Purplelink
← All guides

Guide

Is it safe to email a Social Security number? What to do from a Mac

By ·

Someone asks for your Social Security number, or a client's, and the easy answer is to type it into a reply. This guide says why that is a poor idea, what to do instead with what a Mac already has, and what to do if the email has already gone. The Preview steps come from Apple's guide and were checked against Preview on macOS 27 on November 4, 2026.

Disclosure up front: I make Outbound Veil, the Mac app in the last section. It is a paid app, so weigh that. Everything before that section is free and uses nothing you need to buy. No link on this page is an affiliate link. This is not legal or tax advice.

The short answer

Plain email is not a safe place for a Social Security number. Once it is sent, a copy sits in your Sent folder, in the other person's inbox, and in each side's mail backups, often for years, and you cannot pull it back. One wrong pick from address autocomplete sends it to a stranger. Before you send it at all, ask whether the full number is needed. Many offices can work with the last four digits.

Better ways to send it, in order

  1. The other side's secure portal. Banks, payroll services, tax preparers and many law and medical offices have an upload page or a client portal. Ask for it. The number then goes to their system and does not sit in two mailboxes.
  2. A PDF that needs a password to open, made in Preview. Put the number in a document, save it as a PDF, and open it in Preview. Choose File, Export, and give the copy a new name. Click Permissions, select Require Password To Open Document, and type a password twice. Preview also asks for an Owner Password, which can be the same. Click Apply, then Save (Apple's guide to password-protecting a PDF). Attach that copy, and send the password another way: read it out on a phone call or send it by text message. Never put the password in the same email. Use a long password, since anyone who has the file can keep guessing.
  3. Read it out on a phone call. If you know the person and the number you are calling, a call leaves no copy in a mailbox at all.

To change or remove the password later, open the PDF in Preview and choose File, Edit Permissions.

If you already sent it

  1. Ask the person you sent it to to delete the message, and to empty it from their deleted items.
  2. Delete it from your own Sent folder and Trash. That does not reach their copy or any backups, but it is one fewer copy.
  3. If it went to the wrong person, or you are worried, consider a credit freeze with each of the three credit bureaus, Equifax, Experian and TransUnion. The FTC's IdentityTheft.gov covers what to do if the number is misused.

To make the wrong-recipient case less likely next time, see what Apple Mail can and cannot catch when you send to the wrong person.

For small tax and law offices

On August 18, 2026, the IRS and its Security Summit partners reminded tax professionals that they need a written information security plan to protect client data (IRS news release IR-2026-92). The release does not set rules for email. Still, a plan is a good place to write down how your office receives and sends Social Security numbers and ITINs: which portal clients use, whether staff may ever email a full number, and how a PDF password is shared. Then tell clients the same thing before tax season, so nobody emails a number because it was the quickest way.

Where Outbound Veil fits

Outbound Veil, our Mac app, checks what you type for numbers like these and shows a badge before you send. It will miss some things, and it does not check attachments or who a message is addressed to. Its page lists where it has been tested, and it has a free 7-day trial.

Frequently asked

Is it safe to email a PDF with my Social Security number?

Not as a plain attachment. A PDF attached to an email sits in the same mailboxes as the message, so it is no safer than typing the number in the body. A PDF that needs a password to open is better, if the password is long and you send it another way, such as a phone call or a text message.

Can I send just the last four digits?

Often, yes. Many offices only need the last four digits to match your record, so ask before you send the full number. The last four together with your name and date of birth still say a lot about you, so do not post them anywhere public.

Does Outbound Veil check attachments?

No. Outbound Veil checks text as you type it. It does not open or check attached files, and it does not check who a message is addressed to.

Related guides