A credit privacy number, usually shortened to CPN, is a nine-digit number marketed as an alternative to a Social Security number on credit applications. Sellers offer a clean number and a fresh start for a few hundred to a few thousand dollars. What the buyer actually receives, in nearly every documented case, is another person’s Social Security number and a federal crime attached to the first application they submit.
The problem underneath the scam is real. The Federal Trade Commission’s congressionally mandated accuracy study found that one in five consumers had an error on at least one of their three credit reports, and that for 5% of consumers the error was serious enough to raise the price they pay for credit or insurance. The Fair Credit Reporting Act dispute process exists for exactly that situation. It has been federal law since 1970 and costs nothing but postage.
The use of a fabricated nine-digit number in place of a Social Security number on a credit application implicates several federal statutes, including 18 U.S.C. § 1028 (identification document fraud), 18 U.S.C. § 1029 (access-device fraud), 18 U.S.C. § 1344 (bank fraud), and Section 619 of the Fair Credit Reporting Act (15 U.S.C. § 1681q), which makes it a federal crime to obtain a consumer report under false pretenses.
No Federal Agency Issues a CPN, and the SSA Does Not Recognize One
The Social Security Administration issues Social Security numbers. The Internal Revenue Service issues Individual Taxpayer Identification Numbers and Employer Identification Numbers. Neither agency, and no other federal agency, issues or recognizes a credit privacy number. There is no statute creating the product, no application form, and no office that administers it.
That matters for a practical reason beyond the legal one: a number nobody issued is a number nobody can verify as yours. When a lender runs the nine digits against the Social Security Administration’s verification systems, the number either comes back as belonging to a living person who is not the applicant, or it comes back as never issued. The claim that a consumer in witness protection or an identity-theft victim receives a CPN is false in both directions. Witness protection identifiers are reissued by the Social Security Administration under specific statutory authority. Identity-theft victims get specific FCRA protections, including a Section 605B block of fraudulent information and a Section 605A fraud alert, neither of which requires a substitute number.
The Nine Digits Sold as a CPN Are Usually a Real Person’s Stolen SSN
The numbers CPN sellers distribute are not randomly generated. Most are Social Security numbers issued by the Social Security Administration that are either currently active, often belonging to children whose limited credit history makes the misuse harder to detect, recently deceased persons whose numbers appear in publicly available death-master-file data, or persons in temporary identity-protection programs. The Federal Trade Commission and the Social Security Administration’s Office of the Inspector General have documented this sourcing pattern in repeated enforcement actions.
The practical consequence is that a consumer who purchases a CPN and applies for credit using that number is, in nearly every case, committing identity theft against a real person whose Social Security number has been resold. The original person is the victim and has legal remedies against the consumer who used the number, on top of the federal criminal exposure the consumer faces directly. The Federal Trade Commission’s Consumer Sentinel Network received more than 1.1 million reports of identity theft through IdentityTheft.gov in 2024. That count covers identity theft of every kind, and the FTC does not break out how many of those reports trace to a resold CPN.
Submitting a CPN Triggers Bank Fraud and a Mandatory Two-Year Add-On Under § 1028A
Using a CPN on a credit, loan, mortgage, or rental application implicates multiple federal criminal statutes at once. Obtaining a CPN under the pretense that it is a legitimate alternative identification number can constitute fraud in the inducement. Submitting the CPN on a credit application makes a false representation to the creditor, which reaches the bank-fraud and wire-fraud statutes when the application is transmitted electronically. Using the resulting credit constitutes federal access-device fraud under 18 U.S.C. § 1029.
Federal sentencing exposure for these offenses includes substantial prison terms, typically up to thirty years for the underlying fraud, with aggravated identity theft adding a mandatory two years consecutive under 18 U.S.C. § 1028A. Restitution runs to the true holder of the misused Social Security number, and property acquired with the fraudulent credit is subject to forfeiture. The Consumer Financial Protection Bureau has separately pursued civil enforcement actions against CPN sellers, and several federal courts have held that CPN purchasers are jointly liable with sellers for the resulting harm.
One distinction worth holding onto: in Thompson v. United States (decided March 21, 2025), a unanimous Supreme Court held that 18 U.S.C. § 1014, which punishes knowingly false statements made to influence a federally insured lender, does not reach statements that are misleading but true. That ruling narrows one statute at the edges. It does nothing for a CPN, because a CPN application is not a true statement phrased awkwardly. It is a false identifier.
Concealing a Real Credit File Is the Point, and That Is the Misrepresentation
A CPN is sold as privacy. What it actually does is detach the applicant’s name from the file that carries the bankruptcies, charge-offs, collections, and late payments. The lender then prices a loan against an empty file instead of the real one.
It does sometimes work briefly. A smaller creditor that does not verify Social Security numbers against the Social Security Administration’s systems may approve the application. The temporary success changes nothing about the criminal character of the conduct. The nationwide bureaus verify identity fields against multiple sources when a file is established, which is the mechanism that surfaces the fraud. On detection, the creditor reports the fraud to the Federal Bureau of Investigation, the Secret Service, or local law enforcement. The consumer is identified through the application record, the submission IP address, the bank routing used for any funding, and the physical address used for card delivery.
The Privacy Act of 1974 Binds Federal Agencies, Not Your Bank
The Privacy Act of 1974, codified at 5 U.S.C. § 552a, restricts federal agencies from requiring disclosure of a Social Security number except where a statute requires it. It does not apply to private creditors. A bank, card issuer, mortgage lender, or landlord may require a Social Security number under federal banking statutes and IRS tax-reporting requirements. The Act gives a consumer no basis to refuse.
CPN sellers quote the federal-agency language as though it covered every institution. The misrepresentation is itself a basis for federal Fair Credit Reporting Act and consumer-protection liability against the seller. A consumer who has been told the Privacy Act permits CPN use should understand that the legal foundation of the claim was fabricated for the sale.
An EIN Is Real, and Using One on a Personal Application Is Still a Misrepresentation
An Employer Identification Number is a nine-digit federal tax identifier the IRS issues to business entities. EINs are legitimate for the business activities of corporations, partnerships, and certain other structures. Some CPN sellers claim the number being sold is an EIN. The claim is false: EINs go only to business entities and are not interchangeable with Social Security numbers on personal credit applications.
A business owner with a legitimate EIN may apply for business credit with it, and the resulting business credit history is generally separate from personal credit. Business credit is not a substitute for personal credit, and putting a business EIN on a personal application is a misrepresentation that creates liability for the applicant on its own. The EIN and CPN conflation is a variant of the same scam.
Bureau Complaint Data Shows the Scale of Files Carrying Someone Else’s Information
Recorded in the CFPB’s public Consumer Complaint Database for the twelve months from July 2025 through June 2026, of 3,482,718 complaints filed under the issue “Incorrect information on your report,” 66.9% selected “Information belongs to someone else,” 18.4% selected “Account information incorrect,” and 8.7% selected “Account status incorrect.” These are unverified consumer allegations and the Bureau does not confirm the facts alleged; complaint volume also tracks company size and filing behaviour.
When a seller resells a child’s or a deceased person’s Social Security number and a buyer opens accounts on it, the tradelines land on a file belonging to someone who never applied for anything. That person’s remedy is the block under FCRA Section 605B (15 U.S.C. § 1681c-2), which obliges the bureau to block the reporting of information the consumer identifies as resulting from identity theft within 4 business days of receiving proof of identity, an identity theft report, the identification of the information, and a statement that it does not relate to any transaction by the consumer.
Disputes, Validation and Secured Cards Are the Legal Routes, and They Are Free or Cheap
Consumers with damaged credit have several legitimate paths. The most important is the dispute process under Section 611 of the Fair Credit Reporting Act (15 U.S.C. § 1681i), which lets the consumer dispute inaccurate, incomplete, unverifiable, or too-old-to-report information. The bureau must complete a reasonable reinvestigation within the 30-day period beginning on the date it receives the dispute, extended by up to 15 additional days if the consumer supplies relevant information during those 30 days, and under Section 611(a)(5)(A) it must promptly delete or modify any item found inaccurate or incomplete or that cannot be verified. Our dispute walkthrough covers the procedure step by step.
The other routes: validation requests on collection accounts under Section 809 of the Fair Debt Collection Practices Act (15 U.S.C. § 1692g), where a consumer who disputes in writing within thirty days of receiving the validation notice obliges the collector to cease collection until it mails verification; goodwill deletion requests to original creditors; secured cards and credit-builder loans for active rebuilding, covered in our secured-card guide; and the seven-year fall-off under Section 605 of the FCRA (15 U.S.C. § 1681c), which runs from 180 days after the delinquency that preceded the collection or charge-off under Section 605(c)(1), with title 11 bankruptcy cases capped at ten years.
Report the Solicitation to the FTC and the SSA Inspector General, Then Stop
A consumer approached by a CPN seller should decline, document the seller’s contact information, and report the solicitation to the Federal Trade Commission and the Social Security Administration’s Office of the Inspector General. The Consumer Financial Protection Bureau accepts complaints about CPN solicitations through its general portal. Documentation protects the consumer if the seller later claims complicity, and it feeds the enforcement record.
Consumers who have already purchased a CPN but have not used it on an application should consult a licensed attorney before doing anything else. Federal criminal liability generally attaches at the point of use rather than purchase, so stopping short of submitting the number leaves a different exposure profile than submitting it. The specific exposure depends on the precise sequence of events, which is why this is an attorney question and not a checklist.
Sellers Keep Operating Because the Criminal Exposure Lands on the Buyer
CPN sellers earn a few hundred to a few thousand dollars per number while the criminal exposure falls on the purchaser who uses it. Sellers operate behind anonymized online infrastructure, change company names and websites frequently, and rarely meet a buyer in person. That asymmetry produces a stable scam economy in which the seller profits and the buyer carries the charge.
The Federal Trade Commission and the Consumer Financial Protection Bureau have brought enforcement actions against sellers, but new sellers form faster than cases close. The pattern of illegal advance fees and misrepresentation is familiar from adjacent enforcement: in FTC v. BoostMyScore, LLC and William O. Airy, announced March 9, 2020, the FTC charged a credit-repair operation selling authorized-user tradelines under the FTC Act, the Credit Repair Organizations Act and the Telemarketing Sales Rule, with consumers paying $325 to $4,000 or more before any service was performed. The Federal Trade Commission’s guidance on repairing credit yourself is the counterweight the sellers are competing against.
A CPN-Affected File Needs the Bureau Fraud Department and a Lawyer
If a CPN has been used and the resulting tradelines were reported under the CPN rather than the consumer’s true Social Security number, the resulting file may exist as a fragmented file that the bureau does not associate with the consumer’s real identity. Disentangling it generally requires direct contact with each bureau’s fraud-resolution department, full documentation of true identity, and a sworn statement of the facts.
The procedure is complex, the consumer’s federal criminal exposure may complicate the disclosure, and the bureau is under no obligation to merge a fraud-affected file back into the legitimate one. We work the true Social Security number and the real file. We cannot and do not work with CPNs, other substitute nine-digit numbers, or files created under a fraudulent identity, and anyone in that position should see a licensed consumer-protection or criminal-defense attorney before engaging any credit tool.
State Identity-Misuse Statutes Stack on Top of the Federal Charges
Several states have enacted statutes targeting the use of another person’s identifying information as a distinct offense. California Penal Code Section 530.5, Texas Penal Code Section 32.51, and comparable provisions in roughly two dozen other states make it a state crime to use another person’s personal identifying information without consent to obtain credit, goods, or services. A CPN transaction that resells a real person’s Social Security number falls squarely inside those statutes.
State enforcement runs in addition to federal enforcement, and resolving a state matter does not clear the federal exposure. Several states have also enacted civil-remedy provisions letting the true holder of a misused Social Security number recover damages directly from the person who used it, separately from any prosecution.
What to Do If You Used a CPN
Gather the applications that used the CPN, any denial notices and your credit reports. Those records help establish what number you submitted and what information was reported before you seek a correction.
Consumers who used a CPN in the past and want to clear the resulting application history should consult a licensed attorney about the disclosure path. Our guide on identity theft and credit reports covers the mirror-image situation, where the consumer is the victim rather than the user of misappropriated identification. The procedural mechanics overlap in places; the legal exposures differ.
Three Checks That Separate a Lawful Credit-Repair Service From a CPN Seller
Legitimate credit-repair services operate inside the Credit Repair Organizations Act, codified at 15 U.S.C. §§ 1679 through 1679j, which requires a written contract, a three-day cancellation window, no payment before services are performed, and a prohibition on advising consumers to make false statements to bureaus or creditors. Any service offering to create a new credit identity, selling CPNs or other substitute identification numbers, or recommending false statements on applications is outside federal consumer-protection law.
Three checks. First, a written contract carrying the CROA disclosures, including the three-day cancellation right. Second, no advance-payment requirement, because CROA bars payment before services are performed. Third, no reference anywhere to CPNs, EINs used as Social Security number substitutes, or new credit files. A lawful service works your true Social Security number and the file you already have.
Compare the Tools That Work Your Real Credit File
Every product below works the consumer’s true Social Security number and the file attached to it. None of them creates a new identity, and none of them can, because the FCRA dispute process is the only lawful route to changing what a report says. The choice turns on how much of the tedious part you want to do yourself, how much you want to pay for it, and whether the tool reaches all three bureaus or only one.
| Tool | What you pay | What that buys on a damaged file | Bureaus | Trustpilot |
|---|---|---|---|---|
| CreditRefresh | $49.99/mo, no setup fee, cancel anytime. Mail letters yourself free, or pay RushMail per letter | A scan that flags items as inaccurate, incomplete, unverifiable or too old to report, then drafts an FCRA letter for each one you choose to challenge | All three | 4.3 (9 reviews) |
| Dispute Beast | From $49.99/mo for required monitoring. Mail letters yourself free, or pay Sprint Mail per letter | AI-generated dispute rounds bundled with monitoring; our founder cites a training session to learn the tool | All three | 4.2 (2,067 reviews) |
| DisputeBee | $49/mo personal, $129/mo business | Letter templates and a suggester; you import the report, print, mail, and log responses yourself | All three | 3.2 (68 reviews) |
| The Credit People | $99/mo standard, $119/mo premium, or $599 for 6 months | A done-for-you service that works the case for you, with a dashboard rather than the letters themselves | All three | 1.7 (17 reviews) |
| Lexington Law | $139.95/mo, invoiced at the end of each service period | An attorney-backed firm that handles the file; you do not see or approve individual letters | All three | 3.2 (624 reviews) |
| Credit Karma | Free, paid for by lender referrals | Free monitoring and score tracking, with a direct-dispute path limited to TransUnion | TransUnion | 1.1 (912 reviews) |
Every price is that company’s own published rate, read off that company’s own site on September 15, 2026. Trustpilot scores and review counts as published on September 24, 2026.
Credit Karma’s Direct Dispute path reaches TransUnion. Eduardo F, in a 1-star Trustpilot review of Credit Karma dated September 14, 2026, wrote about its approval odds for new applications: “Credit Karma gets people to apply for loans or credit cards with outstanding approval odds which I believe to be a complete lie. So they make me hurt your credit score with hard inquiries, when in actuality you have 0 approval odds, not outstanding.”
What CreditRefresh Does With a Real File
We scan all three bureau reports, Equifax, Experian and TransUnion, through the monitoring partner, and flag every item that looks inaccurate, incomplete, unverifiable, or too old to be reported. Then we draft a print-ready FCRA dispute letter for each item you choose to challenge. Members bring us real workload: in our September 18, 2026 member-data extract, 97.7% of paying members carry at least one negative tradeline entry, the average member carries 30 across the bureaus with a median of 25, and mailed dispute rounds average 23.6 disputed bureau-level items. The same account can appear at more than one bureau, and a negative entry is not automatically inaccurate or disputable.
In that same extract, 2.3% of disputed bureau-level items in mailed rounds had a recorded outcome. Within that subset, 47.9% were no longer reported on a newer pull of the same bureau, while 52.1% remained reported with a changed balance, status or negative flag. Bureaus decide dispute outcomes, and we never promise a removal or a score result.
Price is $49.99 a month, included with Refresh Monitoring, no setup fee and no contract, against the $79 to $139 a month plus a setup fee that traditional credit-repair firms charge. Mail the letters yourself for the cost of a stamp, or hand a round to RushMail for a small per-letter fee. Nothing goes out without your review and your signature.
It is backed by our 100% money-back guarantee: members who work the full program and see no bureau score rise above where they started can claim back every Refresh Monitoring payment. It is a refund promise, never a score promise.
Skip the paperwork. Start your dispute.
CreditRefresh drafts your FCRA dispute letter and tracks the 30-day investigation window. You review, approve, and send. You stay in control.
Get StartedCommon Questions About CPNs
Can you get in trouble for having a CPN?
Purchasing a number and never using it is legally different from submitting it. Federal criminal liability generally attaches at the point of use, when the number is put on an application and transmitted to a creditor. Possession alone is a weaker posture than use, and it is not a safe one; the specifics depend on how the number was obtained and what was said in obtaining it. Consult a licensed attorney rather than relying on that general rule.
Can I open a bank account with a CPN number?
No lawful route exists. Federal banking rules require institutions to verify customer identity, and a bank opening an account on a number that is not the customer’s is being deceived. Providing the number is a false representation to a federally insured institution, which is the conduct 18 U.S.C. § 1344 reaches.
Can I get a house with CPN?
Mortgage applications are verified against Social Security Administration records, and the false identifier reaches both the bank-fraud statute and, where the number belongs to a real person, aggravated identity theft under 18 U.S.C. § 1028A with its mandatory consecutive two years. The legal path to a mortgage on a damaged file is disputing the inaccurate items and rebuilding the accurate record.
Is CPN legal for apartments?
No. A rental application is an application for credit in substance, and a landlord or screening company relies on the identifier to pull the report. Submitting a false identifier to obtain a consumer report can violate FCRA Section 619 (15 U.S.C. § 1681q), which makes obtaining a consumer report under false pretenses a federal crime, in addition to state identity-misuse statutes like California Penal Code Section 530.5 and Texas Penal Code Section 32.51.
How much does a CPN cost?
Sellers charge a few hundred to a few thousand dollars per number. The comparison worth making is against the cost of the lawful route: disputing under FCRA Section 611 costs postage, a free report from each bureau is a statutory right under the FCRA, and a denied application entitles the consumer to a free copy of the report the decision used, within 60 days, under FCRA Section 615(a).
How long does CPN last?
There is no term, because there is no product. The number is either a real person’s Social Security number, which is theirs permanently, or a number the Social Security Administration never issued, which fails verification. Accurate negative items on a real file do have a clock: most fall off after seven years under FCRA Section 605, and title 11 bankruptcy cases are capped at ten years from the date of entry of the order for relief or the date of adjudication.
Does the Privacy Act of 1974 let me withhold my Social Security number from a lender?
No. 5 U.S.C. § 552a restricts federal agencies. Private creditors may require a Social Security number under federal banking statutes and IRS reporting requirements, and the Act gives no ground to refuse.
What if my child’s Social Security number was sold as a CPN?
Place an initial fraud alert under FCRA Section 605A, which a nationwide agency must include in the file for not less than one year and which requires no police report, and file an identity theft report. Then request a block under Section 605B (15 U.S.C. § 1681c-2), which obliges the agency to block the reporting of information resulting from the alleged identity theft within 4 business days of receiving proof of identity, the identity theft report, the identification of the information, and the consumer’s statement that it does not relate to any transaction of theirs. Section 605B(c) lets the agency decline or rescind a block it reasonably determines was made in error or requested on a material misrepresentation. A security freeze under Section 605A must be placed free of charge within 1 business day of a request made by toll-free phone or secure electronic means, and it blocks release of the file to a prospective new creditor.
This article is for educational purposes only and does not constitute legal or financial advice. The Fair Credit Reporting Act and related regulations are complex, and outcomes depend on individual circumstances. Consumers with specific questions about their credit reports or rights under federal law should consult a licensed attorney or contact the Consumer Financial Protection Bureau directly.
CreditRefresh works on the only file that is lawfully yours. It reads your three reports under your own Social Security number, flags what looks inaccurate, and drafts the dispute a CPN seller promises to make unnecessary. Connecting your three reports takes a few minutes, and the first scan is ready the same day. Backed by a 100% money-back guarantee.
