Your SSN never expires, so don't send it anywhere it can sit for years. That rules out the two ways most people send it: a normal email and a text message. Here is what to do instead, and what to do if it's already out.
Is it safe to send your SSN over email?
No, not in a normal email. The IRS says plainly that "standard email is not encrypted", and the FTC tells businesses that regular email "is not a secure method for sending sensitive data" and to caution staff against emailing Social Security numbers. Gmail encrypts mail while it travels when the other provider supports it (TLS), but Google notes that TLS does not protect email while it is stored on a server. Your number then sits in your Sent folder and in their inbox, in every backup, for as long as nobody deletes it.
If you must use email, keep the number out of the subject line (the IRS points out that even encrypted email doesn't encrypt the subject) and out of the body. Put a one-time link in the email instead.
Is it safe to text your SSN?
Not by SMS. Apple and Google both say SMS and MMS messages are not end-to-end encrypted. iMessage is, and so are RCS chats in Google Messages when both people use Google Messages with RCS chats on and a lock shows. Even then, the number stays on both phones and in their backups, so ask the other person to delete it once they've copied it, and delete your own copy.
What is the best way to send a Social Security number?
From best to acceptable:
| Way to send it | Where your SSN ends up | Use it when |
|---|---|---|
| The requester's secure portal | Only in the system that needs it | An employer, bank, lender or tax preparer has one |
| A phone call you place | Not in any message | You looked the number up yourself, not from the message asking |
| In person | Not in any message | It's a local office, bank branch or HR desk |
| A link that opens once | On the recipient's screen once, then the link stops working | Nothing above is possible and they need it in writing |
| End-to-end encrypted chat (iMessage, RCS with a lock) | Both phones, until deleted | You know the person and will both delete it |
| Plain email or SMS | Both inboxes or phones, plus backups | Never |
For the IRS itself, use your IRS online account, or the Document Upload Tool when a notice or letter asks for documents, not plain email.
Who actually needs your SSN?
Before you send it anywhere, do what SSA suggests: ask why the number is needed, how it will be used, and what happens if you don't provide it. A real employer, bank or tax preparer will have an answer. The SSA's inspector general adds one simple rule: don't share your SSN with anyone who contacts you first, however routine the request sounds.
How to spot an SSN scam
- Social Security will never ask for sensitive information through social media, email or text message.
- Real SSA staff never threaten to suspend your SSN, and never demand gift cards, crypto, wire transfers or cash (SSA OIG).
- The IRS doesn't make first contact by email or social media. A letter or notice comes first.
- The IRS will never ask for your Identity Protection PIN. Calls, emails or texts asking for it are scams.
Already sent your SSN by email or text? What to do now
- Ask the recipient to delete the message, then delete yours from Sent and Trash.
- Freeze your credit at Equifax, Experian and TransUnion. The FTC says a freeze costs nothing to place or lift, doesn't affect your score, and lasts until you lift it. You have to contact all three.
- Or add a fraud alert instead: it lasts one year and can be renewed, and the bureau you contact tells the other two. An extended alert lasts seven years but needs an FTC identity theft report or a police report.
- Get an IRS Identity Protection PIN. Anyone with an SSN or ITIN who can verify their identity is eligible, and a new PIN is generated each year (IRS).
- With a myE-Verify account, turn on Self Lock, which helps stop anyone else using your SSN for an E-Verify job check. Unlock it before you start a job with an employer that uses E-Verify.
- Check your credit reports. All three bureaus now let you check each report once a week for free, permanently, through AnnualCreditReport.com.
- If you see a loan, card or job you don't recognise, report it at IdentityTheft.gov for a recovery plan (FTC).
Don't count on a new number. The FTC says you can't get a new Social Security number without evidence that someone is already misusing yours.
Where NO SUS fits
When the person asking has no portal and needs the number in writing, a Burn Note on nosus.foo turns it into a link that opens once. The note is encrypted in your browser, the key travels in the part of the link after the #, which browsers don't send to our server, and neither of you needs an account. Send the link by email or chat and tell them on a call that it's coming, so they open it soon and tell you straight away if it doesn't open.
What a one-time link does not do
- It doesn't check who opens it: whoever has the link first gets the number.
- It can't stop the recipient from copying the number into their own email or notes.
- If you ask for a 6-digit code instead of a link, the key is held on our server until up to 10 minutes after the code is used or expires.
For passwords and other secrets, see how to send a password securely, or make one right now with our one-time link generator.