Credit Privacy Number Fraud: How Lenders Spot CPNs

Last updated: September 2026

Credit privacy number fraud is the use of a CPN, a nine-digit number sold as a substitute for a Social Security number, to apply for credit. The number usually belongs to someone else, often a child, or to no one at all. For a lender's fraud and onboarding team, a CPN on an application is a synthetic identity signal, and the checks that expose it are ones most institutions can already run.

TL;DR

• A CPN (credit privacy number, also sold as a credit profile number or credit protection number) is not issued by any government agency. SSA's Office of the Inspector General told Congress in 2011 that "CPNs are not legal."

• Federal law makes it a felony to falsely represent a number as your Social Security number with intent to deceive, under 42 U.S.C. 408(a)(7)(B).

• Many CPNs are stolen Social Security numbers, often children's, sold to people with poor credit as a "new credit identity."

• On an application, a CPN shows up as an SSN that does not match the applicant's name and date of birth, a thin or new credit file, and identity elements with no shared history.

• Verify the number at onboarding, add evidence on a thin file instead of declining on it alone, and after opening, find every account that shares the number.

The short answer: what credit privacy number fraud is

Credit privacy number fraud is applying for credit with a CPN instead of one's own Social Security number. A CPN is a nine-digit number sold as a legal SSN substitute, but SSA's Office of the Inspector General told Congress in 2011 that "CPNs are not legal." For a lender, a CPN is a synthetic identity signal that SSN-match, death-record and identity-element checks are built to catch.

• What a CPN is: a number formatted like an SSN that no agency issues.

• What it usually is underneath: a stolen SSN, often a child's, or a number no person holds.

• What the law says: federal law makes it a felony to present a number as your SSN, with intent to deceive, to obtain anything of value.

• What a lender sees: an SSN that does not match the name and date of birth, a thin or new file, and other accounts sharing the number.

What a CPN is, and what sellers claim it is

A CPN is a nine-digit number, formatted like a Social Security number, that credit repair sellers market as a way to build a credit file separate from a person's own. No government agency issues CPNs. In 2011 congressional testimony, SSA's Office of the Inspector General described CPNs as numbers that "resemble the SSN or the IRS-provided Individual Tax Identification Number or Employer Identification Number," and said they "are a means of misusing the SSN and possibly committing identity theft." The same testimony notes that CPNs are "also known as Credit Profile Numbers and Credit Protection Numbers."

The seller's pitch is a fresh start, and the FTC's consumer guidance on credit repair treats that promise as a scam: "If a company promises to create a new credit identity or hide your bad credit history or bankruptcy, that's also a scam." The FTC adds that such companies often use stolen Social Security numbers, or get people to apply to the IRS for employer identification numbers under false pretenses. An SSA OIG news release on a 2018 federal case put it more bluntly: "CPNs, which are actually stolen Social Security Numbers, are marketed to individuals with poor credit history as a way to get a fresh start and establish a new credit identity." In that case, the numbers belonged to children.

For a financial institution, the person who presents a CPN has usually bought the number. The applicant typically gives a real name, date of birth and address, and puts the CPN where the SSN goes. CPNs also appear outside credit cards: a partnerships lead at an identity-data provider, describing rental and property applications, called it someone "using one that they've found or tacked on or manipulated."

Why using a CPN on a credit application is misrepresentation

Federal law makes it a felony to falsely represent a number as one's Social Security number to obtain anything of value. Under 42 U.S.C. 408(a)(7)(B), a person who, "with intent to deceive, falsely represents a number to be the social security account number assigned by the Commissioner of Social Security to him or to another person," when it is not, "shall be guilty of a felony." The offense is punishable by up to five years in prison. A CPN entered in the SSN field of a credit application is the kind of representation the provision describes.

A second federal statute, 18 U.S.C. 1014, is narrower. It makes it a federal crime to knowingly make a false statement "for the purpose of influencing in any way the action of" listed institutions, including FDIC-insured banks, insured credit unions and mortgage lending businesses. It does not reach every lender. The defendant in the 2018 federal case pleaded guilty "to knowingly making a false statement to a financial institution."

The FTC gives would-be buyers the same warning in plainer terms: a person who uses a number other than their own to apply for credit will not get it, "And you could face fines or prison."

The legal framing matters to a fraud team because it settles who the victim is. The applicant bought the number and chose to use it. The number's real owner, often a child, is the person harmed, and usually does not know. This section summarizes the law for fraud and onboarding teams; it is not legal advice.

How CPNs relate to synthetic identity fraud

A CPN application is a synthetic identity. The Federal Reserve defines synthetic identity fraud as "the use of a combination of personally identifiable information (PII) to fabricate a person or entity in order to commit a dishonest act for personal or financial gain." A real name and date of birth paired with someone else's SSN, or with a number no one holds, is that combination.

The Federal Reserve also lists credit repair first among the common uses of synthetic identities, ahead of fraud for living, payment default schemes and other criminal activity. Credit repair is exactly what a CPN buyer says they are doing. Children's SSNs are prized raw material because nobody checks a child's credit file: the Federal Reserve Bank of Boston counts "this child's Social Security number" among the stolen fragments that get combined into a fake person.

For how synthetic identities work more broadly, see our guide to synthetic identity fraud across the customer lifecycle. This page stays with one instrument, the CPN, and the checks that expose it.

The signals that expose a CPN

A CPN rarely fails on one check alone. It shows up as a pattern across the number, the identity elements around it and the credit file behind it. The table sets out each check, what a CPN looks like on it, and what a clean result does not prove.

Each row is a partial test; together they separate a CPN from a genuine applicant.

The SSN match is the strongest single check. The Social Security Administration's eCBSV (electronic Consent Based SSN Verification) service lets financial institutions and their service providers check, with the number holder's written consent, whether an SSN, name and date of birth match SSA records. It returns a yes or no, identifies the element that does not match, and flags a death record if there is one. A CPN presented with the buyer's own name and date of birth fails that match.

The death-record check is a cheap first filter. A product manager at an auto-lending technology company described using "free info, SSN death master file to knock out before you incur any additional costs." A clean death-record result is not proof, though, because fraudsters target the gap between a death and its appearance in death-record data.

Identity-element consistency asks whether the details on the application belong together. A chief risk officer at a card-issuing bank described the test as matching each element, name, address, phone, email and driver's license, against sources, until a check can say "that address has never been associated with that person."

Credit-file depth is where a CPN is often thinnest. A director of fraud at a consumer lender listed the questions: "how long has it been in file? How many different trades do they have?" A CPN file is often new or nearly empty, which is also true of a genuine young or new-to-credit applicant, so a thin file calls for more checks before a decision.

What to do at onboarding

1. Collect and verify the identification number. The bank Customer Identification Program rule, 31 CFR 1020.220, requires a bank to obtain at minimum a customer's name, date of birth, address and an identification number before opening an account, and to verify identity under risk-based procedures. A CPN arrives as that identification number. Treat a mismatch between the SSN and the applicant's name or date of birth as a stop, not a note on the file.

2. Build consent into the flow where eCBSV is used. eCBSV requires the number holder's written consent, which can be an electronic signature. Put the consent step inside the application, before the check runs, so the check is never skipped for lack of it.

3. Treat a thin or no-hit file as a reason for more evidence. A senior director of fraud risk management at a payments company pointed out that an empty bureau return can mean a genuine thin-file applicant, someone young or new to the country, or someone who entered a real-looking made-up name and date of birth. Pull the bureau file, then add other data sources, instead of declining on the empty file alone. That protects the genuine new-to-credit applicant, who looks the same as a CPN on a single bureau check.

4. Decline or refer according to policy, and record why. Write down which check failed and what it showed. A recorded reason lets the decision be reviewed and lets the same SSN be matched if it appears again.

What to do after an account is open

Some CPN accounts get through onboarding, and a clean payment history does not clear them. A director of fraud at a consumer lender described fraudsters waiting years before using an identity, building up its profile so that it looks legitimate when it finally applies. Use this checklist once an account is open:

• Find every account that shares the SSN. Include accounts that share the address, phone, email or device tied to it, and review them together instead of one at a time.

• Compare name and date of birth against the SSN on each account. The same number under different names or dates of birth is the clearest CPN pattern after onboarding.

• Do not wait for a report. "Obviously synthetic, the only victim is us," said a director of fraud at a consumer lender. The number's real owner, often a child, usually does not know it is being used, so the lender finds it or no one does.

• Do not close accounts automatically on one signal. Follow the institution's own policy and reporting obligations, and record the evidence behind each decision.

• Feed confirmed CPNs back into onboarding. A number confirmed on one account should be caught the next time it appears on an application.

Choosing synthetic identity fraud detection software to run these checks at scale is a separate decision with its own evaluation criteria.

How Oscilar approaches CPN and synthetic identity risk

Oscilar treats CPN risk as a decisioning and linkage problem, and it is not the data source. Oscilar's account opening fraud page lists synthetic identity fraud and identity theft among the scenarios it covers, with device intelligence, behavioral biometrics and data enrichments to "enhance customer identification and prevent account opening fraud." Oscilar makes decisions using the identity and SSN-verification sources an institution already works with, alongside those device and behavioral signals. The Oscilar platform lists SSNs among the entity types in its relationship graph, so finding every account that shares a number is a linkage question, and the account-opening page describes analyzing "cross-account linkages to uncover fraud rings."

Oscilar provides a full audit trail per decision with stored reasoning, and human-in-the-loop by design. Models are monitored for data, feature and concept drift, with outcome KPIs measured by segment, and the platform is specified for decisions in under 100 milliseconds.

Frequently asked questions

Is a CPN the same as an EIN or an ITIN?

No. The IRS issues employer identification numbers (EINs) and individual taxpayer identification numbers (ITINs); no agency issues a CPN. SSA's Office of the Inspector General noted in 2011 that CPNs "resemble" the SSN, the ITIN and the EIN, which is part of how sellers pass them off. The FTC warns that credit repair companies sometimes get people to apply for EINs under false pretenses.

Is it illegal to use a CPN on a credit application?

Federal law makes it a felony to falsely represent a number as one's Social Security number, with intent to deceive, to obtain anything of value, under 42 U.S.C. 408(a)(7)(B). A false statement to a listed lender, such as an FDIC-insured bank or an insured credit union, can also fall under 18 U.S.C. 1014. SSA's Office of the Inspector General told Congress in 2011 that "CPNs are not legal." This is a summary of the law, not legal advice.

Can a CPN be a real person's Social Security number?

Yes, and it often is. An SSA OIG news release on a 2018 federal case described CPNs that "are actually stolen Social Security Numbers," which in that case belonged to children. A child's SSN suits a CPN seller because nobody is watching the child's credit file.

Does an SSA eCBSV check catch a CPN?

Usually. A CPN is normally presented with the applicant's own name and date of birth, which do not match SSA's records for that number, and eCBSV reports which element fails and whether a death record exists. The check needs the applicant's written consent, and it is a service run by the Social Security Administration.

What should a lender do about accounts already opened with a CPN?

Find every account that shares the number or its identity elements and review them together. Follow the institution's own policy and reporting obligations instead of closing accounts automatically on one signal, and record the evidence behind each decision. Then feed the confirmed number back into onboarding checks so it is caught the next time.

A CPN is sold as a fresh start and arrives at a lender as someone else's Social Security number, or as no one's. The checks that expose it work best together: an SSN match, a death-record check, identity-element history, file depth and a search for other accounts sharing the number, at onboarding and after. To see how Oscilar supports those decisions, visit our account opening fraud solution.