How a number is assigned. There are three routes in SSA's regulations. A person can apply with "evidence, as necessary, to assist us in establishing your age, U.S. citizenship or alien status, true identity, and previously assigned Social Security number(s), if any." A parent can request a number for a newborn as part of the state's birth registration process, where a state has an agreement with SSA. And a noncitizen can request one through the immigration process. SSA checks its files first: a person who already has a number gets a replacement card, not a new number.
The card and its legends. The card is SSA's property and "must be returned upon request." Cards for U.S. citizens and permanent residents carry no restrictive legend. Others carry "Not Valid for Employment" or "Valid For Work Only With DHS Authorization," depending on immigration status. Replacements are limited to "no more than three replacement social security number cards in a year and ten replacement social security number cards per lifetime," although legal name changes and changes in the restrictive legend do not count toward the limits, and SSA may allow other exceptions in compelling circumstances.
Where you must give it. On a federal tax return and to anyone who files an information return about you, such as an employer or a bank paying interest. On applications for Social Security, Medicare and other federal benefits. To state agencies for taxes, public assistance, driver's licenses and vehicle registration, which the Social Security Act expressly permits them to require. And, in a growing number of tax rules, as a condition of a credit or deduction: the child tax credit, for example, now requires the child's number and the taxpayer's own (on a joint return, at least one spouse's), each issued to a citizen or a person authorized to work, before the return's due date.
Why it is a target. Because one number links earnings, taxes, credit and benefits, a stolen SSN is the raw material for many kinds of identity theft, including tax-refund fraud, synthetic identity fraud and fraud against children who have no credit history yet. Protecting it, and knowing what to do when it is exposed, is covered on those pages.