Slashdot Mirror
Same Birthday, Same Social Security Number, Same Mess For Two Florida Women (cio.com)
itwbennett writes: After 25 years, the Social Security Administration (SSA) has fessed up to giving two Florida women who shared a name and a birthday the same social security number. The women only recently discovered that they shared an SSN, but not before having trouble getting loans and having tax returns rejected. You might think that the SSA would catch something like this, but as it turns out, they are prohibited from trying to verify the legitimate owner of an SSN, except in rare cases, says Ken Meiser, VP of identity solutions at ID Analytics, provider of credit and fraud risk solutions. And the problem isn't as rare as you might think (except for the part about two women with the same name born on the same day in the same state). According to a 2010 study by ID Analytics, some 40 million SSNs are associated with multiple people.
The article definitely makes it sound like it was a mix up due to the two babies having similar names (Joanna Rivera vs. Joannie Rivera), having the same birthday, and being in the same general area.
The article lists some red flags that should have been raised (two addresses listed as being active, the IRS getting W2 forms from two employers that weren't even near each other, etc). In my experience, though, companies and government agencies don't mind missing red flags. Red flags mean that someone has to put in extra effort to resolve the issue. Ignoring the red flag, though, means that you continue doing what you're doing and it becomes someone else's problem.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
Born in same area, same date, same first three letters of last name-- expect collisions. That is how the formula works for allocation, and I am sure real-time checking wasn't done due to "low probability."
Banks are, but AFAIK, the credit bureaus aren't. They're the root of the problem. If the credit bureaus really wanted to end so-called "identity theft", they could do it very easily. It would simply require them to invest the money to perform a callback authentication to all registered phone numbers prior to issuing new credit. Boom. No more "identity theft", or at least so many orders of magnitude less that the remainder could be treated as noise.
I put that in quotes because your SSN isn't a true identity, at least by the cryptographic meaning of the term. It's an identifier. An identity is something that can be used to prove who you are. An identifier is something that stands in for who you are. A proper identity should roughly guarantee non-repudiation. An identifier does not, because it is not secret. It is not possible for someone to steal a true identity, or anything that even approaches one. It is trivial to steal an identifier; it need only be shared once, and then it is no longer secret.
Thus, "identity theft" is a misnomer. It should be called "SSN theft", or even "unauthorized SSN use". But if we call called it that, then the credit bureaus couldn't pretend that the problem is a serious problem caused by a bunch of bad people, rather than an entirely artificial problem of their own making....
The again, if everyone who found a false entry on his or her credit report sued the credit bureau for libel, the problem might just take care of itself.
Check out my sci-fi/humor trilogy at PatriotsBooks.
Thus, "identity theft" is a misnomer. It should be called
Fraud. Nothing more, nothing less. Lies for gain. Why would there be any confusion on the matter? Oh yeah, if you call it bank fraud, the bank would pay for their loss. When you call it identity theft, you blame the victim for the bank's poor security and reduce the bank's loss.
Learn to love Alaska