Child Identity Theft: Prevention and Response

Child identity theft is a distinct and particularly damaging form of identity fraud in which a minor's Social Security number (SSN) and personal information are exploited to open credit accounts, obtain loans, file fraudulent tax returns, or establish utility services — often going undetected for years because minors do not routinely check credit files. This page covers the regulatory framework governing child identity theft in the United States, the mechanisms by which it occurs, the primary scenarios in which it is perpetrated, and the decision boundaries that separate preventive monitoring from active recovery response. The Federal Trade Commission (FTC) and the Consumer Financial Protection Bureau (CFPB) are the primary federal agencies structuring available remedies and reporting channels.

Definition and scope

Child identity theft, as framed by the FTC's IdentityTheft.gov infrastructure, occurs when a person other than the minor uses that child's identifying information — most critically the SSN — to obtain financial benefit or evade legal consequence. Because credit bureaus do not automatically maintain credit files for individuals under 18, a child's SSN exists in a clean state that fraudsters treat as a blank ledger. Detection gaps routinely extend 5 to 10 years, meaning the fraud is frequently discovered only when the victim applies for a first student loan, apartment lease, or driver's license.

The statutory backbone governing remediation is the Fair Credit Reporting Act, 15 U.S.C. § 1681, which grants parents or legal guardians the right to request a manual search of a minor's credit file and to place a protected consumer freeze on that file. The CFPB administers rules under 12 C.F.R. Part 1022 that require credit reporting agencies (CRAs) — Equifax, Experian, and TransUnion — to honor freeze requests for minors under 16. Per the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 (Pub. L. 115-174), all three major CRAs must allow a guardian to create and freeze a child's credit file even if no file previously existed.

The Identity Theft Resource Center (ITRC), a named public-sector reference organization, distinguishes child identity theft from synthetic identity fraud on the basis of SSN use: child identity theft typically pairs a real child's SSN with the child's own name, whereas synthetic identity fraud pairs a real SSN — frequently a child's — with a fabricated name and birthdate.

How it works

The exploitation mechanism follows a predictable sequence that exploits the dormancy of a minor's identity record:

1. SSN acquisition — The perpetrator obtains the minor's SSN through a data breach, insider access to institutional records (healthcare, school enrollment, government benefits), family member access, or purchase on dark-web markets where SSNs from pediatric health records appear for sale.
2. File creation or hijacking — If no credit file exists, the SSN is submitted on a credit application; the CRA's system creates a new file linked to the SSN, sometimes associated with a fabricated identity (the synthetic variant).
3. Account proliferation — Credit cards, auto loans, apartment leases, and utility accounts are opened. Because the child is not monitoring any credit file, delinquencies accumulate without generating alerts to the actual minor or guardians.
4. Tax fraud variant — The perpetrator files a federal tax return under the child's SSN to claim fraudulent refunds. The IRS Identity Protection PIN (IP PIN) program covers dependents and can be used to block unauthorized tax filings using a child's SSN.
5. Government benefits fraud — The SSN is used to claim Medicaid, SNAP, or Social Security benefits. The Social Security Administration (SSA) operates a fraud reporting channel specifically for SSN misuse.

The latency between perpetration and discovery is the defining structural feature. The FTC's Consumer Sentinel Network has recorded child identity theft as a distinct complaint category; the 2022 Consumer Sentinel Network Data Book documents identity theft as the single largest complaint category in the FTC's database for multiple consecutive years.

Common scenarios

Child identity theft clusters around four primary perpetration contexts:

Familiar fraud — A parent, stepparent, grandparent, or other household adult uses the child's SSN to obtain utilities, credit, or housing after their own credit history has been damaged. This variant is disproportionately common relative to stranger-perpetrated fraud and complicates recovery because the victim may be reluctant to file a police report against a family member.

Institutional data breach — Pediatric hospitals, school districts, and government benefit programs maintain SSNs for children and are targeted specifically because pediatric records carry clean SSNs. Healthcare data breaches are regulated under HIPAA, 45 C.F.R. Parts 160 and 164, and affected families must receive breach notification under the HIPAA Breach Notification Rule.

Synthetic identity fraud using a child's SSN — The perpetrator pairs the child's SSN with a fictitious name, date of birth, and address. This variant is harder to detect because the child's actual name does not appear on derogatory credit tradelines; it surfaces only through SSA earnings records or IRS filing conflicts.

Deceased child identity theft ("ghosting") — SSNs of deceased minors are harvested from public death records or obituaries and used before the SSA's Death Master File is updated — a process that can lag weeks to months.

Decision boundaries

The distinction between preventive action and active recovery response is operationally significant and determines which remediation pathways apply:

Prevention threshold — No confirmed fraud has occurred. The appropriate action is placing a protected consumer credit freeze with all three major CRAs under the authority of Pub. L. 115-174. An IRS IP PIN for the dependent child is an additional preventive layer. The FTC's IdentityTheft.gov platform provides the procedural framework for requesting a minor's credit file check.

Active theft threshold — A fraudulent account, tax filing, or benefits claim has been confirmed. This triggers a distinct set of steps: filing an identity theft report with the FTC via IdentityTheft.gov, filing a police report with local law enforcement (required by some CRAs to process dispute letters for minors), disputing fraudulent tradelines directly with the CRA under 15 U.S.C. § 1681i, and notifying the SSA and IRS if SSN misuse is confirmed.

The contrast between familiar fraud and stranger fraud also creates a decision boundary at the police report stage. Familiar fraud recovery may require guardians to navigate protective order processes or consult with a victim advocate before the minor reaches the age of majority — at which point the now-adult victim retains independent legal standing to pursue all FCRA remedies without a guardian's involvement.

The identity protection providers on this domain catalog service providers and agencies organized by recovery function, including CRA dispute services and fraud resolution specialists. The page defines the classification standards applied to those providers. For navigational guidance on using this reference resource, the how-to-use-this-identity-protection-resource page outlines the organizational logic of the provider network.