Slashdot Log In
Identity Theft-What Can Really be Done w/o a SSN?
Posted by
Cliff
on Tue Nov 01, 2005 11:34 PM
from the protecting-your-data dept.
from the protecting-your-data dept.
TheItalianGuy asks: "Many of us that work in the financial sector are bombarded with daily security threats. One of the biggest these days is Identity Theft. My fellow comrades and I have been really grilling each other on differing scenarios on what could be done with what information. However, it all seems to come back the the Social Security Number. Financial companies have other controls in place (customer service verification checking, account passwords, etc) to ensure identification. But in order to be of any use, a bad guy would really need someone's SSN. Absent of that, other information would be useless. Right? That's what I would like to ask Slashdot folks. What could be realistically done with customer information without a SSN? Account numbers, address, maybe a phone or payment amount. Is that really dangerous to the customer if only those get compromised?"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Considering... (Score:5, Insightful)
Re:Considering... (Score:4, Insightful)
Anyway, the entire question of personal privacy is rapidly becoming moot. It's not just that our fear-mongering overlords want more power over each of us, but also that we have no barrier to protect privacy in this modern age. Do you have any idea how much of your personal data is stored out there? Of course not--but the organizations storing it (mostly companies and governments) can do whatever they want with it. My contention is that we need to extend the Bill of Rights to explicitly state that your personal information is part of your property and should be protected from search or seizure without probable cause.
Parent
Re:Considering... (Score:5, Informative)
Parent
Re:Considering... (Score:4, Funny)
Parent
Re:Considering how much data is out there? (Score:5, Interesting)
To elaborate (but at risk of going off-topic), the basic idea is that if someone wants to store information about you, you should have the right to make them store it on your machine. They can sign it or whatever to prevent you from tampering with it, but if they want to see it again, they should have to ask your permission. As long as it's reasonable, you can let them see it--unless you change your mind. Even including your SSN.
This is not really as radical as it might seem. Only a few years ago, pretty much all of your personal information was stored in your punkin head, so to speak. If someone wanted to know about you, they HAD to ask you. From that perspective, the essential principle of the Fifth Amendment is that you didn't have to tell them if you don't feel like it. However, these days it is increasingly less necessary to ask you anything--someone else already owns your data.
Parent
How hard is it to get the SSN (Score:3, Insightful)
Birth Certificate (Score:5, Informative)
Re:Birth Certificate (Score:4, Informative)
Heh
B
Parent
Aggregation Attack (Score:5, Informative)
Re:Aggregation Attack (Score:3, Informative)
Why are you charging $17 for this [microsoft.com] link?
Re:Aggregation Attack (Score:5, Funny)
Because more than zero people are willing to pay $17 for that link?
Welcome to capitalism. Incidentally, could the grandparent poster please send me a copy of his customer list? I've got some excellent opportunities for them in cross-river mass transit real estate...
Parent
A corrolary .... (Score:3, Interesting)
I've worked for companies who game my SSN to my health-insurance company as my member ID. Why do they need it, and what the hell is it being used for as my member ID? Yes, with you SSN, people can do a lot of evil things. Handing it out willy-nilly (without asking you) is jut as bad.
But why is it legal for an employer to just hand this out to third parties? I think the abuses of how people use SSNs stems from the fact that way too many companies ask for it, and way too many companies hand it out to their vendors without any real regulatory restraints.
IMO, it should be illegal to pass out that information without my consent. But I've seen too many examples of my employer passing it on without asking me.
Re:A corrolary .... (Score:3, Insightful)
What should be illegal is using a person's SSN as an authentication mechanism. If it's considered public knowledge, then companies wouldn't be running around going, "Well, if you're really Bob Smith of Trenton, NJ then what... is.... yoursocialsecuritynumber????"
SSN (Score:5, Interesting)
Incidentally, Richard Nixon's social security number is 567-68-0515; there are many cases where a given agency doesn't actually need your number, and it's perfectly appropriate to give them his instead. Have fun.
Re:SSN (Score:5, Insightful)
For more info, see:
http://www.faqs.org/faqs/privacy/ssn-faq/ [faqs.org]a te.html [cpsr.net]
http://archive.cpsr.net/cpsr/privacy/ssn/SSN-Priv
Parent
Re:SSN (Score:5, Interesting)
I run a business myself. I don't collect SSNs but I could. Someone could tell me they wouldn't provide it and then I could tell them that I wouldn't do business with them.
And it's 100% legal.
Hell, I could demand their blood type under the same logic and result.
Sure, it would be suicide for me as a business but for a bank? They don't need you, you need them.
PLEASE. For the love of fuck, STOP MISINFORMING PEOPLE JUST SO YOU CAN HEAR YOURSELF TYPE.
Parent
a more pressing question..... (Score:4, Interesting)
Re:a more pressing question..... (Score:3, Informative)
Contact info:
# Equifax: 1-800-525-6285; www.equifax.com; P.O. Box 740241, Atlanta, GA 30374-0241
# Experian: 1-888-EXPERIAN (397-3742); www.experian.com; P.O. Box 9532, Allen, TX 75013
# TransUnion: 1-800-680-7289; www.transunion.com; Fraud Victim Assistance Division, P.O. Box 6790, Fullerton, CA 92834-6790
More info
Let me tell you... (Score:5, Interesting)
Suffice to say, they did not need my SSN, or anything beyond what would normally be used to purchase items online. I found out when my card was denied at a store - the theif had emptied my primary checking account, and because I had overdraft protection, the attached savings account in one night. Nice thing was, the bank immediately reimbursed me for the fraudlent purchases, followed up with the police, and prosecuted. (Not simply because I am an employee, mind you - but I did get something most people in my situation don't, follow-up. Typically, the bank reimburses a customer and follows up with the authorities separately - without ever contacting the customer again unless required.)
Now, I use a random card number service associated with my credit card to purchase anything on the internet. It may not be the worst form of identity theft, but it can be inconvient, expensive, and time-consuming to recover. I had to deal with bounced checks for bills, and set the fraud alert on my credit bureaus as a result of this. It's certainly worth using a temporary card service if your bank or credit card company offer it.
Just my "It happened to me" tale, but it's one we hear over and over again these days.
Re:Let me tell you... (Score:5, Informative)
(Disclaimer: I am not a security expert. I am not a financial expert. I am not any kind of expert. Don't blame me if sh?t hits your fan.)
Let's say you want to purchase something online with credit. But you don't want your credit card number floating around in various databases on the internet. And you don't like entering it multiple times into multiple websites; this increases the chances that someone will attack you successfully.
So you go to your credit card's website (which you trust). You tell them you want to make an online purchase of no more than $500 (let's say), and you want to do it this month. They give you a fake credit card number X and tie it to your real credit account.
When you go to pay for your item from company foo.com, you give them credit card number X. Now foo.com alerts your credit card company you've used X to make a purchase of (let's say) $400.
The credit card company notes this transaction, and from now on, X can only be used to make purchases from foo.com. So if Mallory was sniffing your traffic and decides to make a porn site purchase two hours later, he will be unsuccessful. Or if the folks at foo.com try to cheat you and charge you twice for your $400 purchase, they too will be unsuccessful (because that would put X over the $500 limit you set).
Also, after that one month time limit, the X itself expires so that even foo.com can't use it anymore.
You can make a separate fake credit card number for every company you intend to buy something from online. If any one of them is sniffed, the damage is minimal. I know for a fact that CitiBank offers this service -- I'm sure plenty of others do as well.
Parent
random card number services (Score:5, Informative)
Not only does this information jump start a police investigation, but it also tells you which database was broken into and thus which set of customers to warn about possible impending credit card fraud.
Parent
What the Navy says about SSNs (Score:5, Funny)
Sounds pretty serious. If you have an SSN, you should definitely not let another person or country get hold of it. Frankly, I'm amazed that anyone in America can get an SSN, but that's liberty for you.
I'm already using a Fake ID with no SS number (Score:4, Funny)
Different Year/Month/Day Born
Different town I was BORN in (yes that was one of the "secret" questions)
Different Mother's Maiden Name (actually I have several of these and rotate them or combine them...)
Different Town and ZipCode where I live
A non-existant Favorite Pet
Same Gender though....
I did sign on to Classmates.com as one of the kids I hated.
I started getting emails from all the girls that would never go out with me in High School!
I couldn't reply though because it was the "free" version of Classmates.com, however, I took comfort knowing the guy I was impersonating could not sign up as himself as I had already taken that position!
karma's a bitch ain't it?
Re:I'm already using a Fake ID with no SS number (Score:3, Funny)
"Remember the time you sucked my dick in back of the art building? Well everytime I think of that day, it makes me want to ram-rod. That's right! I want to joust you like a loose mule in heat. Common, let me slap dat ASS!!!
PS. You have the face of a horse. At least it's good for a nice deep throat"
Okay now. You have your marching orders soldier. You may CUT-N-PASTE at will!
Just having their bills is enough (Score:5, Interesting)
Telephone service is particularly easy to mess with; I just called repairs and ordered service changes and no attempt was ever made to check on me. I was able to add and delete services, change phone numbers and billing addresses, etc. I didn't even have be at the service location to order any changes.
For utility accounts, all the info I've ever needed was on the bills. Again, I was able to change services, update billing records, etc. all without any difficulty. It's been very convenient for me to be able to set things up without having to muck around with Powers of Attorney and so on, but it gives me the shivers to realize what must be possible to one "skilled in the arts".
Once you have utility bills with your address on them you can establish a residence and a lot of stuff follows from that. For instance, I could easily get a library card and enroll my kids in school in the town where this relative lives.
With a little bit of creativity I could probably do stuff with money, too. I guess it's a good thing I'm honest, huh?
Why is that even the question? (Score:5, Insightful)
Define Dangerous (Score:3, Interesting)
I expect (though I don't always trust) any company I give my personal information to keep that information private no matter what that company perceives the potential damage of that information to be. The bad guys are often more inovative than the good guys and who knows what they can do with any given piece of data?
while at the bank today.. (Score:5, Interesting)
I'm waiting for RIDS - Retinal Identification System, gonna use my glass eye, eh Sammy?
It's the concept... (Score:4, Interesting)
All this being said, if a company doesn't do what I consider adequate protection of my information, I don't want to do business with them. It's not that a malicious user couldn't get it any other way; I just don't want to make it any easier for them to get to me. Let them go hog-heaven on the blue-hairs that don't know any better.
And I haven't even talked about your real question. What could one do with a "lowly" account number? Well you tell me. Let's say that's all Joey Malicious has on me. Has he hacked in to your network? Does he have access to your applications and know how to use them? Do you KNOW he hasn't? All I know is that when I call the credit card company, they want the account number and SSN. Are they typing it in with me and can't proceed without me, or are they verifying my answers against what they see on the screen?
What if Joe Malicious works for your company? I'd say you, as a member in the financial industry, are in a much better place to answer this question. YOU need to tell ME that my fears are unfounded, that technically Jane Helper can't review my account info and do a transfer without my account number AND SSN AND mothers maiden name AND first-born sons' DNA because she has to enter it into the system as well. Of course, most financial institutions don't disclose their security practices (or lack thereof) for obvious reasons. None of us outside your "closed-source" way of operating can truly trust the process. All we know is that the threat is real, and we have little control of the problem.
Re:What I feel (Score:5, Insightful)
Bingo.
It's two different problems really. One is: How do you get a unique handle on a person ? As you say, name won't work, there's more than one "John Smith", adding in physical adress leads to duplication, because people move, so "John Smith, Bourbon Street" can very well be the same person as "John Smith, Pennsylvania Avenue".
Adding birthdate helps, but is still no guarantee, there could be two John Smiths both born on say 9.9.1979
For this problem the SSN is a decent solution. If we're talking of the person with SSN XXXXXXXX it's pretty likely we're talking of the same person, assuming every person has exactly one SSN (which ain't true, but it's atleast sorta close)
However SSN is a *lousy* way of verifying identity. Knowing it is no evidence at all that you are the person to which the number belongs.
Over the course of a life you hand out your SSN to several dozens or even several hundred different entities, you don't want all of those to later be able to pretend to be you. (or someone breaking into the computer of one of those)
Parent
I realise that this if for the Americans... (Score:3, Interesting)
In Australia, the closest equivalent we have is the TFN (Tax File Number). The only people that end up with it are:
As far as I can tell, it is NOT an offence to refuse to give it to any of these groups. That includes the Tax Office themselves. There are consequences of not quoting it, however. Namely, all tax payable is taken out at the maximum tax rate. To not give it to the ATO means that your tax return can be delayed while they search for you by name and DOB.
Also, it's pretty crap as ID for banks, because all they get is a small note on the screen of your account details that says "TFN received" or similar. This makes much more sense, IMHO.
A good con (Score:5, Interesting)
In other words, the SSN may in fact be critical to most realy disastrous identity thefts, but a smart thief can get the SSN based on very little prior information.
For example, you can get a official copy of a birth certificate with a wink and a smile. With that you can register for classes at the local community college. A student ID with your birth certificate is enough to get your Social Security card, even if you don't know the number. Student ID can also qualify as proof of residence in an area, which combined with the aforementioned social security card and birth certificate is enough to get a state ID or drivers license.
Badda boom, you have a complete identity, including paper trail, without anything more complicated than forging a signature
We need a private-key credit card. (Score:3, Interesting)
A private-key credit/debit card.
Prevent identity theft (if you can keep your hands on your card) by using challenge-response authentication. The POS terminal sends your card a challenge, the card encrypts the challenge and sends it back, and the POS terminal checks it using your card's public key (which it fetches from the credit card company). Bonus points: put a key pad on the card, so that your key is protected with a password, and you know your password isn't going into random hostile machines.
Non-Randomness (Score:5, Interesting)
I don't know what impact this has on the discussion, but it seemed important to consider.
What can be done? (Score:3, Interesting)
Well, for total identity theft you probably need the SSN. However, a lot can be done without the SSN. Given someone's name, address and birthdate you can get a forged driver's license that'll fool most clerks. If you also have their driver's license number, it'll fool most electronic checking systems as well. Know their checking account number and that gives you enough to write checks in their name. Know their credit-card number and expiration date and you've got enough to run most credit-card transactions. Just knowing the name and checking account number gives you enough to submit an electronic check against their account (you'll have to move fast to get the money out of your account and disappear before they notice the discrepancy, but if you've got that forged driver's license you can probably open a throwaway account easily enough).
Looking at it, a name and date and place of birth seems to be enough in most cases to get an official, certified birth certificate for that person sent to you. Just make sure to pay by money order, not credit card. A birth certificate's a stepping-stone to a lot of... interesting things.
How To Steal ID (Score:3, Informative)
2) Claims to be Joe Bloggs, citing correct date and place of birth
3) Walk out with birth certificate for Joe Bloggs
4) Get driver's licence in name of Joe Bloggs
5) Get bank account in name of Joe Bloggs
6) Engage in fraud as Joe Bloggs, getting hold of $500k worth of stuff on 7-day invoices
8) Ditch all identifying material, returning to your old identity
9) Watch in the news some weeks later about some poor sucker called Joe Bloggs who is up on counts of fraud totalling $1M odd.
Getting acct info (Score:3, Informative)
In the event we need something strange done, we have reps we work with. If we asked for some info on the account, such as a SSN, I wouldn't be surprised if the reps would quietly provide it.
So, don't give your SSN to utilities folks. Your electric company doesn't need it.
Having Your Identity Stolen Sucks (Score:5, Informative)
So in a six month period this idiot was able to get my license suspended in three counties, multiple traffic violations, driving without insurance infractions, driving a stolen vehicle, and countless drug dealing and drug possession charges.
Can someone do damage without your SSN? F$CKiN A! I spend countless hours appearing in front of Judges, DA's, Court Clerks, Law Enforcement Officers, and lawyers and regardless of how much evidence I had, I was regarded with contempt and suspicion until someone could verify I wasn't lying and pardon me.
In the end they caught the son of a bitch and he did 18 months for the Identity Theft charges (He's still in pound me in the ass state prison due to all the other charges in his name and my name). The interesting point is that I had to argue in front of a judge that it would be pointless to keep a drug charge on my record that I didn't commit just so that they could track the crime back to me from his record. By the way, they dropped the drug charges because he pled guilty to ID theft (that's how I got the last stain on my record removed). Government...
The time I lost in wages (I was a contractor at the time) and the hell he put me through trying to clear my name which isn't easy when people look at their computer screens and think your a drug dealin dope fiend is enough for me to hope he's still being anal raped by some large man named Bubba. So you ask the question can someone cause damage without your SSN? They could send you to prison if you don't find out in time and clear your name. All they need is a few corrupt government employees and your first and last name.
Triad Support System (TSS) (Score:5, Interesting)
Each and every entity above can revoke the key at any time.
Merchant can revoke a transaction or deny a consumer (due to poor credit). Consumer can revoke identity if stolen with assurance it won't be used again ever. Arbitrator can authenticate/reject for both parties.
Zero identity theft.
This would require a smartcard that generates rotating public key protected by a PIN/fingerprint (I'm not big on biometric, but consumer ease of use is the key here).
Significant technical hurdles remains with regard to "WHOM" process the public-private key verification as it takes CPU-time. Perhaps the smartcard has advanced enough to the point where it can sign the keys.
Not Valid. (Score:3, Insightful)
-everphilski-
Re:Not Valid. (Score:5, Interesting)
Parent
Re:Social engineering (Score:3, Interesting)
Re:Mine is... (Score:5, Funny)
Parent
Re:Mine is... (Score:5, Informative)
Parent
Re:Mine is... (Score:3, Funny)
Re:SSN is the problem (Score:3, Interesting)
I don't need an SSN to withdraw money from my ATM, or make a deposit. And it should be kept that way. Anything that has a frequent transaction rate (financial transactions, university logins, bank logins, etc) should never use anything involving a SSN. By increasing the frequency of transactions involving SSN, you remove the user's will to protect this number. It begins to become more of a hassle for them to use this number, thus they'
Re:credit card info? (Score:4, Interesting)
Parent
Re:credit card info? (Score:4, Informative)
First, contrary to popular belief, the sig on the back of the card is not there for identification purposes, but rather to indicate that you accept the terms of your cardholder agreement. If you do not sign the card, you cannot legally use it. Period.
Second, if you want to protect yourself, you are much better using a credit card than a debit card. A typical credit card has a much better fraud protection policy than a debit card (might want to read the terms of service). Also, if your account is accessed illegally, with a credit card they have the credit card company's money (or actually, the store's money) while for a debit card they have drained real money from your personal checking account.
Third, the merchant is not required to obey your stupid writing on the back. In fact, if they are doing their job they would require you to sign the card for real to make sure you have agreed to the terms of service. That is why it is perfectly reasonable for a clerk to ask you to sign a card that you present to them unsigned - because your signature is not for ID purposes.
Lastly - most identity theft happens WITHOUT STEALING YOUR PHYSICAL CARD. Geez.
Your cop and lawyer friends either don't like you, or perhaps have merely assumed the identity of lawyers and cops in order to get personal information out of you. You didn't show them your card, did you?
Parent
Re:credit card info? (Score:3, Insightful)
Second: The one time I had to deal with fraud, it was useful in pinpointing that all the fraudulent purchases were online.
Third: As for terms, I go through a credit union, which is great on service and protection, and they have great terms for protecting members, so maybe credit cards help for many, but it doesn't make much of a difference in this case.
Fourth: You bring up 2 points abou
Re:Bank card number (Score:5, Insightful)
Parent