented name, an invented birth date and a mailing address that answers to nobody, and a credit file eventually forms around it. There is no impostor walking into a branch pretending to be you. There is a person who does not exist, wearing one true number. The good news for a reader is that a manufactured file cannot help looking manufactured, and the shapes it makes are the subject of this page.
The short version
Almost nobody discovers a synthetic identity by staring at one credit report, and that is a structural fact rather than a failure of effort. The fraud lives in the relationships between files – one address answering for people who have nothing to do with each other, one number turning up against more than one birth date – and a consumer is only ever shown a single file. What a consumer can do is check whether a file that should not exist does exist, which is why a child having any credit history at all is the loudest alarm in this whole subject. Ask the three nationwide bureaus for a manual search on the child’s number, put a protected-consumer freeze on the result, report the theft to the Federal Trade Commission, and keep every piece of paper. And discard the folklore about reading a state out of the first three digits: for anybody enumerated since June 2011, those digits mean nothing at all.
Watch: the shapes a manufactured file makes
Seventy-five seconds on why a synthetic file looks young and rich at the same time, and why that combination is the thing to look for.
1 min 15 sec
Real number, invented person
The definition matters more than usual here, because the word “identity” makes people picture the wrong crime and then look for the wrong evidence.
The Federal Reserve System put the definition on the record when it published its research on the subject. Announcing that work, the Board’s July 9, 2019 statement describes a synthetic identity as one “created by using a combination of real information (such as a legitimate Social Security number) with fictional information (which can include a made-up name, address or date of birth).” It goes on to describe the life cycle plainly: fraudsters build up the creditworthiness of the synthetic identity over time and then “bust out” by buying high-value goods and services on credit and disappearing, and because the identity was never a person to begin with, there is limited recourse in tracing anyone or holding them to the debt. The paper itself carries the title Synthetic Identity Fraud in the U.S. Payment System, and Ken Montgomery, the Federal Reserve System’s payments security strategy leader and chief operating officer at the Federal Reserve Bank of Boston, framed the consumer problem in one line worth repeating: many consumers do not realize how it can hurt their access to credit or how to protect themselves.
Notice what is absent from that description. Nobody has to look like you, forge your signature, or know anything about your life. Ordinary identity theft is a person wearing your whole face; this is a person wearing one of your fingernails. It follows that the classic symptoms most people are told to watch for – a charge you did not make, a card you did not order, a call from a store you have never entered – can be completely absent for years while the number is in heavy use somewhere else. That is precisely why the classic symptom list is the wrong tool here, and why so much of what ranks for this subject reads like advice for a different crime.
The damage does not stop at credit
The same Federal Reserve statement lists consequences that reach outside the lending system entirely: denial of disability benefits, rejection of tax returns, and inaccuracies in health records. Read that list slowly, because it explains a category of complaint that otherwise makes no sense – the parent whose application for a child’s benefit is refused on the grounds that the benefit is already being paid, the taxpayer whose electronically filed return is rejected as a duplicate, the patient whose chart carries a blood type that is not theirs. Each of those is a downstream effect of a number being in circulation under a name that is not attached to it.
Why the number, and not something else
A Social Security number is uniquely well suited to this because of two design facts, both of them stated by the Social Security Administration itself. First, in its published answers on the 2011 change to how numbers are issued, the agency confirms that it does not reassign numbers – the change gave it enough new numbers to avoid reassignment entirely. A number therefore belongs to exactly one person, once, permanently. Second, only the assignment method changed in 2011; existing number holders were not issued new numbers and no card was reprinted, so every number issued before that date is still in service under the old rules.
Put those two facts together and you have the reason children and the dead are over-represented in this fraud. A number that has never been used generates no contradiction when somebody starts using it, and a number whose holder has died generates no complaint, because nobody is monitoring it. Neither number is ever recycled by the agency, so neither will collide with a legitimate new holder. What makes them attractive is not secrecy – it is silence.
The arithmetic of a manufactured file
A real credit history accumulates the way a life does: slowly, unevenly, with gaps. A manufactured one is built to a deadline, and the seams show.
The signature shape is a young file that suddenly becomes a deep one. A genuine file that begins at twenty-two begins small – a student account, a first card with a low limit, a co-signed vehicle loan – and thickens over a decade in a way that tracks a job, a move, a marriage. A manufactured file has no history at all before some recent month and then acquires accounts at a rate no ordinary life produces, because the person operating it is not living, they are working. Depth arriving faster than time can explain is the single most durable tell in this whole subject, and unlike almost everything else on this page it is visible in a single file.
The second shape is a set of identity elements that do not cohere. The number is real and passes format checks. The name is real enough to type. The birth date is plausible. But the combination has never described one human being, and it is the combination, not any single field, that fails. This is why an institution running a valid-format check on the number alone learns nothing: the number is genuinely valid, because it genuinely belongs to somebody. It simply does not belong to the applicant.
The third shape is an address that behaves like infrastructure rather than a home. Some mailing addresses are not residences at all. The United States Postal Service defines a commercial mail receiving agency, in section 508.1.8 of its Domestic Mail Manual, as a business that in whole or in part accepts delivery of United States Mail on behalf of another person or entity as a business service – a mailbox storefront, in ordinary language. The same section sweeps in office business centers, and it expressly treats a business or individual operating primarily to provide reshipping or redelivery services as a commercial mail receiving agency too. Every such agency has to register with the Post Office responsible for delivery, on Form 1583-A, and the postmaster records the identification presented. None of that is sinister; these are lawful, useful, heavily used businesses, and an enormous number of legitimate small enterprises and travelers rely on them. The point is narrower: an address of that kind tells you nothing about who lives where, which is exactly the property a manufactured identity needs. A voice-over-internet telephone number has the same property for the same reason.
The fourth shape is a file that gains age it did not earn. When an existing account holder adds somebody as an authorized user, the history of that account can begin appearing on the added party’s file. Used as intended, that is how a parent gives a nineteen-year-old a running start. Used the other way, it is a way of grafting years of on-time payments onto a file that is months old, and the industry name for it – piggybacking – is unusually honest. What makes it a signal rather than a verdict is the pattern: one addition means a family. The same account seeding a dozen unrelated files means something else.
The fifth shape is the one nobody can see from the inside. Manufactured identities are rarely built one at a time, and they leave collisions: the same apartment number behind several unconnected names, the same telephone number listed on applications that share nothing else, a birth date recycled across a small cluster of files. Every one of those observations requires seeing more than one file at once. A consumer never does. If you want to understand why a records-research firm keeps insisting on corroboration from an independent record before it will assert anything, this is the underlying reason – the same reason we set out in our note on testing an identity claim that somebody has volunteered.
What a Social Security number can still tell you, and what it stopped telling anyone in 2011
This is the part of the subject where confident, out-of-date advice is easiest to find – including from pages currently ranking for it.
For most of the number’s history, its first three digits carried meaning. The Social Security Administration’s own explanation of the change, published for employers, sets out the old arrangement precisely: the nine-digit number has always been an area number of three digits, then a group number of two, then a serial number of four, and since 1972 the agency issued cards centrally and the area number reflected the state, as determined by the ZIP code in the mailing address on the application. That is the origin of every “the first three digits tell you where somebody is from” article ever written. For a number issued between 1972 and 2011, the claim is broadly true, with the important caveat that it identifies the mailing address on the application – not a birthplace, not a residence today, and not necessarily even the state the applicant lived in.
Then it stopped. The agency changed the way numbers are issued on June 25, 2011, in a program it calls randomization, and it describes three specific effects. It eliminated the geographical significance of the area number by no longer allocating area numbers to specific states. It eliminated the significance of the highest group number, with the consequence that the High Group List – the published table people used to sanity-check a number and to date it – is, in the agency’s own words, frozen in time and can only be used to see the area and group numbers issued before the changeover. And it introduced previously unassigned area numbers, excluding 000, 666 and the 900 to 999 range.
What that means for anyone checking a number today
Three practical conclusions follow, and they are more interesting than the folklore they replace.
Geography is gone for anyone enumerated since mid-2011. Zero digits of a number issued on or after June 25, 2011 carry any geographic meaning: no state, no region, no issuing office is encoded in a modern number, because the agency stopped allocating area numbers to states at all. A page telling you that a prefix in the 4-hundreds means the Midwest is describing a system that was retired years ago – and it is retired precisely for the cohort that matters most to this subject, because a child born in 2012 or later has a randomized number by definition. The heuristic dies exactly where you most want to use it.
Dating a number by its group is gone too. The frozen High Group List still shows what was issued before the changeover, so a number that appears on it can be placed in the old scheme. A number that does not appear on it tells you only that it is recent or that it was never issued at all – two very different conclusions the list cannot distinguish. The Social Security Administration says as much when it points employers away from the list entirely and toward direct verification services instead, naming its own Social Security Number Verification Service for employers, the Department of Homeland Security’s E-Verify service for employment eligibility, and its fee-based Consent Based Social Security Number Verification Service for enrolled companies and agencies. Its assessment of the comparison is blunt: those methods are much more accurate than using the High Group List.
Format checking survives, and it is genuinely useful. Some numbers are never assigned to anyone, before or after 2011. Area numbers 000, 666 and 900 through 999 are excluded from assignment; a group number of 00 and a serial number of 0000 are not assigned and remain invalid. The length has not changed either – nine digits, as always. So a number failing any of those tests is not a real number, full stop. What a number passing them proves is only that it could exist, which is a much smaller claim than most people hear.
The honest summary is that the 2011 change moved this subject from pattern-reading to verification. You can no longer infer a story from the digits; you can only ask an authoritative holder of the record whether a name and a number go together. That distinction runs through every other page we write about identifiers as well, including the practical limits set out in what a Social Security number does and does not open up in a records search.
Five signals, and what each is actually evidence of
Every one of these gets written up somewhere as a red flag. None of them is a finding on its own, and treating one as a finding is how innocent people get accused.
| Signal | What it can honestly support | What it cannot support |
|---|---|---|
| A minor has a credit file at all | The strongest single indicator available to a private individual. A child normally has no file, so the existence of one is an event that has to be explained Act on this | It does not tell you who created it, when, or from where. A file can also be opened in error by a mismatched record rather than by fraud |
| No history before a recent date, then rapid depth | A file that is behaving unlike a life. Combined with an age mismatch it is the classic profile, and it is visible in a single report | Immigrants, people returning from long periods abroad, and adults who have genuinely never borrowed all produce young files. Youth alone proves nothing |
| Number, name and birth date that never described one person | That the combination is wrong somewhere. This is what direct verification services exist to answer | It does not say which field is the false one, and clerical error produces the same result far more often than fraud does |
| A mail-receiving or reshipping address, or a voice-over-internet number | That the contact details carry no residential meaning, so nothing about location can be read from them | Nothing adverse whatsoever about the person using them. These are ordinary, lawful services used by millions for entirely mundane reasons |
| Authorized-user history appearing on a thin file | A file that has acquired age it did not accumulate. Meaningful only as a pattern across several unrelated files | A single instance is overwhelmingly likely to be a parent, a spouse or a small employer doing something completely normal |
Read down the third column before the second. Every signal in the table has an innocent explanation that is more common than the guilty one, which is why an institution weighs them together and across time rather than reacting to any single hit. It is also why we will not turn a table like this into an accusation on a client’s behalf, a limit we set out in full further down.
Why one file never looks wrong
The reason a consumer cannot detect this, stated properly, so that nobody wastes months trying.
Consider what a synthetic identity actually consists of once it is running. Every individual element is true or at least well-formed. The number is a real number. The address receives mail. The telephone rings. The accounts are real accounts, opened through ordinary channels, with payments genuinely made. Examined in isolation, there is nothing to catch, because there is no forgery anywhere in it – only a set of true things assembled around a person who is not there.
What gives it away is repetition across files, and repetition is only visible to somebody holding many files. A lender that has seen forty applications this month from four addresses can see that. A bureau matching incoming records against everything it holds can see that. A consumer holding one report cannot, and no amount of diligence changes the arithmetic. This is the reason the useful published research on the subject is written for institutions, and the reason almost none of it helps the person reading it at a kitchen table.
There is a second asymmetry underneath the first. An institution can ask a question a consumer cannot: it can put a name and a number to an authoritative verification service and get an answer. The Social Security Administration’s own guidance, quoted earlier, sends employers to exactly those services. A private individual has no equivalent – and, importantly, should not. A tool that let anybody confirm which name a number belongs to would be a directory of the population’s most sensitive identifier, and the fraud on this page would get easier, not harder.
So the practical division of labor is this. Institutions detect. Consumers discover, usually by finding a record that should not exist, and then move immediately to containment and repair. Everything in the next two sections is written for the second job, because it is the one a reader can actually do.
The child case, and why it inverts the test
For an adult you are looking for a wrong entry in a file that should exist. For a child you are looking for the file.
The Federal Trade Commission’s consumer guidance on protecting a child from identity theft puts the check in one sentence: a good way to find out whether somebody is using your child’s information is to see whether the child has a credit report, because generally a child under eighteen will not have one. The Commission’s article tells you how to run it – contact the three nationwide credit bureaus, Experian, Equifax and TransUnion, and ask each of them for a manual search on the child’s Social Security number. That phrase matters. An ordinary online report request keys off a file that already exists and will simply come back empty; the manual search is the thing that looks for a file filed under a different name.
Expect to prove who you are. The Commission’s list of what a bureau may ask for is a copy of your driver’s license or other government-issued identification, proof of your address such as a utility bill or a credit card or insurance statement, the child’s birth certificate, and the child’s Social Security card. Anyone who is not the child’s parent should expect to add documents proving legal guardianship.
The warning signs the Commission publishes
Four of them, and each is worth knowing because each arrives from a direction people do not expect. Somebody contacts you about your child’s overdue bill on an account you never opened. You are refused a government benefit – health care coverage or nutrition assistance – because the child’s number is already being used to claim it. A letter arrives from the Internal Revenue Service about unpaid income taxes for your child, which happens when the number has been put on tax forms for a job. Or your child is refused a student loan for bad credit, after somebody used the number to open a card, a cell phone account or a utility service and then stopped paying. Note that two of the four – the refused benefit and the refused student loan – surface only at the moment the child needs something. That is the cruelty of the timing, because the moment a young person first applies for anything can fall many years after the file was opened.
The freeze that federal law wrote for people with no file
Here is the provision that answers the obvious objection – how do you freeze credit that does not exist yet – and it is barely written about anywhere. Subsection (j) of section 1681c-1 of the Fair Credit Reporting Act creates a security freeze for what it calls a protected consumer, defined as an individual under the age of 16 years at the time the request is made, or an incapacitated person or protected person for whom a guardian or conservator has been appointed. On a direct request from that person’s representative, with sufficient proof of identification and of authority, a nationwide bureau must place the freeze free of charge – within one business day if the request came by toll-free telephone or secure electronic means, or three business days if it came by mail – and must send confirmation, plus an explanation of how the freeze can later be removed, within five business days.
Then comes the elegant part. If the bureau has no file for the child when the request arrives, the statute requires it to create a record so the freeze has something to attach to. That record is defined narrowly and protectively: it is created solely for the purpose of complying with the subsection, and it may not be created or used to consider the protected consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living. In plain terms, freezing a five-year-old does not give the five-year-old a credit history. It gives the bureaus a locked, inert placeholder that an application cannot get past.
The removal rules are just as deliberate. A freeze placed this way comes off only at the representative’s direct request, or at the protected consumer’s own request once they are no longer under sixteen, or where the bureau concludes it was placed on a material misrepresentation of fact – and in that last case the representative must be told in writing before it is lifted. When removal is properly requested it has to happen within one hour by toll-free telephone or secure electronic means, or three business days by mail, and a temporary lift for a fixed period can be requested instead. That sixteen-year threshold is also why the Commission notes that minors who are sixteen or seventeen may request and remove a freeze themselves: at that age they are no longer a protected consumer, so they simply use the ordinary freeze right in their own name.
Proof of authority, including for children in care
The statute is specific about what establishes authority to act, and it is broader than most people assume: a court order, a lawfully executed and valid power of attorney, a document from a federal, state or local government agency showing proof of parentage including a birth certificate, or – for a child placed in a foster care setting – a written communication from a county welfare department or a county probation department, or their agent or designee, certifying that the child is in a foster care setting under its jurisdiction. Proof of identification can be the child’s Social Security number or a copy of the card, a certified or official copy of the birth certificate, or a driver’s license or other government-issued identification. That foster care route exists because children in care are among the most exposed people in this entire subject, and it is worth knowing about by anybody working alongside them.
Finally, the same section requires the Federal Trade Commission to maintain a single webpage linking to each bureau’s freeze page within the Commission’s identity theft site, which is also where a report of child identity theft is filed. That report is the document everything else in a repair runs on, so it is worth filing early and keeping.
Where this usually starts
Six ways people arrive at this subject. Two of them are not fraud at all, and working out which one you are in comes before anything else.
A preapproved credit offer arrives for your eight-year-old
Mailing lists are noisy and this alone is not proof of anything. It is, however, a free reason to run the manual search, and the search costs you only the paperwork.
A benefit claim comes back saying the number is already in use
This is the version the Commission lists first among the serious signs. Ask the agency in writing what it is matching against, and start the bureau searches the same week.
A tax return is rejected as already filed
An electronically filed return bouncing as a duplicate is one of the non-credit consequences the Federal Reserve names. Follow the Internal Revenue Service’s own identity theft process, which is separate from the credit repair.
A relative’s number turns up in a data breach notice
Exposure is not use. Treat it as a prompt to freeze rather than as evidence that anything has happened, and keep the notice, because it dates your awareness.
An estate is being administered and mail keeps arriving
Statements addressed to somebody who died, for accounts nobody recognizes, are worth reporting rather than discarding. An executor has standing that a stranger does not.
You suspect somebody in the household
Read the boundaries section before you do anything at all. This is the situation where a wrong move does the most harm, and it is the one we handle most carefully.
Four steps, in an order that is not arbitrary
Search first, then lock, then report, then repair. Reversing the first two costs you nothing; reversing the last two costs you the documents the repair needs.
Ask all three bureaus for a manual search
Not an online report request, which keys off a file that already exists. A manual search on the number, sent to Experian, Equifax and TransUnion, with the identification and proof documents the Commission lists.
Place the protected-consumer freeze
Free, and available whether or not a file turns up, because the statute makes the bureau create a locked record when there is nothing to freeze. One business day by phone or secure electronic means.
File the report with the Federal Trade Commission
Do this before you start arguing with anybody. It is the document the disputes and the account closures are built on, and reconstructing it later is far harder than filing it now.
Close the accounts and clear the file
Contact each company’s fraud department, ask for written confirmation that the child is not responsible, and ask each bureau to remove the fraudulent accounts. Keep every letter and every date.
What we do here, and what we will not touch
On this subject in particular, the limits are the useful part. A firm that promised more would be describing something you should not buy.
Our work on a file like this is documentary and unglamorous. We establish which legal entity actually sits behind a brand on a statement so a letter reaches somebody who has to answer it; we find the specified address a written demand has to go to; we confirm from public sources whether a mailing address is a residence, a registered mail-receiving business, or a commercial unit, which frequently settles an argument on its own; we assemble a dated log of what was sent, to whom, and what came back. That is public-records research, we are good at it, and none of it requires identifying a human being.
Every engagement begins with a lawful purpose stated and written down before anyone opens a database. If the stated reason does not survive a plain reading, or if it changes once we ask a second question, the file does not open. That rule costs us work every month and it is not negotiable.
We are not licensed private investigators and we have never presented ourselves as any. Nobody on this team holds that license. What we are is a skip tracing and public records research firm, so surveillance, interviewing a suspect, and the rest of the licensed-investigator toolkit sit outside both what we do and what this page recommends anyone do. If your matter needs those things it needs a licensed investigator or a police agency, and we will say so rather than improvise.
We do not pretext, in any form. Nobody here telephones a bureau, a lender or an agency claiming to be you, claiming to be your child’s guardian, or claiming to be anyone else, to talk a representative into releasing something. Impersonation is the mechanism of the fraud described on this page; answering it with more impersonation would be both unlawful and obscene. For the same reason we do not obtain account balances, statements, transaction histories, application contents, call detail records or device location. None of that is a public record; none of it is ours to have; and a firm advertising it is advertising a crime with a price list attached.
Under the Fair Credit Reporting Act, this firm is not a consumer reporting agency and our work product is not a consumer report. This page walks straight through covered ground – credit files, tradelines, disputes – so that boundary has to be stated without softening. Nothing we hand you may be used, in any part, to decide anybody’s eligibility for credit or insurance, for a job, for housing or tenancy, or for a government license or benefit. Those calls belong with a provider the Act regulates, because that regime is what carries the accuracy duty, the adverse-action notice and the dispute rights a decision about somebody’s credit has to arrive wrapped in. Read from the other end, every remedy described above – the manual search, the freeze, the dispute – is a right the same Act hands you over your own file. The restriction on us and the rights for you are one design decision seen from two sides.
Attribution is the one thing we refuse outright. We will not name the operator of a manufactured file, and we will not do the intermediate work that would let a client name one: no tracing an application’s mailing address back to whoever lives at it, no attaching a telephone number or an email account to a human being, no discreet inquiry into who might have handled a birth certificate. That is a refusal, not a limitation of skill. The predictable end of that research, handed to a frightened parent, is a confrontation with somebody who did nothing, and a false accusation cannot be withdrawn. Attribution in these cases belongs to law enforcement, which can compel records that nobody else can lawfully see.
Where safety is in play, this page changes shape. A request framed as identity fraud is sometimes an attempt to find a person who left – the number of a former partner, the school district of a child who moved, the current address of somebody who is deliberately unlisted. We decline that work outright, and no amount of documentation converts it into something we will take. A request that names a person who has moved away from the requester gets more scrutiny at intake, not less, and we would rather refuse ten legitimate clients than help once. If you are the person being looked for, note something the Social Security Administration publishes in its own answers on this subject: it will assign a different number in narrowly defined situations, which include a victim of identity theft who continues to be disadvantaged by the original number, and situations of harassment, abuse or life endangerment including domestic violence. A domestic violence advocate or a victim-witness coordinator can help you time that alongside a freeze, and that sequencing is worth getting right before anything is filed.
Everything here is general information about federal law and published agency guidance as they read today, not legal advice about your circumstances, and reading it creates no professional relationship. Agency practice, forms and deadlines change; your own state may give you more than the federal floor described here. If money has already been lost, if a collector has sued, or if a child’s benefit has been refused, talk to a consumer-protection attorney and bring these documents with you. Where a case needs the underlying entity and address research done properly first, that is the part we take on.
Who asks us about this
Six starting points, one deliverable, and the same refusal to hand anybody a suspect.
Parents checking a minor’s file
Chasing a search that came back odd
Guardians and conservators
Acting for a protected person
Foster-care caseworkers
Using the county certification route
Estate representatives
Mail arriving for someone who died
Consumer-rights counsel
Assembling a record for a claim
Adults after a breach notice
Working out whether to act or wait
What arrives at the end is the same in all six: the correct entity, the correct address, a set of requests that will not be refused on a technicality, and a dated log an attorney or an agency can pick up cold. If you also want to know which commercial databases already hold a copy of the exposed details, that is a separate exercise we describe in auditing what the data brokers have on file about you.
The first thing we do is try to talk you out of it
Most people who write to us about a manufactured identity need three free steps and no researcher: the manual search, the freeze, the report. We will tell you that, in writing, and point you at the agency pages that do it, before we quote for anything. Paid work starts only where an entity has to be identified or an address has to be proved, and if we think the answer will come back empty we will say so first rather than bill you to find out.
Questions people ask before they call
What is a synthetic identity, exactly?
A combination of real information with fictional information, assembled into an applicant who does not exist. The Federal Reserve’s July 2019 statement gives the standard formulation: real information such as a legitimate Social Security number, joined to a made-up name, address or date of birth. The operator builds up the file’s creditworthiness over time and then busts out, buying high-value goods and services on credit and vanishing. Because there was never a person, there is limited recourse in tracing anyone or holding them to the debt, and that is what separates this from ordinary identity theft.
Can I tell from a Social Security number where or when it was issued?
Not for anybody enumerated since June 25, 2011. The Social Security Administration randomized assignment on that date, and it says plainly that this eliminated the geographical significance of the first three digits and eliminated the significance of the highest group number, leaving the High Group List frozen in time and useful only for numbers issued before the changeover. Between 1972 and 2011 the first three digits did reflect a state, determined by the ZIP code on the application – not a birthplace. What still works is format: area numbers 000, 666 and 900 to 999 are never assigned, and group 00 and serial 0000 remain invalid.
Why would my credit report show a stranger’s name?
Because a bureau matches incoming records on identifiers, not on people. When your number is submitted alongside an invented name, the record has to land somewhere, and sometimes it lands on your file as an alias, a variant spelling or a former name you have never used. Seeing an unfamiliar name is a reason to dispute and to ask the bureau what record produced it, and it is a reason to file the Federal Trade Commission report so the dispute has documentation behind it. It is not, on its own, proof that anybody has borrowed money in your name.
How do I check whether my child has a credit report?
Contact all three nationwide bureaus – Experian, Equifax and TransUnion – and ask each for a manual search on the child’s Social Security number. The Federal Trade Commission’s guidance is explicit that this is the check to run, because a child under eighteen generally will not have a file at all. Be ready to send your own government-issued identification, proof of your address such as a utility bill or a credit card or insurance statement, the child’s birth certificate and the child’s Social Security card. If you are not the parent, expect to add proof of guardianship.
My child is under 16. How do I freeze credit that does not exist yet?
The statute anticipated exactly that. Under subsection (j) of section 1681c-1 of the Fair Credit Reporting Act, a bureau receiving a valid request for a protected consumer who has no file must create a record so the freeze has something to attach to. That record is created solely to comply with the provision, and the Act forbids it being created or used to consider the child’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living. The freeze is free, and it has to be placed within one business day of a request made by toll-free telephone or secure electronic means.
Are children the only people whose numbers get used this way?
No. Any number that generates no contradiction when it is used works the same way, which is why the numbers of people who have died are also attractive – nobody is monitoring them and no statement is being read. Adults with genuinely thin files, people who have spent long periods outside the country, and people who simply do not borrow are exposed for the same underlying reason. The Social Security Administration does not reassign numbers to new holders, so an unused number stays quietly available rather than colliding with a legitimate new owner.
Can you find out who built the identity?
No, and we decline to try. That answer would require attributing an address, a telephone number or an application to a specific household, and the realistic outcome of handing that to an alarmed client is an accusation against somebody who did nothing. There is no way to withdraw one of those. Attribution here belongs with law enforcement, which can compel records nobody else may lawfully see. What we will do is make sure the entities, addresses and documents are right, so that the agency receiving your report is looking at something it can actually work.
What does this cost me beyond credit?
More than most people expect. The Federal Reserve’s own statement lists denial of disability benefits, rejection of tax returns and inaccuracies in health records among the consequences, alongside the time-consuming job of correcting a credit report. Each of those runs through a different agency with its own process, so a single manufactured identity can generate three or four separate repairs that do not talk to each other. That is the practical argument for freezing early: prevention here is dramatically cheaper than remediation.
Send us the letter and we will tell you what it really is
A denial notice, a collector’s demand, a statement addressed to a child, a breach letter you cannot interpret. We will tell you whether it points at a manufactured file or at something far more ordinary, and which of the free steps to take first. If there is nothing here worth paying for, a researcher will tell you that within 24 hours and you will have lost nothing.
Have the paperwork read
