A new federal law gives Social Security 180 days to get ready to assign one point of contact to anyone whose Social Security number has been misused. President Trump signed H.R. 5345 on October 7, 2026, and the bill says it takes effect 180 days after enactment, which puts the start date at April 5, 2027. Until that Monday, people with a stolen or misused number still work through whichever Social Security employees answer the phone. From then on, the agency must keep one contact, which can be a trained team, on each case until it is resolved.
Affiliate links — we may earn a commission.
The wait until April 5, 2027
The six months before April 5 belong to people with an open case today. Someone whose number was used to claim benefits, alter an earnings file or force a request for a replacement number is still on the agency’s current process, with no named contact. The bill sets the start at 180 days after enactment, counted from the October 7 signing, and Social Security has not said how it plans to staff the new team or how many employees will be assigned to it.
Data breaches are the background to the bill. A House Ways and Means summary counts more than 3,158 reported data breaches in 2024, with more than 1,800 of them involving Social Security numbers and roughly 1.3 billion breach notices sent to victims. One step open now is shrinking what brokers hold: Incogni sends removal requests to data brokers and people-search sites on a person’s behalf and keeps re-sending them.
The final text of the Improving Social Security’s Service to Victims of Identity Theft Act covers four situations. The first is a number used to fraudulently obtain benefits under Titles II, VIII or XVI of the Social Security Act, which include retirement, survivor and disability benefits and Supplemental Security Income. The others are misuse that affects the person’s records at the agency, a case that leads the person to request a new number, and a card lost in transmission to the person.
What Social Security has to build
The Commissioner of Social Security must set up procedures so that each eligible person has a “single point of contact at the Social Security Administration throughout the resolution of the individual’s case.” That contact must track the case to completion and coordinate with other units to resolve problems as quickly as possible. The contact does not have to be one person. The text allows a team or subset of specially trained employees who stay accountable for the case until it is resolved.
Staff on a case can change. Membership of the team may shift to meet the agency’s needs, but only if procedures keep the records and case history continuous, and the person is notified when appropriate if the team changes. That is the only notice duty in the bill. It carries no reporting requirement to Congress, and its only standard on speed is that issues be resolved as quickly as possible, so the test after April 5 will be how Social Security staffs the team.
Rep. Kustoff, the Tennessee Republican who sponsored the bill, built the case on how slow the current process is. The Ways and Means summary says resolving a lost or stolen number can take a long time and is often complicated. Victims may go through several processes and speak with different Social Security employees who often give conflicting information, and the delay gives fraudsters more time to misuse the number.
Steps open to victims before the contact exists
Social Security’s own identity-theft publication points victims to IdentityTheft.gov, the Federal Trade Commission site that builds a recovery plan, or to 1-877-438-4338 by phone. For tax-related misuse it lists the IRS Identity Protection page and 1-800-908-4490. It also advises reporting cybercrime to the FBI’s Internet Crime Complaint Center, checking credit reports periodically through the free annual report site, and telling Social Security if someone used the number for work so earnings can be reviewed.
A new number is the last resort in that publication. Social Security says it may assign one only after the person has done all they can to fix the problems and someone is still using the original number. A card that was lost or stolen, with no evidence anyone is using the number, generally does not qualify. The agency also warns that a new number is not a clean slate, since credit bureaus and other agencies still hold the old number and other personal details.
Opening a case with Social Security now
Until April 5, 2027, the route is the existing one: a my Social Security account and the identity-theft and stolen-number pages on Social Security’s website, plus the agency’s toll-free line. Anyone with a case under way can keep the date, the name or employee ID of each Social Security employee reached and any reference number. The law’s promise of continuity applies only once the team exists, so those notes are the only history a victim controls before then.
The first test comes on April 5, 2027, when a victim of a number theft is supposed to be handed to a team that stays with the case, a change aimed at the conflicting answers the Ways and Means summary describes. With more than 1,800 number-exposing breaches counted in 2024 alone, the caseload is large, and the bill leaves staffing, training and the size of the team to the Commissioner.
More than 1,800 breaches in 2024 involved Social Security numbers
The new contact helps sort out a case after a number is misused, but it does not take personal details off the lists data brokers keep. Incogni asks data brokers and people-search sites to remove personal information, sends removal requests on a person’s behalf and keeps re-sending them.
Ask data brokers to remove your personal details with Incogni →
This article was researched and drafted with the assistance of AI and reviewed by The Money Overview editorial team.
