Is it safe to email your Social Security number? No

Someone in HR, a leasing office or a bank just asked you to "email over your Social" so they can finish the paperwork. You are right to stop and check first.

Is it safe to email your Social Security number?

No. An ordinary email is usually encrypted only while it travels between mail servers. After that, your Social Security number sits in readable form in your Sent folder, in the recipient's inbox and on both providers' servers, often for years. Anyone who later gets into either account can find it with a single search.

The risk is rarely a spy catching the message in flight. It is the copies. An email is not a phone call that ends. It is a document that gets stored, backed up, forwarded and searched, and you control only one of the places it lives.

Where one emailed number ends up

Send your number once and count what exists a minute later:

Your Sent folder. It stays there until you delete it, on every phone, tablet and laptop signed in to your account.
The recipient's inbox. Plus every device they read mail on.
Both email providers' servers. With most providers the company holds the keys, so the stored copy is readable to the provider and to anyone who compels or breaches it.
Forwards and shared inboxes. HR forwards it to payroll. The leasing agent copies the property manager. An address like "office@" may be read by five people.
Backups and archives. Many businesses archive all mail for years as a matter of policy.

The trip itself is the best protected part. Google says "all Gmail messages use TLS automatically," which encrypts the message between servers when the other provider supports it, and it warns that when a message shows the red open lock you should "not send sensitive information" (Gmail help). That protection ends at delivery. For what each of those layers does, see encryption at rest vs in transit, and to check a message you already sent, use the header test in is my email encrypted?

A thief does not need to be watching. They need one reused password or one phished login at either end, at any point in the next ten years. Then they type "SSN" or "social security" into the search box.

Find the numbers you have already emailed

Most articles on this question stop at "don't." This check shows what is already out there in your own account. It takes five minutes.

In Gmail, paste each of these into the search bar:

in:sent "social security"
in:sent (SSN OR "W-9" OR "W-4" OR "I-9" OR "1040")
in:sent has:attachment (tax OR passport OR "social security card")
your own number, in quotes, once with hyphens and once without

In Outlook, Apple Mail or any other app, open the Sent folder and search the same words. Search often can't read text inside photos and scans, so the form names matter more than the number.

Then run the same searches on your whole mailbox, not only Sent. Old tax returns from an accountant, a W-2 from a former employer, a loan file from 2019: each one is a copy of your number sitting in your inbox. Save what you need somewhere encrypted and delete the emails.

What to do if you already emailed your Social Security number

First, some proportion. If you sent it to the right person at a real organization, the most likely outcome is that nothing happens. What you are doing below is shrinking the number of copies and making the number harder to misuse.

In the first 30 seconds. Gmail can cancel a sent message for a short window. The longest setting is 30 seconds (Gmail help), so if "Undo" is still on screen, click it. After that the message is delivered.

In the first hour.

Ask the recipient, by phone, to save the number where it belongs and delete the email from their inbox and trash.
Delete your own copy from Sent, then empty the trash.
If the recipient forwarded it, ask who to, and repeat step 1.
Change your email password if it is reused anywhere, and turn on two-step verification. Your account is now one of the places the number lives.

In the first week. These three are free, and they are worth doing even if you never emailed anything.

Freeze your credit at Equifax, Experian and TransUnion. The FTC explains that while a freeze is in place, nobody can open a new credit account in your name. It is free, and it lasts until you lift it. If a freeze is more than you want, a fraud alert tells businesses to check with you first and lasts one year.
Get an IRS Identity Protection PIN. The IRS describes it as "a six-digit number that prevents someone else from filing a tax return using your Social Security number." Anyone who can verify their identity can get one, and a new one is issued every year.
Lock your number for employment checks. E-Verify's Self Lock is a free feature that locks your Social Security number "to prevent it from being misused in E-Verify." You can unlock it whenever a new employer needs to verify you.

If you sent it to the wrong person or a scammer. Do all of the above today, not this week. Then go to IdentityTheft.gov, the FTC's site, where you can report misuse and "get a personal recovery plan that walks you through each step."

They asked me to email it. Is that normal?

It is common, and it is still not how it should be done. IRS Publication 4557, the security guide the IRS gives tax professionals, says: "A legitimate business will never email and request personal or sensitive information be sent to them via email, unless through a secured mail service" (IRS).

So treat the request as a prompt to ask questions, not as an instruction. The FTC's guidance on identity theft lists four:

"Why do you need it?"
"How will you protect it?"
"Can you use a different identifier?"
"Can you use just the last four digits of my Social Security number?"

"If you're not satisfied with their answers," the FTC says, "don't share your Social Security number."

There is a second reason to slow down. The same FTC page says of the IRS, your bank and your employer that they "won't call, email, or text you to ask for it. If they do, it's a scammer." A new-hire or rental request that arrives by email may be real. It may also be someone pretending to be the recruiter or the landlord. Before you send anything, call the organization on a number you found yourself and confirm that the request is theirs.

Safer ways to give someone your Social Security number

Ranked from best to acceptable:

Say it on a phone call you placed. Nothing is stored. Call a number you looked up, not one from the message. This is the right answer for most one-off requests.
Type it into the organization's own portal or onboarding system. Payroll and HR platforms, bank sites and lender portals exist for this. Reach them by typing the address yourself.
Hand over the form in person. A W-4 or I-9 on paper, given to a named person, leaves no searchable copy.
Use end-to-end encrypted email or messaging. Here only you and the recipient hold the keys, so neither provider has a readable copy. An encrypted messaging app with disappearing messages is a good fit for a single number. We compare the two in is Signal safer than email?
Send a password-protected file, with the password by phone. The IRS asks for this method from taxpayers who email its staff, and it insists that the password never goes by email. The steps and the IRS rules are in our guide on how to send tax documents securely.

If you send whole forms more often than single numbers, the inbox you use matters as much as the method. In Secria Mail, end-to-end encryption is on by default, and every message in your mailbox is stored with zero-access encryption: keys are created on your device and only ever reach our servers encrypted. The old W-2 from your accountant is then a sealed file, not a search result.

Is it safer to text your Social Security number?

A standard text message is no better than email. It is not end-to-end encrypted, and it stays in both phones' message history and backups. An end-to-end encrypted messaging app is a real improvement, because the provider can't read it, and better still if you set the message to disappear. Whatever you use, send the number on its own with no name, birth date or address beside it. A nine-digit number with no label is worth far less to someone scrolling through a stolen phone.

What about a photo of the card, or a PDF form?

A picture of your Social Security card or a completed W-9 is worse than the number typed in a message. A form puts your name, address, signature and sometimes your birth date next to the number, which is the full set a fraudster needs. A photo also lands in your camera roll and your cloud photo backup, two more copies. If an employer needs to see the card itself, show it in person. If a form has to travel, use method 2 or method 5 above, then delete the photo from your phone and from its "recently deleted" album.

FAQ

Is it safe to email my Social Security number to my employer? Not by ordinary email. Ask whether the company has an onboarding or payroll system where you can enter it, or give it to HR by phone or in person. Confirm first, on a number you found yourself, that the request really came from the employer.

I accidentally emailed my Social Security number. What should I do? Ask the recipient to delete the message, delete your own copy from Sent and trash, and secure your email account with a new password and two-step verification. Then freeze your credit and get an IRS Identity Protection PIN. Both are free.

Is it safe to email just the last four digits? It is much lower risk than the full number, and the FTC suggests asking whether the last four will do. The last four are still widely used to confirm identity over the phone, so don't send them alongside your full name and birth date.

Can someone steal my identity with only my Social Security number? A number alone is harder to use. Paired with a name and a birth date or address, it can be used to open credit, file a tax return or get a job in your name. That is why a credit freeze, an IP PIN and Self Lock are the three protections to set up.

Does deleting the email remove the risk? It removes your copy, which is worth doing. It does not remove the recipient's copy, their forwards or their company's archive. That is why the phone call asking them to delete it matters as much as cleaning your own Sent folder.

Your Social Security number has to be shared a few times in a lifetime. It never has to sit in an open inbox afterward. If you want a mailbox where stored mail is sealed by default, you can try Secria for free.