Asking for Identity Theft: The Risks of Social Security Number Overuse

08 July 2011 | 10:34 AM ET | Jesse Emspak, SecurityNewsDaily Contributor

A prototype Social Security card.
CREDIT: Social Security Administration

If you've ever suspected that your Social Security number has fallen into way too many hands, you're probably right.

Social Security numbers have become universal identifiers — even though they were never designed for that purpose.

Getting a bank account or a driver's license is impossible without one, and it's often necessary to fill it in on a visit to a doctor's office. Sometimes even companies that you wouldn't think would need it will ask for it anyway, such as utility companies and cable- and satellite-television providers.

So how did we get to this point? The short answer is simple: Money.

For any company or organization, designing a database costs money and takes time. Writing an algorithm to generate account numbers and organize them costs even more. It's simpler and cheaper to use a ready-made ID that can also track things such as credit reports and tax histories.

"It's the same reason your driver's license became the age-verification token," says Bruce Schneier, chief security technology officer at BT (formerly British Telecom) and the author of several books on digital security. "It was there."

This wouldn't matter if not for the problem of identity theft . While identity theft has been happening for centuries, absent a single number that accessed many accounts it was much harder to do and not nearly as lucrative.

But today, when most people's addresses, full names and birth dates are easily found on the Internet, the Social Security number is often the last piece of information preventing online thieves from having enough data to steal your identity.

That's why governmental and medical data breaches, such as happened recently in Texas and in Massachusetts , are so dangerous. Millions of people had their Social Security numbers exposed for all the world to see, giving cybercriminals what they needed to open bank and credit-card accounts in strangers' names.

Mission creep

Back in the 1930s, when the Social Security program was started, the nine-digit number was designed to only keep track of an individual person's earnings and eligibility.

It wasn't until 1961 that the Internal Revenue Service started using the numbers to track taxpayers, so banks then had to have customers' Social Security numbers to make sure they reported interest and the like.

In the 1980s, the IRS began using it to track whether families were reporting dependents properly, and asked that any minor children have a Social Security number issued. (Many people forget that before that, taxpayers were on the honor system. Predictably, the number of deductions for dependents soon dropped).

By that point, companies were using Social Security numbers as employee IDs. Credit-card companies, often linked to banks, used them to help keep track of customers who might change addresses or names. It was also very useful if someone had a common name such as "Jane Smith."

In the 1970s, the military started using Social Security numbers in place of the old system of serial numbers. At universities and colleges, they became part of the IDs that many students carried.

Local governments also got in on the act. Massachusetts, for example, used drivers' Social Security numbers as license numbers until the late 1980s. Today, governments are required to collect the numbers, but they can't put them on driver's licenses the way they once did.

Who does and doesn't need to know it

But do you need to resign yourself to always providing your Social Security number when it's asked for?

The truth is that you often don't have to give out your number, says Paul Stephens, director of policy and advocacy at the Privacy Rights Clearinghouse in San Diego.

The law is explicit: The only companies that need your Social Security number are those that need to communicate with the IRS. So a freelance employee has to provide one so he can get his 1099 forms, but a credit-card company actually has less need for it, and your doctor's receptionist doesn't need it at all.

Still, consumers are often strong-armed into giving up their Social Security numbers because some companies will simply not do business with you without it — or they'll at least make it difficult for you. And taking one's business elsewhere isn't always a viable solution.

Stephens says, however, that that doesn't mean one is without recourse. For some transactions an alternative identifier can be used, though it takes some jumping through hoops.

For example, a doctor's office often asks for a Social Security number on a form, but you can leave that field blank. It’s important to note that the doctor is using the number not to identify you, but make it easier for the insurance company to find your records.

If you ask that the insurance company use a different form of identification — and it is your right to insist upon it — then the doctor's office can use that too. (The only time you absolutely need to give your Social Security number to a medical provider is if you are receiving Medicare or Medicaid.)

For phone or utility companies, you can use a driver's license or passport, plus one other document. Bank statements, pay stubs or credit card bills will usually work, but it varies from company to company. Odds are you will also have to ask to speak to a supervisor.

Stephens adds that one should always ask just why a company needs your Social Security number to begin with. Credit checks aren't much of an excuse — there are other ways to perform them and the Social Security Administration says as much on its website.

Landlords in large cities often ask for a Social Security number to do credit checks. They don't need it either, because the various credit reporting agencies organize their records in a different way.

(This doesn't mean your Social Security number won't come up in a credit report – with your name, birth date and previous addresses easy to find, a third party could eventually get the number even if you never gave it to a previous creditor.)

And if you start a small business and employ anybody, it's probably worthwhile to get an employer ID number. Many people make the mistake of using their Social Security numbers as employer IDs, but the extra protection is worth the extra time. (This way you needn't use a Social Security number on payroll records).

Stephens adds that the problem is both one of creeping use and bad design with respect to privacy, especially when a company that doesn't seem to need it asks for your Social Security number.

"It's an example of a business not complying with data minimization," a fundamental piece of maintaining customers' privacy, he said.

Would you like to subscribe to our weekly newsletters?