On its own, your passport number is a document identifier, not a password to your bank account. The real trouble with someone having your passport number starts when it travels with other details — your name, date of birth, place of birth, or a photo of the data page. That combination can be used to forge travel documents, open credit accounts, apply for jobs or benefits, build a synthetic identity, or make a phishing message sound convincing enough that you hand over the rest yourself.
Because a U.S. passport establishes both identity and citizenship in a single document, compromised passport data carries more weight than a leaked driver’s license number. Here is what a thief can realistically do with it, how the exposure usually happens, and the steps that actually cut off the damage.
What They Can Actually Do With It
A fraudster holding nothing but a nine-digit number cannot walk into a bank and drain your accounts. What they can do depends on what else they have, and the more of your personal information sits next to that number in the same breach or scan, the more paths open up.
Forged Passports and Fake IDs
Counterfeit passports built around a real number and real name, but a different photograph, can pass a casual inspection. The forgeries get used to cross borders, sign leases, or present ID during other frauds. The person whose data was used often doesn’t find out until they’re pulled aside at a border checkpoint or named in an investigation they had nothing to do with.
Financial Fraud
Passports are widely accepted as primary identification, so a criminal with your passport details can try to open credit accounts, apply for loans, or request wire transfers in your name. Some online platforms verify identity with a passport scan and a selfie, both of which can be manipulated. Unauthorized accounts opened this way generate debt under your name, and cleaning up the credit damage can take months or years.
Existing accounts are exposed too. If a bank falls back on passport data when a customer claims to have lost other credentials, a fraudster with your number and personal details may talk their way past security questions or reset two-factor authentication.
Employment and Benefits Fraud
A U.S. passport satisfies both the identity and employment-authorization requirements on Form I-9, which makes it valuable for anyone trying to work under someone else’s identity or past a background check they wouldn’t clear on their own. The same data can be used to file for unemployment insurance or Social Security disbursements, leaving you to deal with the tax consequences and clawback demands.
Synthetic Identity Fraud
Synthetic identity fraud blends your real information with fabricated details to build a person who doesn’t quite exist. A fraudster might combine your passport number and date of birth with an invented name and a different Social Security number, use that hybrid to open credit accounts, build a history over months, then max out every account and disappear. Because no single real profile matches the synthetic one perfectly, this kind of fraud is difficult to trace back to its source.
Phishing and Social Engineering
Even partial passport data gives a scammer credibility. An email or call that recites your actual passport number, full name, and date of birth reads very differently from a generic phishing attempt. Criminals use that specificity to talk you into revealing banking credentials, Social Security numbers, or security-question answers, or into clicking a link that installs malware. The passport data is the bait; the real prize is whatever you hand over next.
How the Number Gets Out
Most exposure is digital, not physical. Data breaches at airlines, visa platforms, and travel agencies leak passenger records containing passport numbers, full names, dates of birth, and email addresses in one package. Phishing sites impersonating government portals collect passport scans from users who think they’re renewing or applying. Malware sweeps phones and cloud storage for sensitive files, including the passport photos travelers commonly keep as backups.
Physical exposure still happens. A passport left in a hotel room, a photocopy handed to a rental car counter that doesn’t shred its records, a discarded boarding pass at an airport — any of these can put your data in the wrong hands. You do not have to lose the book to lose control of what’s inside it.
Steps to Take If Your Passport Number Is Exposed
Speed matters. The faster you report and lock things down, the less time a criminal has to use the data.
Report to the Department of State
If the physical passport was lost or stolen, report it immediately to the U.S. Department of State. You have three options: report online through the State Department’s form filler, print and mail Form DS-64, or report in person when you apply for a replacement.1U.S. Department of State. Report Your Passport Lost or Stolen Online is fastest, with cancellation within one business day. Reporting in person while applying for a new one can take several weeks to process the cancellation. Either way, reporting invalidates the old document and limits what anyone can do with it going forward.
If your passport number was exposed in a breach but you still have the book, you’re in a grayer area. The reporting process is designed for lost or stolen passports, not compromised numbers alone. You can still report the passport and request a replacement with a new number to cut off the exposed data, weighed against the cost and wait time below.
File an Identity Theft Report With the FTC
File a report at IdentityTheft.gov. The site generates a personalized recovery plan with step-by-step checklists and sample letters you can send to businesses and credit bureaus.2Federal Trade Commission. IdentityTheft.gov The FTC Identity Theft Report also works as official documentation when you dispute fraudulent accounts or push back on creditors.
Freeze Your Credit or Set a Fraud Alert
A fraud alert tells creditors to verify your identity before opening new accounts. Contact one of the three major credit bureaus (Equifax, Experian, or TransUnion); that bureau is required by law to notify the other two. An initial fraud alert lasts one year and is free.3Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
A credit freeze goes further. While a freeze is active, nobody, including you, can open a new credit account in your name. You lift it temporarily when you want to apply for credit yourself. Placing and lifting a freeze is free under federal law.4Federal Trade Commission. Credit Freezes and Fraud Alerts For most identity theft victims, the freeze is the better tool: fraud alerts ask creditors to take extra steps, but a freeze blocks access entirely.
Request an IRS Identity Protection PIN
If your passport data was exposed alongside your Social Security number, a fraudster can file a fake tax return in your name to claim a refund. An IRS Identity Protection PIN adds a six-digit number that only you and the IRS know to your filing; a return submitted under your SSN without it gets rejected.5IRS. Get an Identity Protection PIN (IP PIN) The fastest route is through your IRS online account. If you can’t verify online and your adjusted gross income is below $84,000 (or $168,000 for married filing jointly), you can submit Form 15227 instead.
Apply for a DHS Redress Number
If someone used your passport data for travel and you start getting flagged for extra screening at airports or border crossings, the DHS Traveler Redress Inquiry Program can help. Submit an inquiry through the DHS TRIP portal, receive a seven-digit Redress Control Number, and enter that number when booking future airline reservations.6Department of Homeland Security. Traveler Redress Inquiry Program (DHS TRIP) It won’t fix the underlying fraud, but it stops you from paying the price for it every time you fly.
Watch Your Accounts
Check credit reports and financial accounts regularly for unfamiliar charges, new accounts, or address changes you didn’t authorize. Free weekly credit reports from each bureau are available through AnnualCreditReport.com. Change passwords on any online accounts tied to your personal information and turn on two-factor authentication where you can, using a method a fraudster can’t intercept with the data they already have.
Replacing the Passport Itself
A physically stolen passport can’t be renewed by mail or online. You apply in person at a passport acceptance facility using Form DS-11, the same form used for first-time applications, and provide details about where and when the passport was lost or stolen along with a copy of the police report if you filed one.1U.S. Department of State. Report Your Passport Lost or Stolen
A replacement adult passport book costs $165: a $130 application fee plus a $35 acceptance fee. Faster service adds $60 for expedited processing and $22.05 for 1–3 day delivery of the finished book, bringing a rushed replacement to roughly $247.7Travel.State.Gov. Passport Fees
As of early 2026, routine processing takes 4 to 6 weeks and expedited processing takes 2 to 3 weeks, and neither estimate includes mailing time in either direction.8U.S. Department of State. Processing Times for U.S. Passports If you have travel booked within two weeks, you may need an appointment at a regional passport agency, which handles life-or-death emergencies and urgent travel separately from the standard process.