Does Your Employer Still Use SSNs?

An anonymous reader asks: "My company, a fairly large telco, still uses social security numbers for non-financial purposes; mostly for our IT ticketing system. I find it amazing that in these times, with how easy it is to use an SSN to obtain credit, that any company still does this. I've heard talk for almost eight years that the practice is going to be stopped but little progress has been made. How many companies out there still use SSNs so openly? Since it seems that nobody is in a hurry to solve this issue, what can be done to speed the process up?"

Comments

Simple

[SecaKitten]

what can be done to speed the process up?

Simple, apply for credit cards in your boss's name.

Wow... that's not right...

[soren42]

My employer, a large bank, doesn't even use SSN's (or, more specifically TIN's - Taxpayer Identification Number) for non-financial information. Our employee ID numbers are unique, distinct, and not based on any formula. Now, that said, any employee that has a corporate credit card or is an officer of the company ("Officer", "Assistant Vice President", "Vice President", "Director", "Managing Director", "Senior Vice President", "Executive Vice President", "Senior Executive Vice President", etc., etc., etc.) does have their credit checked monthly by the company. But, I would assume that any company - not just a bank - would take that precaution with employees with purchasing or signatory authority. That system is based on SSN/TIN at our company - but it makes sense there.

I believe that there is a Federal Regulation that intends to restrict the use of SSN/TIN numbers for identification by (guessing here) 2010. I'm certain there is such a law for banks, but I believe that it extends to any US public company. Anyone have details on this?

One last thing - I know many people who use fake SSN's for non-financial uses. For some time, Richard Nixon's SSN was very popular. Now, don't get me wrong, I'm not endorsing that practice - just sharing that it seems pretty common to me.

Re:Wow... that's not right...

[reanjr]

I used to work for a logistics company that GM uses. One of GM's systems required some kind of user authentication (I don't remember the details) that they asked for my SSN to use. I did an MD5 on my actual SSN in hex and ripped out all the letters, used the first 9 as my SSN. It's a nice, repeatable way to generate a fake SSN that is likely to be unique in any system.

I strongly suggest using fake SSNs for anything possible, but of course, many times you are signing the "I verify that all this information is true to my knowledge" clause. Of course if you use it all the time, maybe you can get away with chalking it up to confusion over your actual SSN.

SSN

[CherniyVolk]

In the beginning the Social Security Number was issued by the government and is unique to each living citizen. This much still holds true.

But what was lost somewhere via the effects of Capitalism.... was that this number was supposed to be private to the individual assigned it. And, while there are laws protecting a citizens privacy. Companies were granted positions to effectively counter such laws. Only the government, state or law-enforcement officials may "demand" your Social Security Number. Visa can not demand you give it to them. Your landlord can not demand you give it to him. Private schools by law, can not demand you forfeit such information.

But no law is telling Visa or anyone else to accept alternate information for their personal records. As a result, you have to give out your Social Security Number, becuase if you don't, you can't apply for an Apartment, you can't buy a car, you can't have a credit card, you can't open a bank account, you can't get a job..... yeah, we have a choice.

*Some places do accept alternate information such as Drivers License Numbers.*

Re:SSN

[RexRhino]

Only the government, state or law-enforcement officials may "demand" your Social Security Number.

Completly false. Employers are REQUIRED BY LAW to take your social security number to handle SS deductions. Banks and credit card companies are REQUIRED BY LAW to retain your social security number in order to do financial reporting (so the IRS can check and make sure you aren't spending more than your reported earnings). Gun shops are REQUIRED BY LAW to take your social security number as part of criminal background checks. There are a whole slew of situations where, not only can a company ask you for your SSN, but they are required to take your SSN!

Visa can not demand you give it to them.

Visa IS REQUIRED BY LAW to take your social security number, or a tax ID number if it is a corporation, as part of their financial reporting requirments.

Private schools by law, can not demand you forfeit such information.

Private schools BY LAW ARE REQUIRED to take your SS number if the private school accepts federal government loans or grants for students.

Don't try to obscure the blame that the government bears for your SSN being your ID number. Aside from the fact that they have made legislation making SSN the de-facto ID number (Real ID Act), it was the government that decided that you would have one single number that would follow you for the rest of your life as your unique identity (as opposed to the system they used for passports, where your passport is given a unique ID, but that number will change over the course of your life... your passport is assigned a number, not the person)

Re:SSN

[spagetti_code]

As a foreigner who was working in the US for a number of months (all above board - my US based employer stationed me there) - I was forced to get by without a SSN.

I had all sorts of issues including (a small sample):

• having my VISA card rejected because it wasn't an "American" VISA
• having my passport labelled a forgery at a bank because the date was 14/6/68. To quote the teller "there's no 14th month". Let me tell you - that creates an interesting scene in a busy bank.
• being given checks by another bank, which were rejected by almost everyone because their starting number was too low. Then the bank cancelled them because of my lack of SSN.
• the supermarket wouldn't let me use checks because I didn't have an SSN.
• being offered a discount at the checkout on an expensive item if I signed up for a loyalty card. I said I didn't have an SSN. No problem they said. 30 minutes of head scratching and phone calls later, the checkout and manager and manager's manager gave up. Sorry they said. You need an SSN.

Eventually I got a fake SSN from a website that has lists of unused SSNs and everything went a lot smoother.

Re:SSN

[Eivind]

How about instead stopping the idiocy of confusing identification with authenthication ?

A SSN is a perfectly fine and perfectly way to establish that we're talking about the same person. Names, adresses, birthdates whatever all break down here. (there is more than one "John Smith", there could even be more than one with the same birthdate, furthermore it's perfectly possible that "Ann Smith" is the same person as "Ann Kulstad", she could've married.)

For this purpose, making certain that two records really refer to the same person, SSN is fine. A unique key that refers to an individual.

Now, where you guys went wrong where in confusing this with authenthication.

The very fact that you use your SSN to *identify* which person you're talking about means that lots of different organisations and individuals *MUST* know your SSN. That ain't a problem. The problem is in assuming that whoever is aware of your SSN *IS* you, or is authorized to order credit-cards in your name, or whatever else.

We've got SSNs in Norway too. They're not particularily secret. The tax-people have them. Your employer has it. Your bank has it. They all even *need* to have it, to *identify* you. Your employer, for example, pays taxes, and uses your SSN when communicating with the tax-people so that it's clear for which individual these taxes are.

But here's the rub: Knowing the SSN is never *ever* considered authentication. You cannot order a credit-card in someones name just by knowing it. Nor access their bank-account, or infact do *anything* you couldn't just aswell have done without it. Except for ONE thing: If you know the SSN, you can use it to refer to an individual, in such a way that all involved will know for sure precisely *which* individual you're talking about.

The account is owned by individual X, the taxes are paid by individual X, the drivers-licence was issued to individual X, and we all (the bank, the employer, the drivers-license-people, etc) agree that this is infact one and the same individual, despite the fact that one of us spelled his name wrong, he has married, he has moved, and there's 17 other people with that precise name in Norway.

*THAT* is the point of a SSN.

You cannot at the same time give your SSN to dozens of different organisations (which you need to do if using it as an identificator shall work) and at the SAME time pretend that it's a secret that only the individual himself would ever know.

I dunno why USA persists in the stupidity.

Point out to your local normalization DBA

[Marxist Hacker 42]

That SSNs are non-unique. They used to be, but thanks to illegal immigrants, ID theft, and a lot of other problems, SSNs simply aren't unique anymore, and thus are not a good identifier.

Thought it was actually illegal

[kbob88]

I used to work in the IT department of a managed care company in the early 90s, and seem to remember something about it actually being illegal to use the Social Security Number for any other purpose (than running Social Security and the IRS). Of course, we (and every else in healthcare) still used it as a primary numbering/identification scheme. Not sure if the illegality was true or not.

From the Social Security Administration:

• "[Makes] misuse of the SSN for any purpose a violation of the Social Security Act"
• "Unlawful disclosure or compelling disclosure of the SSN of any person a felony, punishable by fine and/or imprisonment."

You might be surprised...

[BenEnglishAtHome]

...that my employer, a place flat-out driven by SSNs in many aspects of our work, wouldn't think of using them for anything internal that isn't mandated by law. We issue to everyone a 5-character ID that's used for signons and all sorts of IDs. We used to use a contraction of the user name, but even that has been 95% phased out for years.

It's not that difficult to quit using SSNs and it's just good policy. I'm surprised that they are still so commonly used in situations where they might be disclosed to anyone but the person to whom it belongs.

SSNs?

[JohnWiney]

My employer doesn't, because none of his employees has an SSN.

Re:You think you have it bad?

[parasonic]

How about the law that you shall not be identified by your SSN?

How about the law that you shall not be required to give more than the last four digits of your SSN?

No wonder there are "305 lawsuits" per average company per year...

Good thing federal law prevents that.

[BKX]

Or at least allows you to. All universities and colleges MUST allow you to change your student ID to something other than your SSN if you ask (and are encouraged to not use SSNs anyway, though not required). It's federal law (a law passed about five years ago, I beleive). Ask and you shall receive. If you don't, sue and you shall receive even more.

Re:You think you have it bad?

[BandwidthHog]

Neither of those laws you mentioned actually exist.

A business can ask for an SSN when you attempt to buy a nine volt battery with exact change. Perfectly legal. You can, of course, refuse such a ridiculous request. Also quite legal. They can then decline to do business with you. Just as legal.

It’s only the government folks that are prohibited by law from demanding SSNs.

i'm a victim

[feld]

i live in WI and someone in Milwaukee (with many, many previous addresses) is reporting my SS. I have no idea how or where they are reporting it, but they're in the database with my #. They have never used it for financial things yet, though, so my credit is fine. I reported this to the cops several times but they won't do anything about it because they arent using it for credit related things. This pisses me off to no end.

I have the original SS card in its original envelope from 2 months after I was born.

I had a hard time explaining things to employers when I was a teenager because they'd do checks of some sort and find this other guy's name.... notably Radio Shack and Menards (Like Home Depot) were the main ones causing problems over it.