What does a thirteen-year-old need with a platinum credit line and a rewards program better than the one in my own wallet?
I didn't have an answer right away. The envelope showed up addressed to my son by his full name — thick card stock, a bank logo, an offer of credit no legitimate lender should extend to a kid with no job and no bank account (he's thirteen — his biggest financial decision most weeks is whether to spend allowance on skins for a video game). I'd just shredded the last page of my 2022 fraud folder the week before, the one holding my dad's phone-scam paperwork and my own gas-pump card dispute, and slid the empty binder back onto the shelf feeling like we were finally done. This letter meant we weren't. It also meant I was about to learn more than I ever wanted to about synthetic identity theft, credit freezes for kids who don't have credit yet, and how much of catching this falls squarely on parents, since nobody else is watching for it.
A kid that age isn't supposed to have a credit file at all, and that gap is exactly what makes this kind of fraud work. Spotting it early and freezing the file before it grows any further turned out to be the only real defense I found — getting there just took longer than I expected.
Why a Child's Social Security Number Is the Perfect Blank Slate for Synthetic Fraud
Traditional identity theft is someone pretending to be you, using your real name and history to make charges you'll eventually spot on a statement. Synthetic fraud is stranger and slower. A thief takes a real nine-digit number — almost always a child's, because nobody's watching it — and stitches it to a made-up name, address, and birthdate. That fabricated person can spend years quietly building a credit history, a small loan here, a paid-off balance there, long before anyone notices. The Social Security Administration stopped tying those numbers to geography a while back, which sounds like a privacy win right up until you realize it also means a made-up identity blends in exactly as easily as a real one does.
His Social Security number had probably been sitting exposed in some data breach since before he could tie his own shoes — none of us ever finds out how ours got out until it's already being used somewhere. Nobody checks a kid's credit because everybody assumes there's nothing to check.
Can You Freeze a Credit File That Isn't Supposed to Exist Yet?
My first instinct was to call my own bank's fraud line, since that's who I'd worked with after somebody cloned my card at the Shell station on Providence Road and ran up a furniture bill I never authorized — I still check the card reader out of habit every time I fill up there, wiggling it before I swipe anything. Forty-seven minutes on hold later, I hung up without ever talking to a person. Banks can freeze a card. They have no authority over a credit file, especially not one that isn't supposed to exist yet.
There's a longer piece already on this site about locking down our own accounts, Why I Froze Our Credit Twice: A Practical Guide to the Three Bureaus, but freezing a file for a minor is a different animal entirely. Once you know it exists, the process itself isn't complicated: ask each of the three bureaus to check for a file under your child's Social Security number, and if none turns up, ask them to open one and freeze it on the spot so nobody else can. If a file does turn up, the way ours did, that's your proof something's already gone wrong.
Six weeks after I mailed copies of his birth certificate and Social Security card to all three bureaus, the confirmation letters started coming back one at a time, each on its own schedule, each bureau clearly working through paperwork at its own pace. Somewhere in that stack was confirmation that a person in another state, different name, different address, had been quietly attached to my son's number for longer than I wanted to think about.
The Gap No Credit Freeze Closes
A frozen credit file stops someone from opening a bank account or a credit card in your kid's name, but it does nothing about medical records. A reader named Simeon wrote to me once after his mother discovered a stranger had used her Medicare number at a clinic in another state — he's the kind of person who logs every fraud call he makes with the date, the rep's name, and how it ended, which tells you something about how long that kind of mess actually takes to untangle. A synthetic identity built on a child's number can slip into the healthcare system the exact same way, through a clinic that never runs a credit check before treating someone, and a freeze has no jurisdiction there at all. Monitoring services can flag some of this after the fact, insurance can reimburse part of the cleanup cost, and restoration services will grind through the paperwork for you, but none of those three things undoes years of fabricated history already sitting in a file somewhere. Scrubbing his name off the data broker sites that resell kids' information felt like a reasonable next step too, even though it wouldn't have stopped a synthetic file that already existed before I got around to it.
My friend Marguerite, who's spent enough years in mortgage lending to distrust anything that sounds too clean, put it best when I told her about the letter — nobody selling a monitoring service is going to volunteer what it can't catch. She's right. Every company in this space leans on words like "guaranteed" and "complete coverage," and every one of them has a gap somewhere. Mine turned out to be medical records I hadn't thought to check.
Turning the Binder Into an Actual System
The checklist that finally stuck is taped to the whiteboard above the desk in our spare bedroom, right next to the shredder that lives on the floor by the printer: check whether a file exists under his number, open and freeze one if it doesn't, and treat any mail addressed to him from a bank, a collections agency, or a clinic he's never visited as something to file, not toss. I filed a report through the FTC's identity theft site for good measure, and the confirmation form came off the printer smelling like warm toner, same as every other form I've fed through that machine since 2022. A fraud alert would have been the easier move (it only asks lenders to double-check before opening anything), but a freeze is the version that actually locks the door — and for a kid with no accounts to protect yet, locking the door felt like the only version worth doing. The one account of his I locked down immediately wasn't a bank account, since he doesn't have one. It was the email tied to his school login, because that's the single credential a thief could use down the line to reset almost everything else.
Whether Is LifeLock for Kids Necessary to Prevent Child Identity Theft? is even the right question is something I've gone back and forth on. Paid monitoring is good at telling you something's wrong after the fact, and dark web alerts in particular are built for adults whose numbers get resold on some marketplace, which isn't usually how a kid's number surfaces first. Whether it makes more sense to bundle every layer of protection under one subscription or buy each piece separately is its own math problem I haven't fully worked out for our household yet. There's a longer list of things I keep half an eye on for him that this particular letter wasn't about: a SIM swap on a phone he doesn't have yet, a cloned voice pulling off the kind of scam that fooled my dad in the first place, a fraudulent tax return filed under a number that's supposed to belong to a minor, a VPN that would protect his Wi-Fi traffic but do nothing for a credit file that already exists in his name. Different problems, different fixes, and most of them are still years off for him.
Don't Wait for the Letter
My son is still thirteen, still more interested in video games than bank accounts, and he still has no idea any of this happened — some things a parent just handles quietly. The binder I'd emptied out from 2022 has a new tab in it now, but this time I didn't wait years for a scare to grow before I found it. That's the one thing I'd pass along to anyone starting this today: don't wait for the letter. Call the three bureaus and ask them to check for a file before you ever see a piece of mail that shouldn't exist, because by the time a fake platinum offer lands in your mailbox, the fraud usually already has a head start of several years. Nobody in this industry can promise you'll never get that letter. What you can do — what I did, slowly, with a stack of birth certificate copies and far too much time spent on hold — is make sure that when it comes, there's already a locked door waiting on the other side.