How thieves steal children’s identities and why kids are the perfect target

A thief holding your child’s Social Security number probably has no intention of pretending to be your child. They’re busy creating a whole new person.

They take a real number, attach a made-up name and birthdate, and assemble a person who has never existed. They then use that “person” to apply for credit, which starts building a credit history. Your child’s name is usually not attached to this persona, no alert reaches you, no statement looks wrong, and the first time you find out about it might be 18 years later.

The crime has a name, a method, and a specific reason thieves prefer children. Here’s how it works, and why the protection families get offered after the breach doesn’t touch it.

Why kids are the perfect target for thieves

“My kid has nothing worth stealing”

Most parents believe this, and thieves rely on this attitude to go unchecked for a decade or more.

Diane Sacks has spent 25 years in identity theft protection and now runs Parencor, where she focuses on safeguarding heirs from silent fraud. She hears the objection all the time, and she says the logic runs backward.

The real prize isn’t the number itself; it’s that it’s clean. “They want a clean, untouched SSN with no history attached and no credit activity to raise suspicion... that blank slate is the entire prize because a child’s number comes with years of silence,” explains Diane Sacks.

Where thieves get the number

The largest exposure of children’s data on record happened in late December 2024, when attackers used one stolen contractor credential on a PowerSchool support portal that had no multi-factor authentication. An estimated 62 million students and roughly 9.5 million teachers were affected, and fewer than a quarter of affected students had a Social Security number in the exposed data, which still puts the number in the millions.

Schools are the biggest collector of children’s data, but not the only one. These all ask for your child’s Social Security number and keep it on file:

• Pediatric offices

• Insurers

• Camps

• Sports leagues

Our guide to checking your child's credit report covers the full list.

How the fraud actually works

The crime built on it is called synthetic identity fraud, and the Federal Reserve breaks it into four steps.

• Step 1: The thief pairs a real, unused SSN with invented details. Your child’s name never appears anywhere.

• Step 2: They apply for credit and get rejected, because no file exists yet for the fake person.

• Step 3: The rejection creates a credit file. The credit bureaus now hold a record for someone who was never born, with the stolen SSN.

• Step 4: The identity grows up. Small accounts, paid on time, build a history that looks ordinary to the lender.

A clean number is what makes it work. Nothing on file contradicts the invented person, because there’s nothing on file. Social Security numbers have also been issued at random since 2011, so a lender can no longer tell from the number that it belongs to a young child.

Why child identity theft is hard to catch

Adult fraud trips something. A strange charge, a declined card, a statement that looks wrong. Child fraud trips nothing at all, and the gap between the two is wider than most parents expect.

Compare child and adult identity fraud

The Social Security Administration does issue new numbers but calls those cases rare. A victim has to show they’ve already tried to fix the damage and are still being harmed by the original number.

Even then, SSA warns that a new number won’t guarantee a fresh start, because banks, credit bureaus, and government agencies all keep records under the old one. It can also backfire. A number carrying no credit history at all is harder to borrow against, which is the same problem the child started with.

Meanwhile there’s nothing to monitor.

• A child who has never applied for credit has no record at the bureaus, which means no baseline, no activity, and nothing for a monitoring service to compare against.

• The same emptiness that makes the number valuable to a thief is what leaves the family blind.

Thieves wait until the monitoring stops

PowerSchool paid roughly $2.85 million in bitcoin for assurance that the stolen data be deleted. Five months later, the same attacker was demanding money directly from school districts in the US and Canada, attaching real student records from the December breach as proof.

The ransom was paid, and the data was still in circulation.

The stretch between when data is stolen and when it gets used is the whole problem, and Sacks says thieves treat it as a feature:

Standard breach response gives families one or two years of credit and dark web monitoring. For a child, that rests on two assumptions that don’t hold:

• Dark web scansconfirm damage already done. By the time a child’s information shows up for sale, the number is already compromised.

• Credit monitoring has to be set up for a child specifically. A minor can’t be enrolled the way an adult is, because the standard identity check runs against a credit file the child doesn’t have. Child monitoring is a separate product, and a parent has to go looking for it.

What this looks like in practice:

One of Sacks’s clients had both of her children’s Social Security numbers stolen in a school ransomware attack four years ago. This year, her tax return bounced, because someone else had already claimed her kids as dependents.

Four years of silence, and then a consequence from a direction nobody was watching.

How can I protect my child’s identity from thieves?

There are two moves you can make, and neither one depends on anybody noticing the fraud.

1. Freeze the number

Unfortunately, credit bureaus do not have the authority to freeze SSNs, but a freeze with the three major bureaus locks the file so no new credit can be opened against it by anyone, no matter how many databases hold it or which one gets breached next.

Federal law makes freezing for minors free. Our step-by-step walkthrough covers the forms and documents each bureau requires.

The request also serves as a check. Before a credit bureau creates the protected record, it searches for an existing file, and a child who already has one has almost certainly been victimized. The earlier you initiate a freeze, the smaller the window the thief has to work in.

2. Cover what the freeze can’t reach

A freeze blocks new credit, but that’s all it blocks. Every use that skips a credit application stays open.

• Tax refunds: Someone claims your child as a dependent on their taxes or files a return in your child’s name, which is exactly what hit Sacks’s client.

• Employment: Someone works under your child’s number and the income is reported to the IRS.

• Medical care: Treatment gets billed to your child’s identity and lands in their records.

• Government benefits: Someone claims benefits your child is entitled to, like SSI.

Protection that doesn’t stop watching

Most of those fraudulent activities leave traces somewhere outside a credit file, and that’s where monitoring built for families, like Greenlight Family Shield, comes in. It watches those other places, continuously scanning the dark web for your family’s personal information, including kids’ names, emails, and Social Security numbers, with identity theft protection coverage of up to $1 million for every member of the family.¹

Protect your family’s valuable information with real-time alerts on suspicious activity across accounts linked to kids’ identities with Greenlight Family Shield².

FAQs

What is synthetic identity fraud?

A thief pairs a real Social Security number with a made-up name and birthdate to build a person who doesn’t exist, then opens credit in that person’s name. Your child’s name never appears, so no alert ever reaches you.

How would I know if my child’s number was stolen?

Usually you wouldn’t. The number can sit in a breached database for years before anyone uses it, and a child has no credit activity to look wrong in the meantime. Checking their credit report is the only reliable way to find out.

Can my child get a new Social Security number?

In rare cases. The SSA wants proof you’ve already tried to fix the damage and the original number is still causing harm, and it warns that a new number won’t guarantee a fresh start, since banks and credit bureaus keep records under the old one.

Does a credit freeze stop synthetic identity fraud?

It stops the part that runs through a credit application, which is most of it. It won’t stop someone using the number for a tax refund, a job, medical care, or government benefits.

My child’s school was breached and offered free monitoring. Is that enough?

Usually not. Breach response tends to run one or two years, while your child’s exposure runs until they turn 18. Thieves know the difference and wait out the window.

¹Insurance offered by Acrisure, LLC is provided by ACE American Insurance Company and its U.S.-based Chubb underwriting company affiliates. www.chubb.com. Additional details can be viewed here. See link for policy information. Insurance Products are not insured by the FDIC or any federal government agency and are not a deposit or other obligation of, or guaranteed by, any bank or bank affiliate.

²Premium monitoring services are offered by Array.