The Identity Vault

Last Updated: April 2026 · 10 min read

Most parents check their kid’s grades. Their dentist appointments. Their screen time. Almost no parent checks their kid’s credit report.

That’s exactly what identity thieves are counting on.

According to research from Experian, roughly 1 in 4 American children will become a victim of identity fraud or theft before they turn 18. Most parents won’t find out for years. They’ll discover it when their kid applies for a first credit card, college loan, or apartment lease — and gets rejected. By then, someone has been quietly using that Social Security number for years, and the damage is usually deep and expensive to undo.

This isn’t a horror story written to scare you. It’s the actual landscape. And the worst part is how solvable it is once you know what to look for. This guide walks you through what’s happening, how to check whether your child is already a victim, and the specific steps to protect them. Most of these steps you can finish in a single afternoon, for free.

Why Children Are the Perfect Target

Think about what makes a stolen identity valuable. Thieves want a clean Social Security number that nobody is watching. They want it attached to a real person, so it won’t get flagged when they try to use it.

That’s a description of every child in America.

Adults check their credit. We get statements in the mail. Most of us notice when something looks off. Children don’t have credit reports being monitored, don’t get mail addressed to them, and won’t try to use their identity for anything financial until they’re 17 or 18. So a thief who steals a 6-year-old’s Social Security number has roughly a decade of clean runway. That’s plenty of time to rack up debt before anyone notices.

The Numbers Tell the Story

A landmark Carnegie Mellon CyLab study scanned the records of more than 40,000 children. Researchers found that more than 10 percent already had someone else using their Social Security number. That makes children roughly 51 times more likely than adults to be victims of identity theft. Javelin Strategy Research has tracked between 915,000 and 1.25 million child victims annually in recent years. The average affected family pays around $540 out of pocket to clean it up. And victims often spend years dealing with the aftermath.

How Thieves Get Your Child’s Information

There are four main channels. Most parents don’t realize how much they’re contributing to the problem themselves.

Data Breaches at Trusted Institutions

Schools, pediatricians, dentists, summer camps, sports leagues, and youth organizations all collect Social Security numbers and birth dates. Many store this data badly. When any one of them gets breached — and they get breached constantly — your child’s information ends up on the dark web alongside everyone else’s.

Sharenting and Social Media

This part is uncomfortable but unavoidable. A 2018 report from the Office of the Children’s Commissioner for England found that the average child has roughly 1,300 photos and videos of them shared online by age 13. Each post can contain pieces a thief assembles into a profile. Common pieces include full name, birthday, school name, sports team, pet’s name, grandparents’ names, and a clear photo of the face. Barclays has projected that by 2030, two-thirds of identity fraud committed against young adults will trace back to information their parents shared.

Family Members

This is the hardest channel to talk about. Research from Javelin and others has consistently found that the majority of child identity theft victims know their thief. A meaningful share of cases involve a parent, step-parent, or other relative. They use the child’s clean Social Security number to open accounts when their own credit is too damaged to qualify. The motivation is rarely malicious in the way a stranger’s would be. Usually it’s a parent in a financial hole, convincing themselves they’ll pay it off before the child needs their credit. They almost never do.

Synthetic Identity Fraud

Some thieves don’t steal a complete identity. Instead, they take a real Social Security number, usually a child’s because it’s unused. Then they combine it with a fabricated name and birthdate to create a synthetic person. That synthetic person applies for credit, runs up debt, and disappears. The damage attaches to the real Social Security number — your kid’s. And it won’t surface until they try to use it.

The Warning Signs Most Parents Miss

Because children don’t actively use their identity, the signs of theft are subtle and easy to dismiss. Here’s what to actually watch for:

Your child receives mail from credit card companies, collections agencies, government benefit programs, or banks. Pre-approved credit card offers addressed to a 9-year-old aren’t junk mail. They’re a sign that someone has used your child’s information to apply for credit and get added to a marketing list.

You try to open a savings account in your child’s name. The bank tells you there’s already activity, or you get a strange error.

The IRS sends a notice saying your child’s Social Security number was used on a tax return. Or you get rejected when you try to claim your child as a dependent because someone else already has.

Your child gets a call or letter about a debt, a service they didn’t sign up for, or a court matter.

A school enrollment, sports league registration, or medical appointment fails because the information doesn’t match what they have on file.

How to Check Right Now Whether It’s Already Happened

This is the most important section of this article. Almost no other parenting guide covers it properly. Most parents who worry about child identity theft don’t realize they can actually check. You can.

Request Credit Reports From All Three Major Bureaus

Equifax, Experian, and TransUnion each have a process for parents and legal guardians to request a credit report for a minor child. The process differs from a standard adult report request. You’ll need to mail in copies of your ID, your child’s birth certificate, your child’s Social Security card, and proof of address. There’s no online shortcut. The bureaus require physical mail to prevent abuse of the system. The good news: it’s free. If no credit file exists for your child, each bureau will confirm that in writing.

Check Innovis Too

Innovis is the lesser-known fourth credit bureau. Most identity protection guides skip right past it. However, Innovis allows parents and guardians to add a security freeze to a minor’s credit file regardless of what state you live in.

Search the SSA Earnings Record

Sometimes a stolen Social Security number gets used for employment fraud. If you suspect this, request a Statement of Earnings from the Social Security Administration. The statement shows whether any wages have been reported under that number. A 7-year-old with a job history is, obviously, a problem.

Check ChexSystems

ChexSystems is the database banks use to decide whether to let someone open a checking account. If a thief has used your child’s information to open or attempt to open bank accounts, it’ll show up here. Sometimes this happens even when nothing appears on credit reports.

If any of these checks turn up activity, jump to the recovery section toward the end of this article. When they all come back clean, you’re in the best possible position to keep it that way.

The Lockdown Checklist: What to Do This Weekend

This is the work that actually matters. If you do nothing else after reading this article, do these things.

Freeze Your Child’s Credit at All Four Bureaus

This is the single most powerful protection available. As of 2018, federal law makes it free in all 50 states. A credit freeze blocks anyone — including legitimate lenders — from opening new credit using your child’s information. Nobody can take out a loan, open a credit card, sign up for utilities, or apply for anything that involves a credit check. Each bureau has a separate process for freezing a minor’s credit, and you’ll need to send physical documents (the same paperwork as the credit report request). The freeze lasts until your child turns 18, at which point they can manage it themselves. It is the closest thing to a magic bullet that exists in identity protection.

Get Your Child an IRS Identity Protection PIN

The IRS issues a six-digit PIN that must be included on any tax return filed under that Social Security number. Without the PIN, the return gets rejected. This stops tax refund fraud cold, and it’s free. You can request one for any dependent you claim on your tax return.

Audit What’s Already Public

The photos and posts about your child that you put online years ago are still indexed and findable. You don’t have to delete everything. But at minimum, remove or restrict any post that combines your child’s full name, birthday, school, and a clear photo of their face. That combination is exactly what thieves need to build a profile.

Set New Rules for Future Posts

Whether the photo-sharing is yours, the grandparents’, or your child’s friends’ parents, every post adds to the public profile. The rule worth adopting: no full birthday, no school name attached to identifiable photos, no public posting of report cards, soccer team rosters, or anything else that combines identifying details. You don’t need to vanish from the internet. You just need to be deliberate.

Teach Your Kid the Basics

Once your child uses the internet — which is younger than most parents realize — they need to know one core rule. They should never share their Social Security number, full birthday, or address with anyone, ever. This includes online games and chats. So make this a recurring conversation, not a one-time lecture.

What to Do If Your Child Is Already a Victim

If your initial checks turned up active accounts or fraud, take these steps in order.

File an Identity Theft Report at IdentityTheft.gov

This is the FTC’s official reporting site. It generates a formal report you’ll need for the rest of the recovery process. The system specifically supports reporting on behalf of a minor child.

Contact the Fraud Department at Every Credit Bureau

Provide the FTC report and ask them to remove fraudulent accounts, place a fraud alert, and freeze the credit file. Each bureau has a child identity theft specialist team. Ask for them by name, because regular agents often don’t know the procedures.

Contact Each Company Where Fraudulent Accounts Were Opened

Provide the FTC report. Then request that the accounts be closed and the debt removed from your child’s record. Get written confirmation. Keep every email, every letter, every reference number.

Consider Filing a Police Report

This isn’t required. However, it strengthens your case with creditors and is necessary if the thief turns out to be someone you intend to pursue legally.

If the Thief Was a Family Member

Most articles on this topic skip this part entirely. When your investigation reveals that the perpetrator is a relative — a parent, step-parent, grandparent — you’ll face a difficult choice. You can either let them continue to damage your child’s credit, or press charges against family. There’s no clean answer, and the right choice depends on your situation. But the longer you wait, the more damage accumulates. Document everything regardless of what you decide. Your child has the right to take action themselves once they turn 18.

A Timeline for the Rest of Their Childhood

Identity protection isn’t a one-time event. Here’s what to revisit at each stage:

Birth to Age 5

Freeze credit at all four bureaus. Request the IRS IP PIN. Audit and lock down social media. Talk to extended family about photo-posting rules. Store the original Social Security card somewhere secure that isn’t a wallet.

Ages 6 to 12

Re-check credit reports annually. Have age-appropriate conversations about online privacy as your child starts using devices on their own. Watch for warning signs in mail or unexpected calls.

Ages 13 to 17

Re-check credit annually. Start involving your teen in their own protection. Show them how the freeze works, why it matters, and what they’ll need to do when they turn 18. When they get a part-time job, you’ll need to temporarily lift the freeze for employment verification, then refreeze.

Age 18

Hand off control. Walk them through unfreezing and refreezing their credit. Help them get a first legitimate credit card to start building real credit history. Set up ongoing monitoring. The protection you put in place when they were 5 is what gives them a clean slate to start adulthood with.

The Bottom Line

Child identity theft is one of those problems that’s frightening when you first learn about it and almost trivial to prevent once you take action. The protection systems already exist. Freezes are free. Getting an IRS PIN costs nothing. Credit report checks are free too. So the only reason most parents don’t do this is that nobody told them they needed to.

Now you’ve been told.

If you spend a single weekend on this work — freezing the four bureaus, requesting the IRS PIN, auditing your social media, running the initial credit checks — you’ll have done more than the vast majority of American parents. It costs nothing but a few hours of paperwork.

Your child won’t know you did it. They’ll never know what you protected them from. They’ll just turn 18 with a clean credit file and the freedom to build their adult life on a foundation that nobody else has touched.

That’s the whole point.