What Is Employment Identity Theft? Signs, Risks, and How to Recover

Most people are familiar with credit fraud or tax identity theft. The idea that someone could quietly be working under your Social Security number is far less recognized, and that is precisely what makes employment identity theft, also known as employment-related identity theft, so difficult to detect. Victims often have no idea anything is wrong until an unexpected IRS notice arrives or a review of their Social Security earnings record reveals wages from an employer they have never heard of.

Employment identity theft occurs when someone uses your Social Security number or other personally identifiable information to obtain a job, earn wages, or establish work authorization under your identity. The person using your identity may be trying to circumvent a background check, avoid child support obligations, or work without legal authorization. The victim may not discover the fraud until an unexpected tax notice or Social Security earnings discrepancy surfaces the problem.

This form of identity theft is underrecognized relative to its actual scope. According to the ITRC’s 2026 Trends in Identity Report, fraudulent employment represented approximately 5 percent of all identity misuse cases reported to the ITRC during the reporting period. For minors, that figure rises substantially, underscoring the urgency of awareness without overstating the everyday risk.

This guide explains what employment identity theft is, how it differs from related crimes, who is most at risk, and exactly what to do if you believe your Social Security number is being used for employment. The Identity Theft Resource Center has provided free, expert support to identity theft victims for more than 25 years, and no one should have to navigate this alone.

How is Employment Identity Theft Different from Tax Identity Theft and Unemployment Fraud?

These three categories of identity-related crime are frequently confused. They share a common thread: someone misusing another person’s identity for financial gain. But they differ meaningfully in how the fraud works, where it originates, and what a victim needs to do to resolve it. Understanding the distinction matters, because the reporting and recovery process is different for each.

Crime Type	Primary Goal	Key Downstream Effect
Employment Identity Theft	Obtain a job and earn wages under another person’s identity	Fraudulent wages reported to the IRS and SSA; potential tax liability for income you never earned
Tax Identity Theft	File a fraudulent tax return and claim a refund before the victim can file	Rejected tax return; delayed refund; IRS account complications
Unemployment Fraud	Collect government unemployment benefits under another person’s identity	Unexpected Form 1099-G for benefits not received; state unemployment account complications

Employment identity theft originates in the workplace. Someone uses your SSN to get a job and earn wages under your identity. The downstream effects include fraudulent wages reported to the IRS and Social Security Administration under your Social Security number, potential tax liability for income you never received, and inaccuracies in your earnings record that can affect future benefit calculations.

Tax identity theft does not involve an employer. A fraudster uses your SSN to file a tax return and claim a refund before you file your own. Employment identity theft can create tax complications as a downstream effect, which is why the two are frequently confused. The fraud itself, however, originates in hiring, not tax filing.

Unemployment fraud involves filing for unemployment benefits using someone else’s identity, typically following a data breach. No employer is involved and no wages are reported. Victims often discover the fraud when they receive an IRS Form 1099-G for benefits they never claimed.

How Employment Identity Theft Happens

Employment identity thieves need enough personal information to pass an employment verification process. That information reaches fraudsters through several common routes.

Data Breaches

The most common source of the personal information used in employment fraud. When a company storing employee or customer data is breached, names, dates of birth, Social Security numbers, and addresses can be exposed in bulk. Victims typically have no knowledge the breach occurred until months or years later, by which point their SSN may already be in use. The ITRC documented a record 3,322 data compromises in its 2025 Annual Data Breach Report, underscoring how widespread breach exposure has become.

Phishing and Fake Job Postings

Criminals post fraudulent job listings or pose as recruiters to solicit sensitive information from applicants. A job seeker who submits their SSN, date of birth, and address as part of a fake onboarding process has provided a fraudster with everything needed to apply for employment under their identity. This method disproportionately targets recent graduates and active job seekers, who are accustomed to sharing personal information during hiring.

Document Theft

A stolen wallet, intercepted mail, or a lost Social Security card provides physical access to identity documents that can support a fraudulent employment application. Government correspondence, including tax notices and benefit letters, is also targeted. Physical document theft is less common than digital compromise but remains a meaningful risk.

Insider Theft

Employees with authorized access to HR systems, payroll records, or employee databases sometimes misuse that access to steal coworker or applicant information. Insider theft can be harder to detect than external breaches and may go unreported for longer periods.

Data Brokers and Public Records

Criminals supplement partial identifying information with publicly available data from people-search sites, social media, and data broker databases. Names, addresses, prior employers, and phone numbers aggregated from public sources can make a fraudulent employment application appear more credible. Fraudsters often pair a compromised SSN with biographical details gathered this way to strengthen a fraudulent identity package.

Warning Signs of Employment Identity Theft

Employment identity theft is particularly difficult to detect because it does not generate a direct financial impact on the victim’s own accounts. The fraud shows up elsewhere: in tax records, government benefit calculations, and employer filings. These are the indicators to watch for.

Tax and IRS Signals

• Your tax return is rejected because one has already been filed under your SSN. A rejected return may indicate tax identity theft rather than employment fraud, and the distinction matters for how you respond.
• You receive an IRS CP01E notice, which indicates your SSN may have been used for employment purposes by someone else.
• You receive a W-2 or other tax form from an employer you have never worked for.
• The IRS sends a CP2000 notice proposing additional tax owed for wages you did not earn.

Social Security and Benefits Signals

• Your Social Security earnings record shows wages from employers you have not worked for. You can review your earnings history at no cost by creating an account at SSA.gov.
• Your Social Security benefit calculation appears adjusted in ways you cannot account for.
• You receive unemployment benefit correspondence or a Form 1099-G for benefits you never claimed.

Employment and Background Check Signals

• A background check reveals employment history you do not recognize.
• A prospective employer flags discrepancies in your work history.

If you recognize any of these warning signs, contact the ITRC before attempting to navigate government reporting processes on your own. An ITRC advisor can help you understand what happened and identify the right steps for your specific situation.

Who is at Highest Risk of Employment Identity Theft

Most people assume employment identity theft affects only adults who are actively working. The ITRC’s data tells a more complicated story.

Adults with Broad Data Breach Exposure

Anyone whose SSN has been exposed in a data breach is at elevated risk. Given the record number of data compromises documented in recent years, this category now encompasses a substantial portion of the American public. Many people do not know their information was exposed until they are already dealing with the consequences.

Active Job Seekers

Individuals who have recently applied for jobs, particularly through online job boards, have shared their personal information with multiple entities, increasing the number of potential exposure points. Fake job posting scams specifically target this group, soliciting SSNs and other identifying details under the guise of legitimate onboarding paperwork.

Minors and Children

This is the most underrecognized high-risk group. According to the ITRC’s 2026 Trends in Identity Report, fraudulent employment accounted for 40 percent of identity misuse cases involving minors reported to the ITRC. Children’s Social Security numbers are attractive to fraudsters because they typically go unmonitored for years. No one routinely checks a child’s SSA earnings record, which means fraud can persist undetected until the child reaches adulthood and applies for a first job, student loan, or apartment.

Parents and guardians can check a minor’s Social Security earnings record by contacting the SSA directly. If fraudulent wages appear, the ITRC can help families understand what to do next.

What To Do If You Are a Victim of Employment Identity Theft

If you have received an IRS CP01E notice, a W-2 from an unknown employer, or another signal that your SSN is being used for employment, the following steps can help limit further damage and create the documentation trail you will need for resolution. Acting quickly matters.

1. Contact the ITRC for Free Guidance. The Identity Theft Resource Center provides no-cost, live support from expert advisors who can help you assess what happened and build a recovery plan. Call 888.400.5530, or use our live chat.
2. Respond to Any IRS Notices Promptly. If you received an IRS CP01E notice, follow the instructions on the notice. Do not ignore it. The notice indicates the IRS has flagged your account, but there may be steps required to prevent further complications. If you received a CP2000 notice for wages you did not earn, contact the IRS immediately at the number on the notice to dispute the proposed assessment.
3. Get an IRS Identity Protection PIN. An IP PIN is a six-digit number that helps verify your identity when you file your federal tax return. Once enrolled, no one can file a federal return using your SSN without the PIN. You will need to update the IP PIN each year at the IRS website.
4. Check and Correct Your Social Security Earnings Record. Review your earnings history at SSA.gov. If you see wages from employers you did not work for, contact the SSA to report the discrepancy and request a correction. Errors left unaddressed can affect your future Social Security benefit calculations.
5. File a Report with the FTC. Report employment identity theft at IdentityTheft.gov and download an ID Theft affidavit. It may also be required by creditors, employers, or law enforcement during your recovery.
6. Place Credit Freeze. Even if the immediate damage is in your tax and employment records rather than your financial accounts, a credit freeze at the three major credit bureaus (Equifax, Experian, or TransUnion) limits the risk of additional fraud. Fraudsters who obtain an SSN for employment purposes often use it for other types of fraud as well.
7. Document Everything. Keep records of every notice, form, correspondence, and step you take. This documentation will be required for disputes with the IRS, SSA, current or former employers, and law enforcement.

How To Help Protect Against Employment Identity Theft

No protective measure is a guarantee, but these habits meaningfully reduce your exposure.

• Monitor your Social Security earnings record annually. Create a free account at SSA.gov and review your earnings history each year. Wages you do not recognize are often the earliest indicator of employment fraud.
• Enroll in E-Verify Self Lock. You do not need to be a victim to use this feature. Locking your SSN in E-Verify prevents participating employers from hiring someone under your identity.
• Get an IRS IP PIN. Available to all U.S. taxpayers, the IP PIN adds a verification layer to your federal return that prevents fraudulent filing. [Verify current availability and enrollment process before publication.]
• Be cautious with job applications. Verify that job postings are legitimate before submitting your SSN or other personal information. Fake job scams are a direct pipeline to employment identity fraud.
• Limit your personal information exposure. Remove your personal information from data brokers and people-search sites where possible. Limit what you post on social media to only people you know and trust. Employment identity thieves often combine a compromised SSN with publicly available details to make fraudulent applications appear credible.
• Use multi-factor authentication on government and financial accounts. Your SSA.gov account, IRS account, and financial accounts all benefit from multi-factor authentication, particularly as unauthorized device access continues to rise as a compromise method.

Contact the ITRC for Free Guidance

Employment identity theft is a disorienting crime because it operates quietly, in systems most people rarely monitor. Victims are often blindsided by an IRS notice or a government letter, and the path to resolution involves multiple agencies, forms, and timelines that can feel overwhelming without guidance.

No one should navigate this alone. Whether you are responding to an unexpected notice or simply want to understand your risk, the ITRC is here. Call 888.400.5530 for free, confidential support from expert advisors.

Frequently Asked Questions About Employment Identity Theft

What is employment identity theft?

Employment identity theft occurs when someone uses your Social Security number or other personally identifiable information to obtain a job, earn wages, or establish work authorization under your identity. Victims typically discover the fraud through an unexpected IRS notice, an unfamiliar W-2, or discrepancies in their Social Security earnings record.

How is employment identity theft different from tax identity theft?

Tax identity theft involves filing a fraudulent tax return to claim a refund. Employment identity theft involves using someone’s SSN to work and earn wages, not to file a tax return. However, employment identity theft often creates tax complications as a downstream effect, which is why the two are frequently confused.

What is an IRS CP01E notice?

An IRS CP01E notice is sent when the IRS detects that your Social Security number may have been used for employment purposes by someone else. It does not necessarily mean your tax account has been affected, but it signals that your SSN is being misused and that you should take protective action, including getting an IRS IP PIN and contacting the SSA to review your earnings record.

Can a child be a victim of employment identity theft?

Yes. According to the ITRC’s 2026 Trends in Identity Report, fraudulent employment accounted for 40 percent of identity misuse cases involving minors in the ITRC’s dataset. Children’s SSNs are often used for years before the fraud is discovered because no one routinely monitors a minor’s Social Security earnings record.

What should I do first if I think my SSN is being used for employment?

Contact the Identity Theft Resource Center (ITRC) at 888.400.5530 for free, expert guidance. An ITRC advisor can help you assess what happened, respond appropriately to any IRS or SSA notices, and build a recovery plan, at no cost to you.

Will employment identity theft affect my credit?

Not directly. Employment identity theft primarily affects tax records and Social Security earnings history rather than credit accounts. However, fraudsters who have your SSN for employment purposes often use it for other fraud as well, which can affect credit. Placing a credit freeze is a sensible step even when the immediate damage is employment-related.