Is the end of Social Security numbers at hand?

We’ve all been warned not to use the same password for email, Facebook, and Amazon. But that is exactly what every American does when it comes to our financial lives. We rely on the same nine-digit password for everything from loans to taxes: Social Security numbers.

Having just one number is convenient, of course — especially to fraudsters. Right now attorneys general in Connecticut and Illinois are investigating a data breach at Experian /quotes/zigman/430218/delayed/quotes/nls/expgy EXPGY +0.11% , one of the three major credit bureaus, that exposed the identification digits of more than 200 million Americans. To combat such crimes, experts say government agencies have begun to consider alternatives, including biometric scans.

When Social Security numbers were first issued nearly 80 years ago, they weren’t intended to be used as identification with tax men, employers and health-care providers. Yet now, 80% of the top 25 banks and 96% of the top credit card issuers allow people to access to an account if they have the correct Social Security number, according to a 2014 study by Javelin Strategy & Research.

The numbers were exposed in nearly 50% of data breaches in 2013, according to the Identity Theft Resource Center. They can be hacked or tracked through keystrokes, and found on tax forms in snail mail or old records in dumpsters. It’s even possible to guess a Social Security number based on information from Facebook profiles, like hometowns and birth dates, Carnegie Mellon University researchers found in 2009.

Click to Play

Prince George's first trip overseas

The Duke and Duchess of Cambridge arrived in New Zealand on Monday for the start of a three-week tour. They were accompanied by their nine-month-old son Prince George on his first overseas trip.

“Any number of people might know your Social Security number,” says Steve Toporoff, identity protection program coordinator at the Federal Trade Commission.

It is hard to measure how many people fall victim to identity fraud due to a stolen Social Security number, experts say, because it is often difficult to trace the crime back to a specific cause. But the effects of Social Security number misuse are clearer.

The U.S. loses billions of dollars every year to thieves who file for someone else’s tax refund after getting their hands on Social Security numbers. In 2011, the Internal Revenue Service issued about $3.6 billion in potentially fraudulent tax refunds , according to a September report by the Treasury Inspector General for Tax Administration. For more than 174,000 Social Security numbers, more than one refund was filed — an indicator that some weren’t legitimate.

Those nine digits come cheap on the black market. Some estimates peg the cost at just $3, according to the Office of the National Counterintelligence Executive.

The U.S. adopted Social Security numbers as an across-the-board federal government identifier after President Franklin Roosevelt issued an executive order in 1943, less than a decade after they first began being issued for the agency’s benefits programs. In 2011, the agency began using a more randomized process for assigning the numbers. 

There are no official plans to abandon Social Security numbers any time soon, but the government is now considering ways to reduce the number of times agencies ask people for their numbers, Toporoff says, as the digits increasingly fall in the hands of thieves.

President Barack Obama announced a program called the National Strategy for Trusted Identities in Cyberspace in 2011 — an initiative to partner with the private sector to create an online user authentication framework. The plan is to create an Internet ID system, which people could use to interact with multiple government agencies instead of shuffling paperwork that includes private data (like a Social Security number) through the mail.

Click to Play

Can you teach your kid to be an entrepreneur?

Classes and camps to teach young children how to be entrepreneurs are popping up from Princeton, N.J., to San Antonio, Texas.

“Consumers will be required to give out their information in fewer instances and they won’t have to remember a zillion passwords,” Toporoff says.

Some countries have turned to biometric identification in hopes of thwarting fraud. Proponents say fingerprint and iris recognition scans make it more difficult for con men.

India launched an effort in 2010 to issue biometric identification to each of its 1.2 billion people. The program aims to combat welfare fraud in the second-most populous country, where corruption is the norm and benefits like food rations are often eaten up by middlemen. It is among at least 160 biometric ID programs in developing countries worldwide, according to a 2013 paper by the Center for Global Development.

“The use of fingerprints is growing and its one of the strongest technologies,” says Anil Jain, a professor of computer science and engineering at Michigan State University and leading expert in biometrics.

Biometrics are already widely used for criminal and defense purposes, and even the iPhone 5S includes a fingerprint touch ID option instead of a passcode.

Another place in the U.S. where fingerprints are used to cut back on fraud: Disney theme parks. In an attempt to prevent visitors from sharing tickets, guests scan their fingers on a reader, and prints are converted into a numerical ID that is tracked each time someone enters a park.

Companies are also developing new ways of verifying identities. Toronto-based Bionym Inc. offers a $79 bracelet called Nymi, which measures the wearer’s heartbeat to authenticate their identity and can open home and car doors as they approach.

Privacy advocates like Lee Tien, a senior staff attorney at the Electronic Frontier Foundation, say biometric identification might be a new approach to solving the problem, but not necessarily better, and some drawbacks have yet to be discovered since the system isn’t yet commonplace.

“If a key unlocks lots of doors, the risks associated with it are really different from if a key unlocks one door,” Tien says.

More from MarketWatch:

New ransom demand: Pay us in bitcoins

Is identity-theft insurance a waste of money?

Don’t bank on high-tech credit cards

/quotes/zigman/430218/delayed/quotes/nls/expgy

Add to watchlist EXPGY

Experian PLC ADS

US : U.S.: OTC

$ 17.57

+0.02 +0.11%

Volume: 20,329

April 15, 2014 2:42p

P/E Ratio

22.57

Dividend Yield

1.31%

Market Cap

$17.52 billion

Rev. per Employee

$282,118

David Grayadder user6 days ago

Solution #1 - dial back on the automation at the IRS. No more auto-deposit of tax refunds - printed checks only, made out to the taxpayer(s).

Solution #2 - federal agencies that do not need SSNs should not use them. At all. This includes DoD, which (for example) should go back to issuing their own service numbers to all members.

Solution #3 - prohibit banks or any other financial/commercial enterprise from using SSNs for anything other than their stated purpose - to relay Form 1099x information to the IRS. This would include some bozo walking up to the teller at your bank using your SSN to put his filthy paws in your bank account. Here is where biometric info is most useful.

ATL VM user6 days ago

@David Grayadder 1) NO. We don't need to PRINT checks, that is antiquated solves nothing. WE have debit cards we can use for this purpose (which are not required to register an SSN). going back to the 70's is a stupid idea.

2) Federal Agencies are the ones that USE your SSN the most, so not sure what you are talking about here. Maybe we can use a different "personal" identifier but people will forget those other numbers and the point is to use a number you know best.. the one tied to your retirement and income.. makes perfect sense. PRIVATE agencies should not use this number however.

3) Banks are prohibited from using SSN for other than their stated purpose.. not sure where you missed that point. Some bozo that walks into a bank would get your SSN exactly how..? eh.. YOU must have let it slip, I know MY SSN is not accessible to ANYONE, which is yet another reason to keep this communication electronic it's sent to MY email. Yea email can be hacked, again only if you are STUPID enough to share your email with someone or let them know your password of you don't change your password.

ALL of these things you mentioned can EASILY be prevented, my bank account, emails have NEVER been compromised because I follow SIMPLE security procedures. These things you mentioned are only plausible if you are careless with your SSN.

PERIOD

sophia pushy user6 days ago

@ATL VM @David Grayadder

I had mine stolen about 15 years ago, and the officer who helped me because I caught it fast told me it could have been copied from medical records and a disgruntled employee. I have always been careful with it, and even recently when I purchased my last car, I paid cash and they still needed my SS# for the paperwork. I kept asking why, and they told me for the gov.t. It ticks me off how everything from getting a cell phone to a car purchase it is needed. So no matter how "careful" one is, it's still floating out there freely.

Rick Chevalier user6 days ago

@ATL VM If only it were as simple as you make it sound. Whenever I call my bank they want my social, or at least the last four digits. Why? For identification. I doubt that is a 'stated purpose'. Not only that, but my utility providers use it to identify me when I call. I can't even get water service without providing my SSN. Upon asking why it was needed and what they used it for the reply was that is was an entry field on their computer screen. No one could tell me what they used it for. As someone who has had my SSN fraudulently used that is pretty scary.

Some states did use your SSN as your drivers license number although they may have stopped the practice by now. I think this is how my SSN was stolen. It wasn't until 17 years later that I learned of it. I was lucky, they only used it to get out of a DUI. But now that is on my record and I have never had a drink in my life.

k parker user6 days ago

@ATL VM @David Grayadder ATL, you say your soc sec # is not accesible to ANYONE. You must not have a bank acct, brokerage acct, credit card,etc,etc.. Me thinks you are blinded...and overly confident.

it was the best of times it was the worst of times user6 days ago

@David Grayadder Checks are easily stolen and identity thieves prefer a paper trail.

	Avg. APR	Last Week	6 Months
Low Interest	10.33%	10.33%	10.46%
Balance Transfer	12.66%	12.66%	12.49%
Business	12.98%	12.98%	12.98%
Student	13.27%	13.27%	13.27%
Cash Back	14.84%	14.84%	14.62%
Reward	14.99%	14.97%	14.87%
Airline	15.30%	15.30%	14.51%
Bad Credit	22.73%	22.73%	23.48%
Instant Approval	28.00%	28.00%	28.00%

Avg. APR

Last Week

6 Months

Low Interest

10.33%

10.46%

Balance Transfer

12.66%

12.49%

Business

12.98%

Student