ID theft

Your SSN Can Now Be Accurately Guessed Using Date and Place of Birth

Paul Michael — Wed, 08 Jul 2009 16:29:57 +0000

It seems that nothing is safe any more. And now your Social Security Number, the lynchpin to you credit score, taxes, government benefits and more, is under attack. It can be guessed, with a staggering degree of accuracy, using simple information you probably have on sites like Facebook and MySpace.

We have all heard the stories about Identity Theft and we all take precautions to be careful with our SSN. In fact, these days I’ll only put it down on a form if I absolutely have to; that includes medical forms that you often have to fill out when you visit a GP or specialist. But that may now be a moot point, because two Carnegie Mellon researchers have basically reverse-engineered the SSN formula to gain access to that most precious and private number.

John Timmer of Arstechnica.com reported yesterday that these two bright sparks used two practices that had been designed to protect the number, and make it fraud-proof, as a way to discover the code from those two simple facts – date of birth, and place of birth; two facts that are on most public profiles.

To know how they did it, you need to know the basic structure of the SSN. As John describes it, it splits into three zones:

The first three digits are based on the state where the SSN was originally assigned, and the next two are what's termed a group number. The last four digits are ostensibly assigned at random. Since the late 1980s, the government has promoted an initiative termed "Enumeration at Birth" that seeks to ensure that SSNs are assigned shortly after birth, which should limit the circumstances under which individuals apply for them later in life (and hence, make fraudulent applications easier to detect).

From there, the article gets pretty heavily into some technical data and statistics that I won’t bore you with here. If you’re interested, read all the details of the algorithm that reconstructs your Social Security Number. But all you really need to know is that if the SSN code has been cracked, or hacked, then it won’t be long before that information gets into the wrong hands.

So, should you be worried, and what can you do?

Well, as John Timmer explains, although some of the SSN digits are relatively easy to obtain, others are more tricky:

Getting the last four digits right was substantially harder. The authors used a standard of getting the whole SSN right within 10 tries, and could only manage that about 0.1 percent of the time even in the later period. Still, small states were somewhat easier—for Delaware in 1996, they had a five percent success rate.

BUT, and this is a big but, it seems as though modern security systems and automated forms DO NOT REQUIRE the whole SSN. As long as it is cross-referenced with the date and place of birth, up to two numbers can be incorrect. John continues:

They often allow several failed verification attempts per IP address before blacklisting it. Given these numbers, the authors estimate that even a moderate-sized botnet of 10,000 machines could successfully obtain identity verifications for younger residents of West Virginia at a rate of 47 a minute.

Think about it: 47 a minute! Considering how prevalent ID theft is around the world, and how sophisticated thieves are becoming, I think this is enough to cause concern for the average US citizen. And as such, it may be time to start taking precautions.

First, see if you can remove your private information, or replace your place and date of birth with something more vague on your social networking sites and other public profiles. That one should be relatively easy, if a little time consuming.

Second, continue to practice good personal security. Shred any important documents that you are throwing out, and don’t leave sensitive data in a place where thieves could easily find it. I know a lot of people throw things in the car and forget about it, but if the car were stolen or broken into, it could be the start of much bigger problems.

Third, keep on top of your credit reports. You are allowed one free each year from each of the three major credit bureaus. DO NOT use freecreditreport.com, they charge. Instead, go to Annual Credit Report here. If you see anything suspicious or just plain wrong, contact the bureau immediately.

Finally, consider some ID theft protection. I use LifeLock because I got a great deal on it, and although not 100% effective, it does cover me if anything should happen. But LifeLock is basically just a method of putting 90-day fraud alerts on your credit reports, which you can do yourself for free. You can find the information for each bureau here:

EXPERIAN

EQUIFAX

TRANSUNION

For further reading, visit the FTC’s site. It has some great information. Stay safe folks.

Like this article? Pin it!

This article is from Paul Michael of Wise Bread, an award-winning personal finance and credit card comparison website. Read more great articles from Wise Bread:

The Jury Duty Scam – coming to a phone near you?

Paul Michael — Thu, 14 Aug 2008 21:25:23 +0000

My wife forwarded me one of those “hey everyone, don’t fall for this” emails this morning. I get one from a friend or relative at least once a week, and usually they’re well-meaning but filled with gross inaccuracies or are just completely untrue. However, when I looked to my source for all things BS, snopes.com, I discovered this one was 100% true. It’s called the Jury Duty scam. It’s a smart, simple con that could clean you out.

This scam has been around for a while (2005), but is relatively new compared to the Nigerian email scams and other similar cons. The premise is simple. Here’s the write-up from snopes.com :

The scammer calls claiming to work for the local court and claims you’ve failed to report for jury duty. He tells you that a warrant has been issued for your arrest.

Allow me to break in here for a second. That last statement is incredibly powerful because it throws you completely off guard. You’re now on the defensive, and in those situations you’re more prone to do what you can to make things right. Now, part two of the scam:

The victim will often rightly claim they never received the jury duty notification. The scammer then asks the victim for confidential information for “verification” purposes. Specifically, the scammer asks for the victim’s Social Security Number, birth date, and sometimes even for credit card numbers and other private information – exactly what the scammer needs to commit identity theft.

If you live in Michigan, Ohio, Texas, Arizona, Illinois, Pennsylvania, Minnesota, Oregon or Washington State, you’re in a state where this scam has already been reported. But that doesn’t mean you’re safe from this in any other town or city.

Personally, this scam would never get to me because I know I’m ineligible for jury duty. I’m a Green Card holder, so I’d already be clued in that something was wrong. You may also be someone who would just never fall for something like this. But the point of these scams is similar to the principle of junk mail and spam. For every 99 people that don’t fall for it, 1 person does. If you have an army of people making dozens of calls every hour, you could walk away with hundreds of thousands of dollars as an ID theft scammer in just one day.

What can you do? Arm yourself with knowledge.

First and foremost, the FBI issued a warning that states “the judicial system DOES NOT contact people telephonically and ask for personal information such as Social Security number, date of birth or credit card numbers.” The only time you will ever be called by a court system about jury duty is AFTER you have mailed back a completed questionnaire, and that is a rare occurrence.

So, if you are called out of the blue and someone is demanding your personal info, just hang up the phone. Don’t even get into a debate with these scumbags.

In fact, this is a good rule of thumb for any phonecalls that you do not solicit; NEVER give out personal information to verify records of any kind. If someone insists on “verifying” information, they should already have it…so, you can ask them to read it out and give yes or no answers. If it’s a scam, they clearly won’t have it.

Obviously, this does not apply to banks or credit card companies that YOU call, they should do an in-depth verification system before letting you have access to your accounts, with good reason.

You’d be well-advised, regardless of this scam, to keep an eye on your credit/debit cards and accounts for any unusual activity. And request a free copy of your credit report from annualcreditreport.com , you’re entitled to one from each of the credit reporting companies every 12 months. This is not to be confused with freecreditreport.com, which in my honest opinion is just a big, but perfectly legal, scam.

You can also put a fraud alert on your credit report for further safety, although there is still some debate about how this affects your credit rating. I have one on mine, I like the higher level of protection. Bottom line folks, this is a scam that really works and it’s only going to snag more people. Keep your wits about you, and have a safe day.

Other reading:

http://www.riverside.courts.ca.gov/newsmedia/05juryscam.pdf

http://www.mncourts.gov/?page=NewsItemDisplay&item=20317

This article is from Paul Michael of Wise Bread, an award-winning personal finance and credit card comparison website. Read more great articles from Wise Bread: