If you feel like you were scammed, first and foremost, you need to take precautions against identity theft.
If you gave them a credit or debit card number in order to purchase some of their benefits, you want to contact your card carrier, tell them that you now believe your card was compromised, ask them to do a chargeback on the monies paid, and then cancel that card and open a new one.
If you gave them your social security number and enough other information about yourself for them to be able to open up cards or take out loans in your name, you have to go even further. You should consider placing a fraud alert on your credit history.
To get a fraud alert, call any one of the three credit reporting bureaus -- Experian, TransUnion or Equifax -- and tell them that your identification data has been compromised and ask them to put a fraud alert on your credit history. When you call one of the bureaus and ask for a fraud alert, any one of the three bureaus will alert the other two and you'll be able to get a full credit report automatically from each of them. That way, you'll be able to see if any of your loans and cards are unauthorized and cancel them.
A fraud alert is free for 90 days, and it means that if, during that time, anyone attempts to open up a card or an account or take out a loan in your name, you will get a phone call before any such loan or credit line gets authorized. After 90 days, you can continue the service for a fee or switch to a private company such as lifelock.
A fraud alert will not affect your credit negatively. It is only to protect you, and it won't change the way that you can use your credit cards or bank accounts. It just alerts new lenders not to approve new lines of credit without contacting you first.
I'm linking you to Experian, because I have the link handy.
Doing the above and monitoring her accounts carefully and promptly reporting irregularities should keep her secure from identity theft.
As far as the social security number is ***** you need to contact Social Security to let them know that your number has been potentially compromised. You are going to want to follow the directions on the Social Security Administration's website.
Social Security does not usually feel it's necessary to get a new social security number, but you can take that up with them. They would want you to notify the IRS so that nobody can grab your tax refund or collect unemployment or social security benefits in your name, however.
There's a special form you will need to fill out -- form 14039 -- with the IRS which will protect you if some scammer gets benefits such as worker's comp or social security in your name or uses your identity to get a job. The form and directions are available on the web. I have linked you to.
And, of course you would want to report the fraud to your police, the FBI online at their Internet Crime Complaint Center at IC3gov and to the Federal Trade Domission.