Social Security numbers for sale: Who pays?

April 5, 2005

BY JONATHAN KRIM
THE WASHINGTON POST


Want someone else's Social Security number? It's $35 at www.secret-info.com. It's $45 at www.iinfosearch.com, where users also can sign up for a report containing an individual's credit-card charges, as well as an e-mail with other "tips, secrets & spy info!" The Web site Gum-shoes.com promises that "if the information is out there, our licensed investigators can find it."Although Social Security numbers are one of the most powerful pieces of personal information an identity thief can possess, they remain widely and inexpensively available despite public outcry and the threat of a congressional crackdown after breaches at large information brokers.

Brokers such as ChoicePoint Inc. and LexisNexis have pledged to restrict the availability of such data after personal information on more than 175,000 people was purloined from the two firms by identity thieves posing as legitimate businesspeople.

So far, neither those moves nor revelations of a series of breaches at major banks and universities has curbed a multitiered and sometimes shadowy marketplace of selling and re-selling personal data that is vulnerable to similar fraud.A simple Internet search yields more than a dozen Web sites offering an array of personal data.Some are run by small data brokers. Others are run by private investigators, many of whom have complained that recently announced restrictions on the availability of Social Security numbers would hurt their ability to assist law enforcement, track down deadbeat dads or locate witnesses.

Yet with only scant checks to verify whether someone requesting data is legitimate, several sites sell full Social Security numbers, potentially contributing to an epidemic of identity theft and fraud that touched about 10 million Americans in the past year.No law prohibits the sale of Social Security numbers, but privacy experts and some government agencies have warned for years that the number is overused and under-protected.

Inaugurated in 1936, the nine-digit number was intended to match citizens to the retirement money they would eventually receive. Over time, the number became essential for getting or verifying credit and for employment background checks.Eventually, it became so deeply linked to personal data throughout the economy that it became a de facto national identifier.

"For identity thieves, it's their magic key ... that gets into every door," said Daniel Solove, a George Washington University law school professor who specializes in privacy law.Nonetheless, some insurance companies still use the Social Security number as an individual's account number, printing it on identification cards, leaving people immediately vulnerable if wallets are stolen or lost. Medical offices routinely request Social Security numbers, often when initial appointments are made, and many universities use them as student identification numbers.

According to a recent study commissioned by Unisys Corp., a technology consulting company, about half of large financial institutions use Social Security numbers to verify the identities of customers who call in for services. Some even use the numbers to identify customers as part of the log-in process when they want to access accounts via the Internet.So vital are Social Security numbers in this sea of information that ChoicePoint warned investors in a recent Securities and Exchange Commission filing that its business could suffer if the rules on distribution of Social Security numbers were tightened.

The mass breaches of data at ChoicePoint and LexisNexis forced the companies to become proactive.Executives of both firms told Congress last month that for many of their non-law- enforcement clients, Social Security numbers would be truncated so that only five digits would appear on reports.But plenty of sources for the information still exist.

Using an intermediary, The Washington Post was able to obtain the full Social Security number of a reporter within 24 hours from two of three online providers the intermediary contacted.Not all providers advertise Social Security numbers, and those that do promise to verify that the buyer has a legitimate reason for seeking a number, such as to complete tax forms of an employee or to find someone involved in a court action.The intermediary, a security consultant who helped the Federal Trade Commission identify illegal data sales in 1999, told the providers he needed the number for tax purposes. Two providers accepted that reason without question or requests for documentation. A third refused to supply Social Security numbers.

Under a law that took effect in 2001, non-public data from financial records cannot be sold or transferred without giving the individuals involved a chance to opt out. There are several exceptions, however, including employment checks, for tax filing, or to process a financial transaction. The system relies on the honesty of the person seeking data, and the diligence of the person selling it.

Several members of Congress are sponsoring new privacy legislation, including bills that would ban the sale of Social Security numbers without individuals' permission.Privacy experts say financial institutions should use multiple test questions when people call in for account information, rather than just requesting a Social Security number. If the number is compromised, they say, it's hard to limit the damage because new numbers are almost never issued.

Copyright 2005 Newsday Inc.