A Social Security number is the closest thing most Americans have to a master key. It opens credit files, tax records, bank accounts, and medical files. When it ends up in someone else's hands, the damage rarely arrives all at once. It surfaces months later as a collection call, a rejected loan, or a tax return you never filed.

There is a sequence to this, though. Do the high-impact moves first, keep a record of everything, and a frightening situation turns into a manageable project. Here is the checklist, in the order that matters most.

1. Freeze your credit at all three bureaus

A credit freeze is the fastest way to stop new accounts from being opened in your name. It blocks lenders and other creditors from pulling your file, so most fraudulent applications die at the starting line. It does not touch your existing accounts, and it does not lower your credit score.

You have to freeze each bureau separately — Equifax, Experian, and TransUnion — and the freeze is free by law. Do it online, then save the confirmation numbers and the PIN or password each bureau issues for lifting the freeze later. Store them somewhere you will still find them in two years.

Freeze or fraud alert?

A freeze is the stronger tool. A fraud alert asks businesses to verify your identity before granting credit; a standard alert lasts a year, and an extended alert can last seven years when it is supported by an identity theft report. Plenty of people do both. Neither one stops a fraudulent tax return or a bogus medical claim, so keep reading.

2. File the two reports that give you leverage

Banks, creditors, and debt collectors respond to paperwork. Two documents carry the most weight:

1. The FTC identity theft report. Go to IdentityTheft.gov and work through the guided interview. You get a personal recovery plan and an official report you can download and hand to creditors, insurers, and police.
2. A police report. File with your local department, bringing your ID, the FTC report, and any letters or statements connected to the fraud. Ask for the report number and a copy. If the front desk seems unsure how to handle it, ask for the officer who works financial crimes. You are not wasting their time; a police report is often what unlocks stronger protections.

Together these are usually called an identity theft report, and they are the reason a bank stops arguing with you. If a creditor or collector keeps insisting you owe a debt from a fraudulent account, those documents are your evidence — and in the United States, the Fair Credit Reporting Act gives you the right to dispute inaccurate information. If a collector sues you or refuses to correct your file, that is the moment to talk to a consumer attorney.

3. Protect your tax identity before filing season

Refund fraud is popular because it is quick and hard to reverse. If someone files a return using your number, your legitimate return gets rejected and the refund you are owed gets held up for months.

Request an Identity Protection PIN from the IRS. This six-digit code must accompany your return, and without it a fraudster's filing is far more likely to fail. Once you have one, you need it every year, so keep it somewhere safe.

If a return has already been filed in your name, submit the IRS identity theft affidavit, Form 14039, along with the guidance the IRS provides, and follow up by phone. Expect verification letters and delays. This is one place where paying a tax professional is genuinely worth it — bring them every notice you receive.

4. Sweep your bank, benefits, and medical accounts

Credit files do not cover everything. Work through the accounts a freeze cannot protect:

• Bank and deposit accounts. Notify your bank, close anything you did not open, and ask about screening reports such as ChexSystems, which banks use to decide who gets an account. Many of these files can be frozen or flagged.
• Investment and retirement accounts. Confirm your contact details, look for transfers you did not authorize, and ask whether the firm offers a verbal password or extra verification.
• Unemployment and public benefits. A fraudulent benefits claim is often the first clue. Contact your state unemployment agency and any other benefits office and report it.
• Health insurance and medical records. Request a claims history from your insurer and read it for services you never received. You also have the right to request your medical records and ask for corrections to be noted.

While you are in each account, turn on transaction alerts. A text or email when a charge posts is a cheap early-warning system.

5. Check your Social Security record and replace what was lost

Sign in to your my Social Security account and review your earnings record. If an employer you never worked for shows up, someone may be using your number to work. Report that to the Social Security Administration. The same account lets you confirm your benefit estimates and catch changes you did not make.

You should also know what the SSA will and will not do. It rarely issues a brand-new number, and generally not simply because yours was exposed — a new number would not erase the old one from credit and government records anyway. If your card was lost or stolen, request a replacement, keeping in mind that limits apply to how often you can do that. Then stop carrying the card in your wallet.

6. Lock down the accounts you still control

Most follow-up fraud comes from weak account security rather than the number itself. Close those doors now:

• Use a password manager and give every important account a unique password.
• Turn on two-factor authentication, and prefer an authenticator app or a hardware key over text messages.
• Update the recovery email and phone number on your email, bank, and mobile accounts. An abandoned address is a back door.
• Ask your mobile carrier to add a port-out PIN or account lock so nobody can hijack your phone number.
• Opt out of the data broker sites that publish your name, address, and relatives. It is tedious work, but it shrinks the raw material available to anyone trying again.

Your first month, then the long tail

In the first week or two, freeze your credit, file your reports, notify your bank, and change your passwords. Over the following months, pull your credit reports and read them line by line, watch statements as they arrive, and file your taxes early each year so a fraudulent return cannot beat you to it. A freeze stays in place until you lift it, but fraud alerts expire — put a reminder on your calendar.

Keep one folder, digital or paper, with every report number, letter, and contact name. That folder is what turns a confusing mess into a case you can prove. And if the volume of paperwork starts to feel overwhelming, you do not have to handle it alone: the FTC's identity theft resources walk you through each step, and a consumer attorney or tax professional can take over the parts that carry legal or financial consequences.

Photo: stevepb / Pixabay