Social Security numbers facilitate identity theft

A happy family vacation in Virginia Beach turned into a nightmare for a retired Chesterfield County couple who became victims of identity theft.

Two days after Robert and Doris Struhmer's trip, someone began draining $5,200 from their checking account.

Over a 10-day period, unknown to them, a thief conducted numerous fraudulent transactions by phone and with fake checks using the Struhmers' checking account and routing numbers, even paying telephone and cell-phone bills and making a mortgage payment.

The losses came to Struhmer's attention when he received a call from Philadelphia police informing him that a man had been arrested with Struhmer's name, address and Social Security number in his possession.

Today, the Midlothian retirees are still scratching their heads about how it happened.

They've gotten their money back, closed the compromised accounts and put alerts on their credit reports. But they face traveling to Philadelphia next month to testify in court against the criminal.

"It has been a total nightmare," Struhmer said. "You're just waiting for something else to happen."

Martha Sharp, another area resident, said two banks, plus a former employer and possibly the state of Virginia, over the past several years failed to protect her Social Security number and a lot of other sensitive data from being stolen or lost.

"This is the world we live in now," she said. "I guess all these entities have a right to my Social Security number but are apparently unable control their systems to maintain an individual's privacy."

Sharp is correct.

Many businesses, government agencies and other entities are legally entitled to consumers' Social Security numbers.

Others, though, are not. The problem is those not entitled still ask, consumers tell, data slip out from databases, and con artists ply their trade, ripping off people's identities both from businesses and consumers.

So, which entities are entitled to know consumers' Social Security numbers? Which are not? What recourse is there for people who don't want to disclose their number? Why is it so critical to protect Social Security numbers now?

. . .

In a December report, "Security in Numbers: SSNs and ID Theft," the Federal Trade Commission said identity theft "continues to be a major problem in this country," with victims numbering in the millions each year and out-of-pocket losses in the billions of dollars.

Social Security numbers play a major role in facilitating identity theft. Because privateand public-sector entities have used them so extensively as an identifier, "the SSN has become both available and valuable to identity thieves," the FTC said.

That's why it is critical for consumers to limit access to their Social Security numbers. But some are losing the battle.

The Office of Inspector General said it received more than 14,200 allegations of Social Security number fraud or misuse in 2008, versus 12,200 in fiscal 2007. It opened more than 700 fraud cases related to Social Security numbers in 2008, spokesman George Penn said.

Consumer Jean Johnson of Highland Springs wants to know why some businesses like telephone companies ask for people's Social Security numbers.

"It makes me feel very vulnerable," Johnson said. "I'm very protective of my Social Security number."

Social Security Administration spokeswoman Dorothy Clark said if a business or government agency is not on its list of entities legally entitled to have consumers' numbers, "you're not legally required to give that number."

On the list: the Internal Revenue Service, various federal and state government agencies and departments, banks, employers and agencies that administer government programs.

Not on the list: doctors' offices and retailers.

Bon Air resident Beverly McNeer wonders whether businesses that are not entitled to your Social Security number can deny services or products if you do not produce it for them.

Clark says they can. "If you refuse to give them your Social Security number, you may not get the service you're trying to obtain."

It's a consumer's decision whether to give up their Social Security number or walk away and do business elsewhere, she said.

That can be disheartening if a person wants, say, a new doctor, but that doctor's front office requires providing a Social Security number.

A consumer can ask the company to use a different identifying number instead of a Social Security number, suggested Beth Givens, director of the Privacy Rights Clearinghouse in San Diego.

"What we recommend is that individuals offer to give their driver's license number instead," she said.

Can consumers compel an entity to stop using their Social Security number?

"You could say it to them, but they don't necessarily have to comply," said Naomi Lefkovitz, an attorney in the FTC's division of privacy and identity protection. "There's nothing to legally stop them from using it as an identifier.

"There are a number of companies that are moving away from using Social Security numbers as authenticators and additionally as internal identifiers," she said. But "there are other companies who aren't doing a thing. It can be a costly and time-consuming process, depending on their system."

The federal Medicare/Medicaid system still uses consumers' Social Security numbers on identification cards.

"The transition to [a] new Medicare identifier would cost more than half a billion dollars," said Tony Salters, spokesman for the Centers for Medicare & Medicaid Services. It would take more than three years "and result in enormous upset to our beneficiaries, more than a third of whom have had the same identifier for at least a decade."

Hopewell resident G. Lee said: "It is difficult to protect your Social Security number, especially when you are required to show your Medicare card when you need medical care, making it necessary to carry it at all times."

That may not be necessary, said Kim Brundage, spokeswoman for the Bon Secours Richmond Health System.

Even if a patient arrives unconscious, "the emergency department would seek identification like a driver's license and would use that information to obtain their Medicare/Medicaid status," she said.

Many companies and organizations have succeeded in safeguarding consumers' data. But others, among them some of the most trusted entities in the nation with deep pockets and sophisticated layers of security, have utterly failed to protect consumers' data, according to the Privacy Rights Clearinghouse.

The clearinghouse, which tracks data breaches, reported that more than 263 million records containing sensitive personal information, such as Social Security numbers, were involved in security breaches in the U.S. since January 2005.

"You should never assume that your Social Security number is being held securely," Givens said. "There are many factors outside the control of that company, such as hacking and dishonest employees."

Consumers often have little recourse when a company lets a person's sensitive data slip out of its database, she said.

"Several individuals have attempted to sue companies that have data breaches. But they have not been successful. If there's no evidence that a data breach resulted in ID theft, it's very difficult to sue," she said.

While many companies that have had a data breach offer free credit monitoring to those affected, others don't.

Many companies don't even offer free credit monitoring to the consumers whose data they let slip away. "There is no law that says that they must provide you any credit monitoring," said Mari Frank, a California ID theft and privacy attorney. "At least, there's no federal law."

SunTrust Banks Inc., with $179 billion in assets, would not explain why it uses customers' Social Security numbers as an identifier, if it intends to stop using them that way and if there's a prohibitive cost involved in switching to another type of identifier.

SunTrust spokesman Hugh Suhr said only: "Protecting the confidential information of our clients is paramount, and we incorporate extensive measures within our operations to help safeguard that information."

Many consumers fear their Social Security numbers have been so compromised over time that trying to protect them is like attempting to get toothpaste back in the tube.

Sharp noted: "I have had no known credit trouble yet, but still feel I'm sitting on a disaster waiting to happen."

Contact Iris Taylor at (804) 649-6349 or .