Researchers say they can guess your SSN
Posted: Monday, July 6 2009 at 04:59 pm CT by Bob Sullivan
There’s a new reason to worry about the security of your Social Security number. Turns out, they can be guessed with relative ease.
A group of researchers at Carnegie-Mellon University say they’ve discovered patterns in the issuance of numbers that make it relatively easy to deduce the personal information using publicly available information and some basic statistical analysis.
The research could have far-ranging implications for financial institutions and other firms that rely on Social Security numbers to ward off identity theft. It could also unleash a wave of criminal imitators who will try to duplicate the research.
Details of the research were published Monday in the Proceedings of the National Academy of Sciences journal and will be explained at the annual Black Hat computer hacker convention in Las Vegas later this month.
The report means companies and other agencies should once and for all stop using Social Security numbers as passwords or unique identifiers, said Professor Alessandro Acquisti, who authored the report.
"We keep living as if they are secure, a secret," he said. "They're not a secret."
The Social Security Administration says SSNs are issued using a complex process that is effectively random, making them impossible to guess in practical terms. But Acquisti and fellow researcher Ralph Gross used public lists of Social Security numbers to look for patterns. They found several. The two say they can guess the first 5 digits of the Social Security number of anyone born after 1988 within two guesses, knowing only birth date and location. The last four digits, while harder to guess, can be had within a few hundred guesses in many situations -- a trivial hurdle for criminals using automated tools. "Someone filling out credit card applications using a Web site and a botnet could easily succeed (in getting someone's number)," he said. ‘Public should not be alarmed’ Acquisti shared the report with the Social Security Administration’s office before publication. He said he could not disclose what steps the agency is taking in response to the research. The Social Security administration played down the discovery. In a statement to msnbc.com, Social Security spokesman Mark Lassiter called any suggestion that Acquisti had cracked the code for predicting Social Security numbers “a dramatic exaggeration.” “The public should not be alarmed by this report because there is no foolproof method for predicting a person's Social Security Number,” the statement read. But privacy expert Daniel Solove, a law professor at George Washington University who reviewed the report, called the discovery a “really big deal.” “If you have a password and you can readily figure it out, that’s absurd,” he said. “This paper points out just how ridiculous it is that we think there's a way to really keep Social Security numbers confidential. There effectively is no way you can keep them totally confidential. It’s just not possible.” How it works Acquisti said he’s discovered simple patterns in the Social Security numbering system. It involves the elusive concept of randomness. To most people, a number is either random or it's not. But to mathematicians, randomness is a sliding scale. Developing perfectly random numbers -- the science of cryptography -- is nearly impossible. Often, software programs designed to create random numbers erroneously spit them out with a faintly distinguishable pattern. With a large enough sample, the numbers begin to form clusters. Even a small discovery of such a cluster can make an enormous difference to someone trying to crack a crypto code, making predictions of supposedly random numbers an order of magnitude easier. That's what the Carnegie Mellon researchers found. A completely random guess at a 9-digit SSN should be a one in one billion chance. But instead, their newly educated guesses have narrowed the odds down to roughly 1 in 1,000. Making matters worse, because of changes in the way the numbers have been issued since 1988, the numbers are getting easier and easier to guess as time passes. In one example, the researchers said, they can uncover a Delaware resident's 9-digit SSN within 10 guesses about 5 percent of the time. The SSN is actually broken up into three parts - the first three digits are the “area number,” the second two are "group number" and the last four are the “serial number.” The Social Security Administration already offers considerable information about the first part of the number. The area number is based on the zip code used in the application for an SSN. High population states have many area numbers -- New York has 85, for instance – but many others, like Delaware, have only one. The other two parts the number, however, are assigned in a way that the Social Security Administration believes it nearly impossible for someone to guess. But the Carnegie Mellon work shows they are not. He took the largest publicly available list of SSNs -- the agency's master death file, which publishes numbers of the deceased to make them hard to use by imposters -- and sorted the list by state and date of birth. Immediately, it became clear that the second portion -- the group number -- was sequentially issued and also trivial to guess. For example, every SSN issued in Pennsylvania during 1996 contains the middle two numbers 76. That made guessing the first 5 digits of someone's SSN easy in some cases. During a test, the group was able to predict the first five digits of Vermont residents born in 1995 with 90 percent accuracy. That's important, because there are many ways to determine the last four digits of someone's Social Security number. Some data brokers sell truncated SSNs, with either the first five or the last four numbers visible to the purchaser. And many financial firms use those numbers as a PIN code for verification. Also, endless customer service operators ask for the last four digits when consumers call for help. Any agent who knows where and when a caller was born could quickly amass a large set of complete Social Security numbers. The report contains even more bad news. The serial numbers -- the last four digits -- can often be guessed using formulas and patterns, he said. It turns out that the Social Security Administration doesn't utilize true randomization to create serial numbers. For example, a graph plotting the numbers issued to Oregon residents in 1996, shown below, shows bands that cluster around certain numbers. In fact, there are five discernable lines. A truly random issue would show dots scattered throughout the chart. The pattern inside SSNs With additional analysis, Acquisti said, the researchers were able to discern that the serial numbers are issued sequentially, in a way that ties them to the holder's birth date. "The SSA believes that scheme is so complex that it's sufficiently random," he said. "We show it is way less random than apparently they believe.” As a result, instead of a the four digits yielding a 1 in 10,000 chance in guessing SSNs, he said he can improve the odds to at least 1 in 1,000, and in some cases, far less than that. The Social Security Administration seems to agree with Acquisti on this issue. In its statement to msnbc.com, the agency said that “for reasons unrelated to this report, the agency has been developing a system to randomly assign SSNs. This system will be in place next year.” Birth dates easy to obtain For now, an attacker who wanted to guess someone's SSN would still need a birthday and hometown, but these data points are readily available from a number of sources. Many people volunteer such information on social networking sites like Facebook. Voter registration lists and other public databases also include such information, and it is often available for a small charge (or free) from data brokers that operate on the Internet. There are additional challenges in guessing SSNs for residents born before 1988, because many older Americans did not receive a Social Security number at birth -- so their hometown and their Social Security number application zip code might differ. But beginning that year -- in a move ironically intended to combat fraud -- the Social Security Administration began forcing many families to order SSNs at birth, thereby eliminating one more element of chance for a would be SSN-guesser. It’s far easier to guess SSNs for anyone born in 1988 or later, Acquisti said. The formula for issuing the numbers is, in fact, not designed to withstand attacks from cryptography experts or mathematicians. It was invented in 1936 as a simple numbering system for paper file cabinets. "This was before there were computers," Acquisti said. "SSNs were never designed for the purpose we use them." The group is not disclosing the precise formula, because doing so would be akin to publishing the list of all Social Security numbers. But Acquisti said one “provocative” strategy that government officials might take: Setting a date in the future -- perhaps in three to five years -- where all SSNs are made public, so companies and government agencies stop using SSNs for security purposes. He called current efforts to protect Social Security numbers from public view "well intentioned, but misguided.” The researchers recommend that the Social Security Administration immediately implement a much more random formula for generation SSNs. But that won’t help the millions of Americans whose SSNs are now easily guessable. For that, there is only one answer, the report says: “Industry and policy-makers may need, instead, to finally reassess our perilous reliance on SSNs for authentication and on consumers’ impossible duty to protect them,” it said.
Family turns to Facebook when son disappears
EMAIL THIS
TRACKBACKS
Trackbacks are links to weblogs that reference this post. Like comments, trackbacks do no appear until approved by us. The trackback URL for this post is: http://www.typepad.com/services/trackback/6a00d83451b0aa69e2011570d7425a970c
advertisement
BUY BOB SULLIVAN'S NEW BOOK
Bob Sullivan's new book unmasks hundreds of hidden fees and offers step-by-step instructions on how to fight back. Order it here.
Also available as an audio book.
RED TAPE ARCHIVES






what is my Social Security number
mike smith dallas,tx (Sent Nov 7, 2009 8:50:07 PM)
whats the point?? i agree it should be social insecurty number.someone stole my purse 2 yrs ago.along with my ss# ect.they used mySS3 but a different name (not mine)to get online loans.SS office says nothing they can do about it just for me to put alert on my # now i have inf on my report totaling over $2000.00 that i have to fix.I have called the companies that have phone #s but they say send me your ss# and a copy of your drivers license we will see what we can do.YEAH RIGHT!! Nothing is safe anymore!!!!
Tammy (Sent Jul 31, 2009 9:14:44 AM)
I like the researcher who said that they should make public all SSNs. I talked about doing that 15 years ago, since everyone asked for my SSN and I refused to give it. By making all SSNs public, they will render them useless to everyone except the SSA.
Also, what good would it do to issue another unique identifier? Once that got known, you'd be in the same situation we are now.
The best way is to let every company that now asks you for your SSN to instead, make up their own number for you. That's what each company does anyway, only they call it an account number. Let that account number be your identifier with that company. By doing that, we'd each have many different identifiers, and that would make identity theft impossible. The idea here is to protect the consumer, not to make it easy for the credit card companies or any other company that wants to have you as a customer.
Oh, and yes, it did state on your SS card that it was not to be used for identification purposes. When the SSA was asked about that, they said that it meant that you couldn't present it as proof of ID....like you can with a driver's license.(they have since removed that from the newer SS cards.)
Susan Myer, Miami Florida (Sent Jul 28, 2009 3:15:29 PM)
I have live in both Canada and the US, I grew up in Canada, but live here now. When I came down here to live I was amazed at how everyone thinks they the right to ask for my ssn number, in Canada its against the law to ask for your ssn, not the banks, doctors, landlords, or credit card companies, only certian branches of the government or a job have the right to see it. It was not always like that there, but about 20 years ago they just changed it and it went quite smoothly and now your private info is your private info, by the way up there your tax info, medical info, even credit info(you have to sign a paper before anyone can look that up) is all protected and a person cant just go to a web site and look into someones life, its agains the law. We might give some thought to making our life on paper as secure here as theirs is north of the border.
John Doe, Phoenix, AZ (Sent Jul 24, 2009 2:23:15 PM)
thanks for posting a How To Guide for all the criminals out there.....
Washington DC (Sent Jul 24, 2009 1:24:55 PM)
"I recently moved to Ohio and was shocked when applying for my drivers license that people were able to put their SSN on it as an option!!!Ohio has been doing this for years.How dumb is that!!!"
You didn't move that recently - Ohio outlawed that 2 years ago or more.
Jane, Youngstown OH (Sent Jul 9, 2009 8:53:27 AM)
Well if criminals hadn't figured it out..it is nice to know that researchers published a how to guide. Who are these genuises?
Micha, Pittsburgh, PA. (Sent Jul 9, 2009 8:24:25 AM)
I heard that certain places sells SSN, our neighbor an illegal immigrant from mexico got his from a mexican commercial center. He works now in a post office.
resident alien, chicago (Sent Jul 8, 2009 10:14:31 PM)
I use a fake SS number beginning with 98 (illegal for a real SS number) for anyone that asks for it that isn't legally required to get it. Keeps the riff-raff from getting the real thing. I used it to apply for a fishing license and a ham radio license.
Jorick in NH (Sent Jul 8, 2009 9:14:20 PM)
Loose lips sink ships, it's been said. So it's particularly disturbing that Carnegie-Mellon researchers would publish a "how-to" for all hackers and criminals out there on how to decode a Social Security number.
Jordan, Cincinnati, Ohio (Sent Jul 8, 2009 5:39:26 PM)
I applied for my two sons numbers at the same time and the only difference is in the last 4 numbers. I always get them mixed up. they're of by about 993, so I always figured someone did the second application 993 forms later.
john glenn (Sent Jul 8, 2009 5:37:28 PM)
There used to be a federal law (maybe it still exists) that said that nobody had a right to ask you for your SSN except the IRS and your employer when filling out a W-4 for new hires.
Law or no law, the SSN has become a universally used national identification number - next thing we know, the government will be requiring that it be tattood on our arms.
BTW, having written software to validate SSNs for a major financial house about 10 years ago, I already know the algorithm for creating SSNs. It is no secret and I am amazed that the so-called statisticians didn't just look it up. It goes like this:
The first 3 digits are the 'area' and are assigned geographically according to the zip code of the requestor. For example, any number whose area digits are from 159 to 211 was issued in Pennsylvania. The assignments are available publicly at the ssn website (www.ssn.gov).
The next two digits are the group number and they are assigned in a non-intuitive pattern. Within a single area number, the group numbers are issued in this order:
ODD numbers from 01 through 09
EVEN numbers from 10 through 98
EVEN numbers from 02 through 08
ODD numbers from 11 through 99
The third set is the serial number. For each area/group number combo, they start at 0001 and are assigned sequentially through 9999.
So, the first three digits give you a fix on the location. The second two can be referenced against a list of group numbers to give the approximate year/month the card was issued. after 9999 serial numbers are issued, the group is updated according to the above pattern.
For example, if I were applying today for a new card in the area I am working, the number would be 172-84-xxxx indicating a Philadelphia suburb in July of 2009.
This is all old hat and I fail to understand why these guys were wasting their time on it.
Bad Wolf, Stockton, NJ (Sent Jul 8, 2009 1:55:34 PM)
My ex-husbands new wife pays his child support on our 3 kids. She has my SSN and all the kids. She used mine for my credit report and 2 credit cards. The police told me it was no big deal and they can't change Child Support Enforcement laws. I don't like it, she has my info and doesn't like me. Recipe for a bad situation.
C Collins, Detroit, Mi (Sent Jul 8, 2009 8:59:12 AM)
Hell, the illegal Mexicans have been doing this for years... instead of wasting all that money on research why not just ask the typical Coyote or smuggler on how they pick SS numbers that match the names....
eddie s/Certified Gov't Right Wing Radical (Sent Jul 8, 2009 8:50:37 AM)
The documentation with the Social Security card clearly reads "for tax purposes only, not for identification". Opps!
expatinasia, Bangkok, Thailand (Sent Jul 8, 2009 8:32:35 AM)
I love doomspeakers who talk but don't know what they are talking about. The bible does not say anything about microchips. I love how you and others assume that the "mark of the beast" means a microchip. The scripture reads "If anyone worships the beast and his image, and receives his mark on his forehead or on his hand, he himself shall also drink of the wine of the wrath of God " Yeah, that must mean microchips...... 8-P
Mike, Pennsylvania (Sent Jul 8, 2009 7:28:17 AM)
I recently moved to Ohio and was shocked when applying for my drivers license that people were able to put their SSN on it as an option!!!Ohio has been doing this for years.How dumb is that!!!
average joe (Sent Jul 8, 2009 7:26:43 AM)
Some guy in Florida uses my social security number every year to file his taxes and get refunds, tax credits and all sorts of other stuff that I am then supposed to pay for. The government will not tell me that I am working in two places even as they collect taxes from me in one spot with zero deductions in another so that they can "protect" my privacy. Every year the government says I made more money than I did and owe them more for the privilege of working. In Nevada, even if you denied them the ability to put your SSN on your Driver's license it was still used to formulate your DL number and anybody with access to your license had your SSN.
The system is well beyond (financially) broke and broken but don't expect anyone to fix it anytime soon. Our government, bloated bureaucrats and (self)representative-Congress-Critters have much more important fish to fry in the takeover of this nation.
Eclectic Ward, Flanigan, Nevada (Sent Jul 8, 2009 7:14:47 AM)
Beware of online job applications that require your SS number, and they all do ask for it that I know of, because my son had his identity stolen this way just a few weeks ago.
KrazyKake, Delbarton, WV (Sent Jul 8, 2009 7:00:46 AM)
this isfunny. Every company uses your SSN and its very easy to see the randomness is a joke. the system needs an overhaul. AS far as the microchip bit being the Mark of the beast- lol i laugh at it. honestly look at every bar code we purchase now a days- all have 6 at the begining, middle, and end - the mark is there!
John Doe, hicksville (Sent Jul 8, 2009 1:57:41 AM)
This is why SSN's were never supposed to be used as ID - it used to even say on the stupid card. The fact that this number is now used for everything is so absurd.
D D, Bisbee, AZ (Sent Jul 8, 2009 12:25:47 AM)
Just listen to the police scanner around here. Many times the police run an ID thru dispatch, they give Name Address and SSN over the air. How convenient that law enforcement is helping identity theft.
Randy, Richmond, Missouri (Sent Jul 7, 2009 11:58:39 PM)
Hiya.
hmmm...Yay! our goverment has reached a new low. perpously making it so we can get screwed over in our sleep.
Yeah...I was able to verify part of there evidence.
I suppose these people will now support chipping people as a solution.
Not good.
John Doe, Seatle, Washington (Sent Jul 7, 2009 11:02:17 PM)
I'm not afraid of putting my SSN out there.
Todd Davis 457-55-5462 (Sent Jul 7, 2009 10:39:17 PM)
I got my Social Security number when I was 24 and recently out of university. I'm German and learned to speak English without much of an accent while in school in the USA, and stayed for an additional year at Lake Tahoe after school, worked odd jobs and had a very good time. I suspect the clerk in the little social security office thought I was the son of a rich family that hadn't needed to work previously--few questions, as I recall and no need for more than my California drivers license. Will you save some benefits for me?
Ralf Von Bustenhalter, Berlin, Germany (Sent Jul 7, 2009 10:31:43 PM)
My credit card number was stolen and used over the internet Department store websites and on e-bay. I suspect it was copied using a cell phone by an employee of an optical store where I purchased my glasses. That was on a Friday, by Sunday I was missing 3 grand from my checking account. fortunately for me the account was backed by Visa and I accidentally caught it that weekend because I called the automated system to check on a completely different transaction. I notified all parties, took men's shoes that were ordered online back to Sears, mailed back engraving tools to the man that thought he had a good sale on e-bay. Met with fraud detectives. For a few days the calls were endless. I'm very fortunate, in a way that they didn't really steal my identity, they just took my Debit card for a joy ride. Don't think it can't happen to you, it can. Now I like my bank, but they also use the last for of my SSN number as one of the ways to identify me on the phone. Oh, I did get all of my money back. I left a much longer post that should pop up soon.
Trixie Belden, Olympia, WA (Sent Jul 7, 2009 10:09:16 PM)
By god you tell them fools ain't nobody scared by their ole scams!
Jesse James, Bucksnort, TN (Sent Jul 7, 2009 9:53:52 PM)
Jane Doe is absolutely right about microchipping being the mark of the beast, and that means our souls will go to Hell if we take it. As for asking why the information in this article would be published and make it easier for the thieves, someone is trying to put enough fear into the people so that we will demand to be chipped, and it will seem like it was our idea instead of the government's. No, thanks!
Stan Anderson (Sent Jul 7, 2009 9:44:56 PM)
I work in a courthouse in the Felony division. The SSN is listed prominently on most of the arrest reports and anyone can get a copy...it's public record. Don't be a fool and think your SSN is protected...it isn't. Also, SSN's used to be listed on deeds and mortgages. If your county courthouse has your records on microfilm, anyone can get on a machine and browse for SSN's. Recording offices are now required to redact SSN's from online image archives, but the older stuff from the mid-nineties and back is up for grabs.
Sam Smith, Tallahassee, Florida (Sent Jul 7, 2009 9:16:59 PM)
RE:Mitch, Seattle, Wash (Sent Jul 7, 2009 12:00:33 AM)
Washington Mutual and Jane Doe (she of the mark of the beast) apparently have their heads up the same rear end.
It's a number. It's public information. Get over it.
Larry the Fable Guy (Sent Jul 7, 2009 8:00:48 PM)
For those who complain that they must provide their SSN to doctors and on insurance forms, you no longer have to do so. For the last several years Federal privacy laws require insurance companies to provide you with an AMI (alternate medical identifier). They are no longer allowed to send anything with your SSN through the mail, including your insurance card. So the AMI will be on your card (member number). So when you fill out a form at the doctor's office, just leave the SSN line blank and tell them to use the AMI from your card. Federal law (HIPAA) also prohibits health care providers and other entities from collecting info they don't need. So since the insurance company must process your claim using an AMI, there is no need to give the doctor your SSN, and they shouldn't even be asking for it per HIPAA. Sadly this is not true for MEDICARE. Medicare cards carry your SSN, and the Federal Govt doesn't require itself to adhere to the same laws required for Insurance companies. Classic case of "Do as I say, not as I do."
Molly Grant, Hartford, Conn. (Sent Jul 7, 2009 8:00:15 PM)
Problem solved; lets just call them Social Insecurity numbers
CKJ (Sent Jul 7, 2009 7:55:29 PM)
“Industry and policy-makers may need, instead, to finally reassess our perilous reliance on SSNs for authentication and on consumers’ impossible duty to protect them,” - The need an overhaul, not a reassessment! The fact that they tie people's entire identity to a number for life is ridiculous and it was never meant to be that way - and should not be now.
GoodGurl, Detroit, MI (Sent Jul 7, 2009 7:46:47 PM)
ha-ha! good one, jane doe from seattle. microchipping is "prophecied in the Bible as the Mark of the Beast and all who take it will have a free ticket to hell" woo-hoo! fire up the bus, kids, we're going on a road trip
still laughing, philadelphia, pa (Sent Jul 7, 2009 7:34:38 PM)
I have a bone to pic with this identification thing. I get calls from people demading to know my identity. I usually respond with a demand to know their identity. I think everyone should follow suit. Who do you know that's really calling. First they are probably bill collectors .... The chances of you ever reading this are slim to none ...
Richard Stanley, Buffalo, New York (Sent Jul 7, 2009 7:31:54 PM)
In 1972 I worked in a state Employment Office that required SSNs on your application. I could look at the first five numbers and tell where someone was born and approximately what year. It was easy and I'm not into math or cryptography - in fact my math skills suck. If I could figure it out within a short period of time - I worked there 2 years - without even trying I'm sure it's doable by the "experts".
Fortunately I was born before mandatory SS cards were issued and I moved from the state which issued my card.
J Roberts, Washington, DC (Sent Jul 7, 2009 7:24:09 PM)
OBSOLETE
JOhn DOE ,SEattle,wa (Sent Jul 7, 2009 7:01:58 PM)
Social Security numbers were never designed to be used commercially. To end identity theft, lawmakers must revert to the ID numbers' original use; for Social Security ONLY.
Albie (Sent Jul 7, 2009 6:23:47 PM)
The Texas Workforce Commission (our state's employment agency) requires that we keep track of our job search on an official form that asks for SSN. I must have filled out 4 or 5 of these before realizing what an incredibly stupid requirement that was.
Mark B (Sent Jul 7, 2009 6:17:28 PM)
Those CM researchers need to check out the internet first & save themselves the hassle of "research." This is old news. I read about this on the internet several years ago. There are even websites that will tell you the first 5 digits of you SS# if you tell it your birthdate & birthplace.
Debra, WI (Sent Jul 7, 2009 6:14:10 PM)
What surprises me is the amount of old folks commenting on this article saying "herruummm harr it's no big deal".
Just because you got your SSN outside of your original hometown after you were done walking 13 miles uphill in the snow to school does NOT mean your SSN still can't be calculated by these here newfangled computermajiggers.
More difficult, yes... but anyway, the point is if someone is really itching to grab your identity, they'll find a way to make it happen. It's sad and ridiculous, but true.
dal, orlando, fl (Sent Jul 7, 2009 6:13:12 PM)
I wrote to my Congresswoman (Judy Biggert) to suggest the IRS be stopped from requesting people put their SSN on checks submited to them. On that one piece of paper, which is handled by who know, who is your full name and address already. To me that is too much info in one place outside my control. She didn't understand the issue and sent back a generic reply.
LS suburban Chicago (Sent Jul 7, 2009 6:01:33 PM)
It's not paranoia if they REALLY ARE out to get you. I was just swindled out of a large chunk of my retirement savings by an organized crime syndicate of criminal capitalists. You finger the kingpins of the cult of the greedy, and they just claim "Executive Privledge". The media refuses to discuss the absence of a personal code of ethics by the alien culture that has infiltrated our system. The government has gone mustang. Law enforcement's mission has been changed to "Serve and protect the cult of the greedy".
What the working class would like to hear is that the Federal Government had locked the doors from the inside and run a hose from the tailpipe into a window.
Nelke Stall, SS#838-65-9213, Main Street, U.S.A. (Sent Jul 7, 2009 5:25:46 PM)
When I moved to Hawaii in 1990 I was shocked that your drivers license number was your SSN! So right there on the ID you show everyone is your name, address, DOB and SSN. Not smart, bruda!
No Island Girl, Seattle, WA (Sent Jul 7, 2009 5:10:16 PM)
[posted by]Walla Walla Worshington, DC (Sent Jul 7, 2009 8:17:32 AM)
[Quote]Well my Husband and his father SS# was applied for at the same time at residency. Guess what, only the las number is different and only increase by one digit.
ex. SS1 654-26-5612, SS2 654-26-5613 weired..[Quote]
HEY THATS MY SS# WHAT GIVES YOU THE RIGHT TO POST MY PERSONAL INFORMATION ON THE INTERNET. YOU WILL BE HEARING FROM MY LAWYER
Bobby Tucson (Sent Jul 7, 2009 5:04:39 PM)
I find it strange that they're supposed to be somewhat sequential. My brother, husband and I were all born in the same hospital in the same city. Brother was born in July 1984 and hubby in October 1984, and the first five digits of theirs are completely different. I was born in October 1985 and the first five digits of mine are exactly the same as my brother's, but not my husband's.
R Estes (Sent Jul 7, 2009 4:57:01 PM)
The real problem is that when banks royally screw up and give money to the wrong person, they blame the person who they thought was.
If someone says
"I'd like a loan for Mr. Wilson for $1000" and I say
"Who are you?" and he says
"Why Mr. Wilson of course" and I say
"Good enough for me"
and then it turns out I gave it not to Mr. Wilson but to Mr. Rat instead I blame Mr. Wilson for my royal screw up?
If the banks get it wrong when they are mailing their money to total strangers no one has ever seen, why are they blaming us, the victims of "identify theft"?
Banks need to stop foolish cost cutting measures and spend more time and money verifying people are who they claim they are and stop handing out tens of thousands of dollars by mail.
Banks are responsible when they give money to the wrong person, not us!
Alan, Washington, DC (Sent Jul 7, 2009 4:31:41 PM)
Listen, there IS NO SUCH THING as privacy anymore !!
Anybody can get unlisted phone numbers, birth certificates, driving records, probably medical records.
With all the social media, internet and 24/7 communication, privacy is a thing of the past.
Social Security is tired and needs to be overhauled and changed.
KB Missouri (Sent Jul 7, 2009 4:23:48 PM)
DOH!!! I've known it for a very long time, the pattern of the SSN and I'm not even a natural born American! I just saw mine and my mother's when we got our citizenship, and realized that the first 5 digits were the same! I was a kid then!!! My mom had to get one for me for tax purposes. So, is this a big deal? It's a big deal only if we continue to rely on the SSN as a national identification system, which it was NEVER MEANT TO BE ANYWAY!
Sheiglagh, Dallas, TX (Sent Jul 7, 2009 3:25:58 PM)
It's funny that my SSN is more valuable than the benefits I will receive.
Why does the VA still use SSNs on their ID cards for benefits?
Libra, Las Vegas, NV (Sent Jul 7, 2009 2:51:40 PM)
Frankly, I want to meet the man who has the stones to steal my identity. Yes, the man with the guts to get up every morning and face the day as ME. He can have my wife. He can have my bills. He can have my criminal record. He can have my credit rating and I will be happy to introduce him to my bookie!
Peter R LeVan, Reading, PA (Sent Jul 7, 2009 2:16:08 PM)
The problem isn't the security of SSN's, it's the treatment of those who commit crimes using them. when our government says anything is a 'serious crime' you have to laugh because the punishment isn't serious. Cable TV, free room and board, weights, etc.? Laughable.
Until we start publicly executing identity theives we will always have this problem. I'm not saying we torture them. I'm saying we simply put them to sleep and be done with it. But of course I'm sure some bleeding hearted moron will argue for an identity theft's rights as though that thief is a positive contributing member of our society. Perhaps the only way to stay safe in this world is to join the ACLU, NAACP or become a criminal defense attorney because the criminals aren't likely to go after someone they know is on their side.
Not Surprised (Sent Jul 7, 2009 1:53:55 PM)
My company once required us to sign into training classes by writing our name and SSN on a piece of paper that was passed around the room. I would write BR-549 as my SSN just to piss of the managers. My company also once required a manager's SSN to be placed on your annual review. Sometimes you just need to kick the paper pushers out of the way and correct the system.
Retail Worker, Everywhere USA (Sent Jul 7, 2009 1:30:39 PM)
Won't we be in need of a new numbering system soon anyway? A 9 digit number only allows for a billion variations. About half of those numbers are already spoken for. Based on the rate they're handing them out now, they're going to run out of numbers some time this century. No better time than the present to start implementing a new, more secure system.
Ray B., NYC (Sent Jul 7, 2009 1:14:48 PM)
This is indeed old news. While I was active duty military and using the dining facility daily, we were originally issued meal cards to show that we were eligible to use the facility. This policy was later changed to use our service numbers (which are our SSNs) which were entered into the cash register / computer. I remember well one lady who would cashier who could always tell us what state we were from and roughly which year we were born. This was nearly 20 years ago, before identity theft was so common...
Not Surprised, Grand Rapids, MI (Sent Jul 7, 2009 12:57:33 PM)
When Social Security was instituted, there was a lot of resistance to creating a "national identification" system - it was never intended to be used in most of the ways that it's used today. My old card actually said on it in red letters "NOT TO BE USED FOR IDENTIFICATION." It was universally ignored, and modern cards don't even bother saying it.
Grumpyoldlady (Sent Jul 7, 2009 12:41:38 PM)
sorry Jane Doe, Seattle, Washington (Sent Jul 7, 2009 12:24:07 AM),
Re-read your bible. there is nothing in there that says anything about putting a "chip" in your had or forehead.
Bob, Ada Ohio (Sent Jul 7, 2009 12:32:28 PM)
Unmentioned is the important fact that many organizations use the last four digits of your SSN as an identity protection measure. How many times have you been asked for the last four digits of your SSN this year? And what if one of those people used that number to find out your SSN... within two guesses...
Matt, Scranton, PA (Sent Jul 7, 2009 12:27:00 PM)
does that program work for the powerball?
herb, seattle (Sent Jul 7, 2009 11:56:24 AM)
No Big Deal. I have 2 brothers and all of our SSN's are sequential.
Jim, Denver CO (Sent Jul 7, 2009 11:42:45 AM)
I can guarantee you these "researchers" will not be able to guess my SSN based on my DOB and place of birth. I know that the first 5 digits are based on that, but what about someone who was born outside of the US, but was assigned their SSN in the US in a state that is not their home state? Yeah...so much for "accurate guessing"
Johnny Tran, Washington DC. (Sent Jul 7, 2009 11:40:10 AM)
in the eigths grade my whole class applied for social security numbers together. all the applications were mailed together, and as far as i know, all the numbers were sequential.
bruce Blazo stamford, NY (Sent Jul 7, 2009 10:44:25 AM)
What I don't understand is that after years and years of giving out our social security numbers to anyone who asked in the mid 20th century, why do we now think that we can protect it from being "discovered" by ANYONE just because we don't as freely give it out today? The damage was done LONG ago when we were lied to by the government when it told us it would NEVER be used as an identification number.
ND, Texas (Sent Jul 7, 2009 10:26:05 AM)
I didn't get my SSN until I was in High School and got my first after school job. Location - moved a few years later. Hard to track me I bet!
D. J. - Hickory, NC (Sent Jul 7, 2009 10:21:23 AM)
Only a statistician would try to prove their point with this comment:
"...they can uncover a Delaware resident's 9-digit SSN within 10 guesses about 5 percent of the time."
This is almost as slick as when Bill Clinton talked to the grand jury about the meaning of the word "is".
Rob Radina - St. Louis, MO (Sent Jul 7, 2009 10:04:45 AM)
The advice in this article is a total non-sequitir: First the researcher reveal that they have devised a method for guessing your SSN with relative accuracy and ease, and then they say this means that "companies and other agencies should stop using SSNs" for their IDs.
...If your SSN can be guessed, why does it matter in the least if your SSN is used as an ID?
David Auslander, Washington, DC (Sent Jul 7, 2009 9:52:38 AM)
let's not make big news of this
Jim, Beaverton, OR (Sent Jul 7, 2009 9:42:48 AM)
I agree with the cooler heads. It’s okay to use SSNs as unique identifiers (even public identifiers).
However, it’s only okay if you can prevent use of SSNs by anyone other than the owner – that is, make them useless to anyone who steals them. Here merchants and service providers are on the front lines, be they retailers, banks, credit reporting agencies, or medical care providers.
If companies have no financial incentive to actually verify the identity of a person claiming to be the owner of an SSN, they won’t – and id theft will thrive as an industry.
I think a common identity authentication system is needed; otherwise each company/industry would be forced to develop its own (incompatible) system. The SSA should develop some kind of public/private pair - The SSN being the public part, and some other piece of information, known only to the user and the SSA, being the private part. Like a PIN code for your ATM card. It won’t eliminate the problem, but it could significantly reduce occurrences.
And if your SSN (or PIN) is compromised, call the SSA to cancel the card, and get a new one with a new PIN.
John, Detroit MI (Sent Jul 7, 2009 9:39:30 AM)
Not exactly big news. My mother worked for Social Security 40 years ago, and recognized patterns even then.
Ms Wheezer, TX (Sent Jul 7, 2009 9:27:49 AM)
It took them that long to figure it out?
Jeez, I'm no scholar and I figured out the first two portions easily (my former job I had access to SS# for Pension Plans all over the country).
Maybe I should apply for a scholarship to Carnegie Mellon
aaa, U.S. (Sent Jul 7, 2009 9:20:17 AM)
Wow. Another potential problem caused by government mis-regulation. I'm surprise that no one has started using it as a litmus test as to blame the problem on either Obama or Bush.
Jym Allyn (Sent Jul 7, 2009 9:03:33 AM)
I know my girlfriend's SS# because we stood in line together to obtain our cards. I was in front of her in the line and her SS# is the NEXT number in sequence ! That was in 1964 !!!!!!!
Random Number, Raleigh, NC (Sent Jul 7, 2009 9:01:43 AM)
I know my girlfriend's SS# because we stood in line together to obtain our cards. I was in front of her in the line and her SS# is the NEXT number in sequence ! That was in 1964 !!!!!!!
Random Number, Raleigh, NC (Sent Jul 7, 2009 9:01:43 AM)
You expect the government to protect your information? Only a fool would think so. Now some people want the government to run health care. Yeah, I want my medical information in the hands of government bureaucrats. Might as well post it on the web yourself, that's where it'll end up.
LTCSTAN, NYC (Sent Jul 7, 2009 8:43:15 AM)
Funny that the last 4 digits of a person's social security number are the hardest to guess. I think all of the credit cards and bank accounts I have use those last 4 digits as an identifier. I've recv'd mailings with the first 5 digits of my SS# hidden with ***-**, but the last 4 displayed. I've been burning/shredding my mail for years (at my Dad's urging, back when I first moved out in the 80's). THANKS, DAD!
LiLo, Southeastern Texas (Sent Jul 7, 2009 8:37:51 AM)
In response to Verrrry interesting...now, let's hack BHO's SS# and see where he was born...on second thought, Somalia does not issue SS#'s, does it?
SSS-SS-SHIX, Leavenworth. You are very stupid. BHO was not born in Somalia. Get over yourself and get educated. Ignorance is Bliss
Walla Walla Worshington, DC (Sent Jul 7, 2009 8:17:32 AM)
Well my Husband and his father SS# was applied for at the same time at residency. Guess what, only the las number is different and only increase by one digit.
ex. SS1 654-26-5612, SS2 654-26-5613 weired..
Pam, Port Saint Lucie FL (Sent Jul 7, 2009 8:13:56 AM)
Gee, that's great, especially since secure conscious organizations now show only the last four digits of your SSN in any correspondence. When can we opt out?
Bill Ferrary (Sent Jul 7, 2009 7:58:45 AM)
Most people don't even stop to think that that number is issued by, and is therefore the PROPERTY of the federal government, which therefore has absolute jurisdiction over how that number can be used.
All it would take is for the government to say to businesses and the credit bureaus they couldn't use the number anymore and there wouldn't be a damn thing the banks could do about it. Of course, this will never happen since no one in government has the guts to take a stand for thier constinuents against the corporations,.
Eric, Gaithersburg, MD (Sent Jul 7, 2009 7:56:06 AM)
And we go round and round... Instead of writing in to a website to complain, join the fight to change things. Flood your congressman and senator with letters, phone calls and emails. Do not stop until something is done. The only reason this kind of thing is allowed is because we allow it. I have been writing and emailing for years, but one lone voice in the wilderness (and a voice without money at that) isn't going to do it. Most of you will just go back to sleep and do nothing but whine. Come on people! Get off of your rumps and fight!
firestarter, Egg Harbor, NJ (Sent Jul 7, 2009 7:56:01 AM)
Jane Doe, Seattle Washington, you actually believe what is written in the bible?!
Ron, Va (Sent Jul 7, 2009 7:55:42 AM)
This is no suprise to me, My brothers and my SSN number differ by only the last two numbers (and dont get me started on the issues that it has created for our credit reports)We were born before 1988 and in the same hospital only 5 years apart and my husbands, also born in the same hospital and a year after me is also very similar to mine. I think they are right, they should make all SSN public and we should stop relying on them as an identifier since that is not their intended purpose anyways. All they do is create more issues and paperwork and its not worth it.
Angela (Sent Jul 7, 2009 7:06:57 AM)
In my day, we were required to write our SSN's inside the covers of our college textbooks in order to sell them back to the bookstore!
Jane Doe, New York, NY (Sent Jul 7, 2009 5:48:50 AM)
Jill isn't the only one by a long shot that has 2 ssns. I know a guy that has 2 also...same thing happened to him that happened to Jill...Not his crime or Jills, just a mistake that happened way back ...
Taz Mage (Sent Jul 7, 2009 5:42:35 AM)
My credit is horrible, anyway. I doubt very much that anyone would really want to know it.....:)
shelly (Sent Jul 7, 2009 4:27:46 AM)
I laminated a social security card number and glued it on the inside wall of my post office, I then reviewed the post office cameras (one weeks worth.) I then made a copy of only the people who wrote down the number to my local authorities- a criminal tendency list. They asked me if I wanted to come work for them, I said no thank you , why would I want to work for you I would have to give you my social security number(snicker).
pleasantly surprised (Sent Jul 7, 2009 3:58:36 AM)
What are you complaining about? People are treated like cars.That's why your registry is "The Motor Transport Registry" who cares? The ones ripping us of the most are the "Offical" agencies-Read Governments.Taxes, Car Re'gd. zpetrol, etc.So forget about secrecy.
John Doe, Seattle (Sent Jul 7, 2009 3:49:23 AM)
Every job application, that I have ever seen, asked for my SSN and most stated that I would not be considered for the job if the application was not filled out COMPLETELY. I have applied for dozens and dozens of jobs in my life.
Companies and government agencies (other than the IRS and SSA) use SSNs because they are too lazy (and stupid) to come up with their own unique identifiers for people and entering a nine digit number is easier than searching on a persons name.
I have a book that lists the state for each of the first three digits.
Someone, Sometown, Someplace (Sent Jul 7, 2009 3:35:26 AM)
I have an Italian "SS#" which I got way back in 1975 when in Italy it was not required nationally yet,
At the time I also had a US SS# and I was always amazed at how simplistic the US one was when I compared it to the Italian one ....I got mine in Florida and my mom and dad in NY and even when I was a kid you could see the pattern in the numbers..the Italian one has several letters and numbers grouping it starts with RCA MDA followed by 12 numbers and letters in a different sequence/position. Sometimes you even have to put it on a business card along with your tax id number....maybe it is time to add some unique combo of letters & numbers more elaborate than "zip+four" etc.
Adam Ricco Wilmette Il. (Sent Jul 7, 2009 2:59:59 AM)
The more critical and rather more obvious security issue mentioned only in passing in this article -- which I noticed a few years ago examining my credit reports: "Some data brokers sell truncated SSNs, with either the first five or the last four numbers visible to the purchaser."
As in, compare several records and put the whole SSN together -- no algorithms required.
john, seattle, wash. (Sent Jul 7, 2009 2:32:16 AM)
Vote in Hawaii. you have to give the polling authorities your SSN. I argued with them at the last election. I just wanted to make the point of the problem... of course, its not the volunteers fault. Can some smart (and ambitious) attorney please sue the state of Hawaii?
Tim Orden, Kaneohe, HI (Sent Jul 7, 2009 2:03:47 AM)
maybe we all need to be microchipped like dogs :)
curious (Sent Jul 7, 2009 1:54:02 AM)
I used to live in another city. I called the water department for a question on my bill. The customer service rep asked me to verify who I was by using my SSN. Man, I was ticked off! What in the frick was a stupid water company employee doing with my full SSN in the system?!?!?!?!? She said it was needed when we set up utilities in that town to get a credit rating. A credit rating for setting up water/sewer services?!?!?!
From now on I don't give my SSN to ANYONE but the IRS. Customer reps hate me when I tell them I will verify who I am some other way but I don't care and this article is why.
Scott, Visalia, CA (Sent Jul 7, 2009 1:44:17 AM)
I think people are overly worried about SSN theft. By the way, do you ever wonder what the waiter does with your credit card when you pay for your meal at a restaurant? Guess you won't be paying with CC at your meals anymore. Did you know most accidents in the home happen in the kitchen? Guess you won't be cooking anymore meals. Get a clue. You can spend all your time worrying about this and that. If someone really wants to do you harm you're screwed SS# or no. All you should do is be prudent and not give your info out to anyone unless it's necessary like your employer. Common sense, that's it. It's all you can do.
White Lotus (Sent Jul 7, 2009 1:38:13 AM)
My sister and I are five years apart in age (and in our 30's). Our SS numbers are almost identical except for the last two numbers. I assume my parents applied for them at the same time.
Mom (Sent Jul 7, 2009 1:33:29 AM)
So what's the big deal, half the drivers in the USA have their Socal Security Number plastered across the top as their driver's license number. The original act creating SS passed the law making the use of SS for any other purpose Illegal. Soon after that, Congress stole half the funds from SS and allowed the use of the SS member to track ownership of even dogs and cats.
Nothing is sacred in the USA any more, including the honor of our politicians.
William Brooks (Sent Jul 7, 2009 1:10:29 AM)
this is like reading the book "hello my big big honey!" and trying to figure out what town the people are from, given only that you have their country or state, and also trying to figure out the date, after being told all the dates were removed. sure, some people recognize some of the info on a ss card, but they also recognize you in the street. it is another question if they want to zap that card or person, which brings us back to william burroughs' favourite concept: *control*
sheila carfenders (Sent Jul 7, 2009 1:09:08 AM)
Thank you Jill for admitting your crime, Federal Marshals will be contacting you shortly. Listen for a knock.
Second, it was the practice historically to issue locally, hence sequential was the norm. But that is no longer done, so it means little with today's numbers.
SSN are overrated. Life goes on without them....
If you have personal info online you are foolish.
West11, Amman (Sent Jul 7, 2009 1:04:33 AM)
This is hardly even news. I hope they didn't spend too much on their "research".
From SSA's website:
The digits in the Social Security number allow for the orderly assignment of numbers. The number is divided into three parts: the area, group and serial numbers.
The first three (3) digits (area) of a person's social security number are determined by the ZIP Code of the mailing address shown on the application for a social security number. See Social Security Number Allocations for more information.
Within each area, the group number (middle two (2) digits) range from 01 to 99 but are not assigned in consecutive order. For administrative reasons, group numbers issued first consist of the ODD numbers from 01 through 09 and then EVEN numbers from 10 through 98, within each area number allocated to a State. After all numbers in group 98 of a particular area have been issued, the EVEN Groups 02 through 08 are used, followed by ODD Groups 11 through 99. Within each group, the serial numbers (last four (4) digits) run consecutively from 0001 through 9999.
Richard, Oshkosh, WI (Sent Jul 7, 2009 12:50:15 AM)
I was born in 1962 and my parents dutifuly got me a SSN. Five years later when I was registered for kindergarten, they were asked for that number for id purposes. They forgot they had gotten me one way back when and applied for a new one for me. I know have two ssn's totally unique from each other. I bet they couldn't guess both of mine!
Jill, Medina, OH (Sent Jul 7, 2009 12:40:53 AM)
SEND A COMMENT
PLEASE READ: All comments must be approved before appearing in the thread; time and space constraints prevent all comments from appearing. We will only approve comments that are directly related to the blog, use appropriate language and are not attacking the comments of others. Firms mentioned in our comment area are welcome to add their own comments.