Slashdot Mirror
Same Birthday, Same Social Security Number, Same Mess For Two Florida Women (cio.com)
itwbennett writes: After 25 years, the Social Security Administration (SSA) has fessed up to giving two Florida women who shared a name and a birthday the same social security number. The women only recently discovered that they shared an SSN, but not before having trouble getting loans and having tax returns rejected. You might think that the SSA would catch something like this, but as it turns out, they are prohibited from trying to verify the legitimate owner of an SSN, except in rare cases, says Ken Meiser, VP of identity solutions at ID Analytics, provider of credit and fraud risk solutions. And the problem isn't as rare as you might think (except for the part about two women with the same name born on the same day in the same state). According to a 2010 study by ID Analytics, some 40 million SSNs are associated with multiple people.
8675
I would assume that it is not a coincidence that two women with the same name and same birthdate got the same social security number; I expect that when the second application came in, they checked the name and birdhday and assumed that it was a duplication of the first application, and just send out "here is your number".
Most of the duplicates are due to fraud by illegals.
309
What is there to explain? Americans hate the idea of the UID *because* they all have direct experience with having a SSN. The way the SSN is, it is like having a password for very important things, but one that you have to give out to every street vendor to verify you as well. Identity theft nightmare for the owner.
while(1) attack(People.Sandy);
Nothing much to explain - we just issue duplicate SSNs to avoid a unique, centralized ID number system.
SSN started out merely as an identifying number to record social security payments. After awhile, though, it morphed into a number that identifies you for everything. However, this isn't a very secure number and it can be compromised in any of a dozen different ways. Combine this with a person's name and date of birth and you can do some horrible things to their credit rating while raking up huge debts in their name.
I know this first hand since I'm a victim of identity theft. Someone got hold of my name, address, DOB, and SSN (how, I'll never know). They opened a credit card in my name. (Despite, I might add, getting my mother's maiden name wildly wrong. So much for that "security question.") The only thing that kept this nightmare from being much, much worse was that they paid for rush delivery of the card and THEN changed the address on the card. The card was sent to me before the address change went through so I was able to shut the account down before any real damage was done. Of course, I still need to have my credit frozen for the rest of my life since my information's out there and could be used at any moment.
Fortunately, there have been enough identity theft stories in the news to make people aware of the situation. Unfortunately, too many companies require you to give your SSN when they don't really need it and too many people just assume "it's required so I have no choice."
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
...my company's accountant told me that someone in Los Angeles had used my SSN and the IRS was trying to garnish my wages. She told them that I was certainly not Mr. Aguilar and that I was not responsible for Mr. Aguilar's debt to the IRS. Seems like a simple thing but she was not supposed to tell me about the incident. Because if the proles ever found out how often this happens, they'd lose faith in the integrity of The System. I, as the taxpayer and rightful SSN holder was never contacted by the IRS to either collect money or warn me that there was someone out there using my SSN, possibly ruining my credit.
I'm pretty sure that most of the "40 million" are sharing a SSN with somebody who died *years* ago, and that the number of people like the two women cited as an example is much, MUCH smaller.
I mean, for ${deity.name}'s sake, there are only ~300 million *AMERICANS*. If one in 8 Americans had SSN collisions with another living person, I can *guarantee* it wouldn't have taken until now to be newsworthy.
That said, the gov't really needs to add at least a digit or two. Just adding one digit & making every existing SSN end with "0" until 2025 (to allow a graceful transition where existing 9-digit numbers would have an easily-derived 10-digit value) would give them enough unique numbers to go a few centuries without ever reusing a number.
Why would you add the digit on the end and break every system in existence? Much better to add it to the left like a normal number then the zero is completely optional unless you have a 10 digit SSN. Reusing SSNs is a stupid idea. Just start giving babies and new applicants 10 digit, then 11 digit numbers, etc... If everyone in 2016(or 2017 if you want to give a little more time) got a SSN greater than 999,999,999 then existing systems would adapt quickly, many probably already support ID fields greater than 9 digits as there are alternate IDs like passport numbers and foreign IDs already in existence that probably exceed 9 digits. The other alternative would be to go to alphanumeric IDs for new applicants.
Personally, though, it might be better to break the system and fix it right. Why do you need a non-changing number? Credit card companies and even banks have the ability to reissue you a new number if your previous number is compromised. Credit card companies sometimes even send you a new number every few years just for safety. A standard USA credit card is 16 digits, I would propose a 16 alphanumeric SSN that changes every year and can be invalidated at any time. When you file your taxes, you file it with the current year's SSN and then when it's complete, they send you a new SSN to use the next year. As long as each SSN is chained to the previous one, they you still have the ability to track what is needed but finding a 3 year old number is now worthless.
The way the SSN is, it is like having a password for very important things, but one that you have to give out to every street vendor to verify you as well. Identity theft nightmare for the owner.
No.
The problem isn't what the SSN is. The problem is the way the SSN is used.
I'm Spanish. In Spain we have a national ID system, and I have my own ID number. However, we don't use this number as a password in order to verify that we are who we say we are. It's used more or less as an index in a database. You can easily find my national ID number with a simple Google search. Mine, and probably every other Spanish citizen's. No big deal about it.
In you case, what's going on is that a bunch of clueless policy makers working for businesses decided that the SSN would work fine as a way to identify people. It's not. You're using it wrong.
My site
SSNs aren't unique. This has been known for a long time - it was discussed in the C user's journal back in the 80s.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
Your mother's maiden name isn't an identity check. It's like "What's your first pet's name". Nobody has the name of your first pet in a big database used to verify your identity. It's just a passphrase that can be anything. In fact, you should use something other than your mother's actual maiden name. Anyone can do a bit of research and find out your mother's maiden name. But they can't do research to find out the fake name you used so they won't be able to use that information to take over an established account.
The US social security number as an id is seriously broken. After consideration, I'd epect my ssn to be in at least 100 poorly-secured databases: bank accounts, insurance accounts, doctor/dentist/hospital facilities, employers, etc. The number is hardly secret, yet there are about 350M persons in the USA and only 1000M distinct ssns.
A better system would redefine a ssn as two components. A 9 (or 10?) digit public number would signify who you are -- lotsa entities need to know that -- and a 6-7 digit secret number would prove that you are the person associated with that ssn. It is pure hell when the first number needs to be changed (witness protection?) but the second number could be changed often and with little overhead or impact, whenever one suspects it has been compromised. The current electronic fiduciary networks would be sufficient and secure enough to support and manage this.
Unfortunately, the US Congress will eventually try to fix these problems by passing laws, making things illegal, rather than passing technology that makes violations almost impossible.
> The US social security number as an id is seriously broken. After consideration, I'd epect my ssn to be in at least 100 poorly-secured databases: bank accounts, insurance accounts, doctor/dentist/hospital facilities, employers, etc. The number is hardly secret
More specifically, it's fine as an IDENTIFIER, and ID must necessarily be different from AUTHENTICATION. My name identifies me (approximately), my password authenticates me.
To be useful, a personal ID must be more or less public - the name "Barak Obama" is useful only because everyone knows who that is, it's public. Also, in order to be useful, authentication information must be private. So as you said, two pieces of information - one that is the ID, the other is the authentication.
This seems obvious, but people who should know better routinely treat user names as "a little bit secret". This is wrong. It's either secret, in which case it's hashed so nobody can read it, and it can be trusted to be secret, or it's it's not. Since a user name is not protected as a secret, don't start thinking that maybe it's a little bit secret, kinda maybe, and start putting any trust in people not knowing it. User names aren't hashed, they are sometimes displayed, so they aren't secret. Not even a little bit (especially not a little bit).
Banks are, but AFAIK, the credit bureaus aren't. They're the root of the problem. If the credit bureaus really wanted to end so-called "identity theft", they could do it very easily. It would simply require them to invest the money to perform a callback authentication to all registered phone numbers prior to issuing new credit. Boom. No more "identity theft", or at least so many orders of magnitude less that the remainder could be treated as noise.
I put that in quotes because your SSN isn't a true identity, at least by the cryptographic meaning of the term. It's an identifier. An identity is something that can be used to prove who you are. An identifier is something that stands in for who you are. A proper identity should roughly guarantee non-repudiation. An identifier does not, because it is not secret. It is not possible for someone to steal a true identity, or anything that even approaches one. It is trivial to steal an identifier; it need only be shared once, and then it is no longer secret.
Thus, "identity theft" is a misnomer. It should be called "SSN theft", or even "unauthorized SSN use". But if we call called it that, then the credit bureaus couldn't pretend that the problem is a serious problem caused by a bunch of bad people, rather than an entirely artificial problem of their own making....
The again, if everyone who found a false entry on his or her credit report sued the credit bureau for libel, the problem might just take care of itself.
Check out my sci-fi/humor trilogy at PatriotsBooks.
Thus, "identity theft" is a misnomer. It should be called
Fraud. Nothing more, nothing less. Lies for gain. Why would there be any confusion on the matter? Oh yeah, if you call it bank fraud, the bank would pay for their loss. When you call it identity theft, you blame the victim for the bank's poor security and reduce the bank's loss.
Learn to love Alaska