By Steven C. Fraser, Esq. | FL Bar No. 625825 | DC Bar No. 460026
A Social Security number is the one number that unlocks the other three things a person cannot easily replace: retirement and disability benefits, credit, and the tax account. That is why it is the top target. Javelin Strategy and Research's 2025 Identity Fraud Study put combined identity fraud and scam losses at $47 billion in 2024. Behind that figure are two scenarios I see in practice, and both are now addressed by a short federal law.
The first scenario: someone uses your number to apply for Social Security benefits in your name, or to redirect benefits you already receive. You find out when a notice arrives about a claim you never filed, a direct deposit change you never made, or an overpayment you never received.
The second scenario: you request a replacement Social Security card and it never arrives. A card lost in the mail is a card in someone else's hands, and the agency's answer until now has been to issue another one and hope.
What Congress passed
H.R. 5345, the Improving Social Security's Service to Victims of Identity Theft Act, was introduced by Representative David Kustoff of Tennessee on September 15, 2025, passed the House on December 1, 2025, passed the Senate in September 2026, and was signed by the President on October 7, 2026. The enrolled text is on GovInfo.
The statute adds a new Section 714 to Title VII of the Social Security Act. It directs the Commissioner of Social Security to establish procedures so that a covered individual gets a single point of contact at the agency for the life of the case.
Who is covered. Anyone whose Social Security number has been misused, including misuse to fraudulently obtain benefits under Title II (retirement, survivors, and disability), Title VIII (special veterans benefits), or Title XVI (Supplemental Security Income); anyone whose SSA records were affected by misuse; anyone who requests a new number because of misuse; and anyone whose Social Security card was lost in transmission to them.
What the point of contact is. Not one named employee. The law describes a team, or a subset of specially trained employees, and it allows the membership to change as the agency needs. What may not change is continuity: the agency must keep the records and case history intact across the team, and must notify the victim of changes when appropriate.
What the team must do. Coordinate with other units inside SSA to resolve the problem, track the case to completion, and remain accountable for it until it is resolved. The operative phrase is that the contact stays with the individual throughout the resolution of the case.
When it starts. The section takes effect 180 days after enactment, which puts it in early April 2027. The law sets no separate deadline for the Commissioner to publish the procedures and contains no reporting requirement to Congress.
What the law does not do
This is the part worth saying plainly, because the title promises more than the text delivers.
The law does not recover a dollar. If someone drew benefits in your name, Section 714 gives you a team to work with on correcting the record. It does not create a claim for restitution, a damages remedy, or a faster path to repayment of anything you lost elsewhere.
The law does not punish the thief. There is no criminal provision in it. Identity theft remains a federal crime under existing law and a state felony in Florida under section 817.568 of the Florida Statutes and in the District of Columbia under D.C. Code section 22-3227.02, but prosecution is a decision for law enforcement, not for SSA.
The law does not touch your credit or your taxes. The IRS and the three national credit bureaus are separate systems with separate procedures, and the new SSA team has no authority over either.
Recovery, in other words, is still built the way it was before, and the center of it is the Federal Trade Commission's site at identitytheft.gov.
The recovery plan that still has to be done
If your number has been misused, the order of operations has not changed.
File a report at identitytheft.gov. The FTC's report is the document the rest of the system runs on. It generates a written recovery plan, it serves as the identity theft report the credit bureaus require, and it can route a Form 14039 Identity Theft Affidavit to the IRS when the theft reached your tax account.
Freeze your credit at all three bureaus. Under 15 U.S.C. section 1681c-1(i), a security freeze is free, and the bureau must place it within one business day of an online request or three business days of a mailed one. Florida's own freeze statute, section 501.005, and the District's, D.C. Code section 28-3862, remain on the books but federal law now makes the freeze free for everyone.
Block the fraudulent accounts. Under 15 U.S.C. section 1681c-2, once you send a bureau proof of identity, your identity theft report, a list of the entries that are not yours, and a statement that you did not make those transactions, the bureau must block that information within four business days. This is the step that removes a thief's debts from your report without disputing them one at a time.
Report to Social Security. Report benefits fraud to the SSA Office of the Inspector General through its online form, review your earnings record through a my Social Security account, and ask SSA in writing to block automated telephone and online access to your record if you do not use those services. SSA issues a new number only in limited cases, after you show the number is still being misused and the other steps have not stopped it. Once Section 714 is in force, this is the request that should get you a named team.
Protect the tax account. Request an Identity Protection PIN through your IRS online account. File and pay on time as usual. If the IRS writes to you about a return you did not file, answer the letter in writing, by the method the letter specifies, and keep the certified mail receipt.
Put everything in writing. Every agency and every creditor should hear from you by letter or through its own secure online form, and every letter should go by certified mail with a copy kept. A case that lives in phone calls is a case with no record.
Why a single point of contact matters anyway
None of that criticism makes the law pointless. The most common complaint I hear from identity theft victims is not that the law is against them. It is that nobody owns the file. Each call starts over, each letter goes to a different unit, and the case stalls between offices that each believe another office has it. A team that must track the case to completion, with continuity of records written into the statute, is a direct answer to that complaint. It is a small law, and it is the right small law.
The test will be the procedures the Commissioner writes between now and April. When they appear, I will write about them here.
Sources: H.R. 5345, 119th Congress, enrolled text (GovInfo); White House statement on bills signed into law, October 7, 2026; 15 U.S.C. sections 1681c-1 and 1681c-2; Fla. Stat. sections 501.005 and 817.568; D.C. Code sections 22-3227.02 and 28-3862; IRS Taxpayer Guide to Identity Theft; Javelin Strategy and Research, 2025 Identity Fraud Study.
Steven C. Fraser is admitted in the District of Columbia (1998) and Florida (2003) and practices in bankruptcy, tax controversy, consumer protection, probate, and related litigation. This article summarizes a public law and published agency guidance. It is not legal advice and it is not an opinion on any particular case.