Child Identity Theft: Protection, Detection, and Parental Action
Child identity theft involves the fraudulent use of a minor's Social Security number or other personal identifiers to open credit accounts, obtain government benefits, or commit financial fraud — often remaining undetected for years until the child attempts to use credit as an adult. This page covers the definitional scope of child identity theft under federal regulatory frameworks, the mechanisms through which it operates, the scenarios in which it most commonly occurs, and the decision boundaries that distinguish parental monitoring obligations from professional service intervention. The identity theft providers provider network structures the professional service landscape that addresses these cases.
Definition and scope
Child identity theft is classified by the Federal Trade Commission (FTC) as a distinct subcategory of identity theft in which the victim is a minor under 18 years of age. Because children typically have no credit history and no reason to check credit reports, fraudulent accounts opened in their names can accumulate derogatory history for a decade or more without detection.
The primary identifier at risk is the child's Social Security number (SSN), issued by the Social Security Administration (SSA) at birth or upon application. Under the Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., consumers — including parents acting on behalf of minor children — have the right to request credit reports, dispute fraudulent accounts, and place fraud alerts or security freezes. The Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 extended the right to place free security freezes to all consumers, including minors, by amending the FCRA directly.
The scope of child identity theft encompasses:
- Credit fraud: Opening credit cards, auto loans, or mortgages using the child's SSN
- Benefits fraud: Filing for government assistance programs, tax refunds, or Medicaid using the child's identity
- Synthetic identity fraud: Combining the child's real SSN with a fabricated name and date of birth to create a fictitious consumer file
- Employment fraud: Using the child's SSN for employment authorization, creating IRS tax liability tied to the child's record
The identity theft provider network purpose and scope page outlines how professional services addressing each of these subcategories are classified within the national provider network structure.
How it works
Child identity theft typically follows a lifecycle with four discrete phases:
- Acquisition: The perpetrator obtains the child's SSN through data breaches, healthcare records exposure, school system compromises, family member access, or purchase of stolen data on criminal marketplaces.
- Exploitation: The SSN — often associated with no existing credit file — is used to apply for credit products, government benefits, or employment. Credit bureaus generate a new file, which lenders may approve without recognizing the applicant is a minor.
- Dormancy: Because the child has no legitimate credit activity, no statements or collections notices reach the family. The fraudulent accounts age, accumulate balances or derogatory marks, and may be sold to collection agencies.
- Discovery: Detection typically occurs when the minor applies for a student loan, a first credit card, a driver's license-linked product, or employment — and encounters a damaged or unfamiliar credit history. The FTC's IdentityTheft.gov platform provides a structured recovery process at that point.
The Consumer Financial Protection Bureau (CFPB) notes that synthetic identity fraud — which heavily exploits children's SSNs — is among the fastest-growing forms of financial crime because the fabricated profile is not tied to a real person who might notice or report the fraud.
Parents and guardians can request a manual credit file search from each of the three major credit reporting agencies (Equifax, Experian, TransUnion) on behalf of a minor. Under the FCRA as amended, if a file exists, a security freeze can be placed at no cost. If no file exists, parents can request that a freeze be created and applied proactively — a practice the CFPB and FTC both recommend.
Common scenarios
Child identity theft occurs across three primary contexts, each with different source actors and risk profiles:
Familial (Familiar) Identity Theft: A parent, grandparent, or other family member uses the child's SSN for personal financial gain. The FTC identifies familiar fraud as a particularly complex recovery scenario because the victim may be reluctant to file a police report or dispute accounts that benefit a household member. Recovery often requires involvement from a nonprofit credit counselor certified by the National Foundation for Credit Counseling (NFCC) or a licensed attorney.
Third-Party Data Breach: Healthcare providers, school districts, and government agencies hold SSNs for minors and represent high-value targets. The Health Insurance Portability and Accountability Act (HIPAA), administered by the HHS Office for Civil Rights (OCR), requires covered entities to notify affected individuals — including minors through their guardians — within 60 days of a confirmed breach (45 C.F.R. § 164.404).
Synthetic Identity Construction: Criminal networks specifically target SSNs assigned to newborns and young children because the numbers have no existing credit history. The resulting synthetic file may be used for years before generating a dispute or flag.
The distinction between familial and third-party fraud is operationally significant: familial fraud typically requires law enforcement coordination and legal documentation, while third-party breach-related fraud follows a standard dispute-and-freeze workflow.
Decision boundaries
The threshold for parental action versus professional service engagement depends on the nature and scale of the compromise:
Proactive freeze (no fraud detected): Any parent or guardian can place a security freeze on a minor's credit file at all three major bureaus at no cost under the FCRA. This is a routine preventive action requiring no professional intermediary. The how to use this identity theft resource page describes how to navigate services in this category.
Disputed fraudulent accounts: When fraudulent accounts are confirmed in a child's name, the FCRA dispute process applies. Parents acting as authorized representatives file disputes directly with credit bureaus and with creditors. The FTC's IdentityTheft.gov generates a customized recovery plan and pre-filled letters for this process.
Familial fraud with legal complexity: Cases involving a family member as the perpetrator, tax liability tied to fraudulent employment records, or law enforcement documentation requirements typically warrant engagement with a licensed attorney or a federally recognized identity theft advocacy organization.
IRS tax identity theft: If the child's SSN has been used to file fraudulent tax returns, the IRS Identity Protection Specialized Unit (IRS IP Unit) handles resolution through Form 14039, the Identity Theft Affidavit. Tax-related child identity theft is a separate track from credit bureau resolution and requires independent remediation steps.
The operational boundary between self-directed recovery and professional service intervention is defined primarily by: (1) whether a family member is implicated, (2) whether tax records are compromised, and (3) whether the minor has reached 18 and is attempting to use credit — at which point the urgency and complexity of remediation increases substantially.