GAO

United States General Accounting Office

a

Testimony

Before the Subcommittee on Oversight and Investigations, 

Committee on Financial Services; and Subcommittee on 

Social Security, Committee on Ways and Means

For Release on Delivery

Expected at

10:00 a.m., EST

on Thursday

November 8, 2001

SOCIAL SECURITY

Observations on Improving 

Distribution of Death 

Information

Statement of Barbara D. Bovbjerg, Director 

Education, Workforce and Income Security Issues and

Richard J. Hillman, Director

Financial Markets and Community 

Investment Issues

GAO-02-233T

Page 1 GAO-02-233T 

Chairwoman Kelly, Chairman Shaw, and Members of the Subcommittees:

Thank you for inviting us here today to provide you with our observations 

on the gathering of death information and its distribution to financial 

institutions. Over the past few years, Congress, law enforcement, and 

others have expressed concern over the use and misuse of Social Security 

numbers (SSNs). Accurate and timely death information (i.e., notification 

of death), including the SSN, is critical to the integrity of the federal 

benefits system and can help protect consumers’ financial assets against 

fraud. However, the SSN also is a key identifier used by unscrupulous 

individuals to steal identities, obtain false identification documents, and 

commit fraud.1

 

In light of the recent terrorist attacks, your committees have considered 

actions to prevent potential terrorists and criminals from creating false 

identities using SSNs and, in particular, to prevent the misuse of a deceased 

person’s Social Security number. Accordingly, you asked us to examine the 

process for gathering death information and distributing it to financial 

institutions. Specifically, our remarks will focus on (1) how long each stage 

of the process takes, (2) what actions the financial services industry 

reported taking to prevent the misuse of a deceased person’s Social 

Security number, and (3) what possible steps could be taken to improve the 

timeliness of collecting and transmitting death information. Our 

observations are based on prior GAO work, preliminary work at the Social 

Security Administration (SSA) and the National Technical Information 

Service (NTIS), and discussions with the three national credit reporting 

agencies, eight of the largest credit card issuers, and two national trade 

associations. We have not independently verified the timing of the process 

for distributing death information, nor have we assessed the costs 

associated with improving the timeliness of this process.

In summary, death information collected by SSA generally reaches financial 

institutions and other entities within 1 to 2 months of a person’s death, 

although delays in processing and distributing information sometimes 

occur. Complete files of recent deaths are distributed quarterly and 

updated monthly with information from a number of sources. SSA receives 

direct reports of deaths from relatives and friends of the deceased and from 

funeral homes. SSA also obtains further data by cross-checking its own 

1

Identity Fraud: Information on Prevalence, Cost, and Internet Impact Is Limited

(GAO/GGD-98-100BR, May 1998).
Page 2 GAO-02-233T 

files with information from other federal and state agencies. The financial 

services industry relies on Social Security numbers as one of the primary 

identifiers to establish the identity of customers, to assess the 

creditworthiness of customers, and to protect against fraud. Financial 

institutions check personal information provided by those seeking new 

credit, and many subscribe to fraud prevention products. The financial 

services representatives we spoke with expressed interest in receiving 

more timely death information. SSA is exploring ways to accelerate the 

process of receiving and processing death information, including 

producing updates weekly rather than monthly, and transmitting death 

information to NTIS electronically. In a long-term initiative, SSA is 

participating with state and local officials to develop an Electronic Death 

Registration System that could reduce the time to report death information 

to SSA. However, cost and legal issues remain to be resolved before the 

electronic system can be fully implemented.

Background Each year, about 2.5 million people die in the United States. SSA is 

responsible for keeping track of death information on beneficiaries of the 

Social Security system, but it gathers such information on nonbeneficiaries as well. SSA collects reports on deceased persons from a 

number of sources, including funeral homes, relatives, other federal 

agencies, and state vital record offices. SSA places information from the 

reports, such as the date of death, in its Numerical Identification File 

(NUMIDENT)–-the master file of Social Security number holders. It 

contains information collected when an individual applies for a Social 

Security card, when a change of name or other correction is recorded, and 

when a death is reported. SSA periodically extracts death information 

from this file to generate the Death Master File (DMF). SSA may make 

death information available to the public under the Freedom of Information 

Act.

SSA makes the DMF file available to the public, including financial 

institutions, through NTIS. NTIS offers this file as a single issue or a 

subscription. Purchasers who wish to keep their DMF current are required 

to purchase a subscription, which includes the full file and monthly 

updates. NTIS makes this information available to its 107 subscribers on 

magnetic tape or CD-ROM. NTIS subscribers include churches, computer 

companies, federal and state agencies, insurance companies, non-profit 

organizations, universities, the national credit reporting agencies, and 

other financial services organizations. 
Page 3 GAO-02-233T 

Death Information Is 

Distributed to 

Financial Institutions 

Within 1 to 2 Months 

Death information is collected and transmitted through several steps. 

Relatives, friends, or funeral homes are generally the first to report deaths 

to SSA, and the reports typically reach SSA field offices and processing 

centers within a week of the death.2

 According to SSA, these sources 

account for about 90 percent of the death information it receives. The 

remaining reports come from other federal or state agencies. 

Processing information from relatives, friends, or funeral homes generally 

takes another week after SSA receives the notification. After a death report 

arrives at a field office or processing center, SSA checks the Master 

Beneficiary Record or the Supplemental Security Record to determine 

whether the deceased was a Social Security program beneficiary.3

 Death 

information is recorded directly on NUMIDENT within a few days of the 

report's receipt. If the deceased was a beneficiary, benefits are also 

terminated on the Master Beneficiary Record. 

In some cases, death reports are delayed or SSA requires more than a week 

to complete the processing of a report. About 5 percent of the deaths 

reported to SSA, for example, are identified from SSA computer matches 

with records of deceased individuals provided by other federal agencies, 

such as Veterans Affairs and the Centers for Medicare and Medicaid 

Services, or state agencies, such as state vital statistics bureaus. SSA field 

offices must verify any death report that was based solely on information 

from these matches before terminating any benefits or recording the death 

information on NUMIDENT. Because death data provided by states to SSA 

is restricted,4

 some deaths may not be recorded on the DMF distributed to 

financial institutions.5

 Over time, the number of death records that are 

2

For example, funeral home directors, who are generally responsible for submitting death 

certificates to the state vital statistics bureaus, report deaths to SSA by submitting a form to 

local SSA field offices.

3

The Master Beneficiary Record and Supplemental Security Record are the principal SSA 

payment files for the Old Age, Survivors, and Disability Insurance and the Supplemental 

Security Income programs, respectively.

4

According to the National Association for Public Health Statistics and Information Systems 

(NAPHSIS), states restrict the disclosure of their death information to secure compensation 

for its use and to maintain confidentiality. NAPHSIS is a not-for-profit organization 

representing most of the state registrars and directors of vital statistics.

5

42 U.S.C. 405(r) permits SSA to restrict state-supplied death information to federal benefitpaying agencies.
Page 4 GAO-02-233T 

affected by this restriction is unclear. Once SSA field offices verify the 

state-supplied death information with another source and take the 

necessary action to terminate benefits and update its benefit records, 

disclosure of the death information is no longer restricted. However, the 

time period from the date of death until these deaths are recorded on 

NUMIDENT may be quite long, because death reports from states may be 

90 to 120 days old when they arrive at SSA.

The remaining 5 percent are based on files from the Department of the 

Treasury of payments returned by postal authorities or financial 

institutions. A Department of the Treasury official told us that it was likely 

that these reports require more than a week from the date of death to reach 

SSA. However, we did not verify this information and could not determine 

how much more than a week might elapse.

At the beginning of each month, SSA extracts death information from the 

NUMIDENT for the DMF and sends the file to NTIS. According to NTIS 

officials, the files generally arrive within the first week of the month. NTIS 

generally needs another 2 to 4 days to produce and send the magnetic tapes 

and CD-ROMs to its subscribers. In total, about 1 to 2 months elapse 

between a person’s death and the time when the death information is 

available to financial institutions and other NTIS subscribers, depending on 

when the death notice is first received by SSA.

Actions Taken By 

Financial Institutions 

to Prevent Misuse of 

Deceased Individuals’ 

Social Security 

Numbers

The financial services industry relies heavily on SSNs as a key identifier for 

a number of purposes, such as the reporting of information to the Internal 

Revenue Service or the accurate processing and recording of customer 

financial transactions. The timely receipt of death information and prompt 

updating of financial data are key factors in the industry’s ability to prevent 

fraud and identity theft involving the SSNs of deceased individuals. 

In our discussions with representatives from the financial services industry, 

they reported taking a number of steps to verify information on customers 

applying for new credit. For example, financial institutions check the 

creditworthiness of customers by obtaining the credit history of an 

applicant from credit reporting agencies, using the SSN as one of the key 

identifiers. However, for existing accounts, most financial institutions we 

spoke with did not use a formal process or central data source to identify 

deceased customers. Instead, they relied primarily on family members and 

on executors or trustees of the estate to provide this information. For 

existing customers receiving Social Security benefits via direct deposit, 
Page 5 GAO-02-233T 

Social Security stated that it generally notifies the financial institution of a 

beneficiary’s death within 24 hours of receiving notice. However, as we 

discussed above, there could be delays in SSA receiving such notices.

Some of the institutions we spoke with were aware of the Death Master 

File but were (1) unsure about the information it contained or (2) not 

aware that they could subscribe to the file from NTIS. Others were not 

aware that the Death Master File existed. According to the NTIS 

subscriber list, very few banks subscribe through NTIS for the Death 

Master File. Only one of the financial institutions we spoke with reported 

tracking losses or the frequency of fraud associated with deceased 

customers. However, the financial institutions we spoke with reported that 

their losses or the frequency of occurrence were not material. Most 

financial institutions told us that they subscribed to fraud prevention 

products or services offered by the credit reporting agencies that included 

alerts for deceased persons’ Social Security numbers.

All three national credit-reporting agencies reported subscribing to and 

receiving the monthly updates to the DMF. However, one credit reporting 

agency relied solely on the quarterly Death Master File and not on the 

monthly updates for its normal credit reporting and fraud services. We also 

found that the credit reporting agencies made the data from the DMF 

available only for subscribers to their proprietary fraud prevention 

products. In contrast, death information reported directly to the credit 

reporting agencies by credit issuers and family members was made 

available to all their users, along with other credit information on a 

customer’s credit history. This information was generally provided within 

one to two billing cycles.

Financial institutions also subscribe to other sources for death 

information. One information service we contacted primarily used the 

Death Master File and supplemented it with information from other 

sources, such as funeral homes and local governments. It provided 

screening and matching services to its clients, to identify deceased 

customers. The representative we spoke with indicated that his service’s 

clients often lacked the necessary technology infrastructure to process and 

maintain the Death Master File. This representative also noted that the 

timeliness of data contained in the DMF had greatly improved since the 

move to the monthly updates (from quarterly updates). However, the 

representative said that more frequent updates—weekly or daily—were 

needed.
Page 6 GAO-02-233T 

Two credit card associations that we contacted have also taken some steps 

to help prevent the misuse of Social Security numbers of deceased 

individuals. For example, they cosponsored a verification system for 

bankcard applications. This system was designed to verify such things as 

an applicant's address, telephone number, and Social Security number, and 

whether he or she has provided any questionable data on the application. 

This system, which was designed to help members reduce losses attributed 

to fraud, had several fraud alert codes, one specifically designated to flag 

the use of the Social Security number of a deceased individual.

In our discussions with representatives from the financial services industry, 

most expressed an interest in receiving more timely death information to 

narrow the window of opportunity in which criminals can perpetrate fraud. 

The credit reporting agencies expressed an interest in receiving more 

frequent DMF updates, but their responses varied regarding how frequently 

SSA needed to provide those updates. Some could handle the updated 

information daily; some could process the updates only biweekly. Some 

recommended that SSA provide a Web-based “look-up” service to verify 

death information.

Possible Steps for 

Improving the 

Collection and 

Transmission of Death 

Information

SSA is exploring ways to speed up the collection and processing of death 

reports and the transmission of death data to financial institutions. In the 

near term, SSA and NTIS are discussing ways to speed up the transmission 

of death information to users, such as financial institutions. SSA officials 

have stated that it would be relatively easy to produce updates on a weekly 

rather than monthly basis. Additionally, SSA and NTIS officials stated that 

it should be possible for SSA to transmit updates electronically to NTIS, 

and that NTIS could also provide its updates to financial institutions 

electronically. SSA officials have indicated that it would be more difficult 

and costly to provide updates more frequently than weekly, or to bypass 

NTIS and provide electronic updates directly to financial institutions. 

As we have previously reported, delays in SSA receiving some state death 

reports have hindered the prompt processing and distribution of such 

information. In a long-term initiative, SSA is participating in several pilot 

projects with state and local officials to develop an Electronic Death 

Registration System that, among other things, would enable the states to 

report deaths to SSA electronically. This system could improve the speed 

with which deaths are reported to SSA. For example, in a July 2001 SSA 

request for contract proposals of the new system, SSA required project 

plans to demonstrate the capability to send a “fact of death” report to SSA 
Page 7 GAO-02-233T 

within 5 days of a death, and within 1 day of receipt in the state bureau of 

vital records. However, state agreements with SSA preclude the agency 

from terminating benefits solely on the basis of state-provided death 

reports. Therefore, SSA also required project plans to demonstrate the 

capability to confirm death information electronically with entities 

originating the death report, such as funeral directors.

SSA and the National Association for Public Health Statistics and 

Information Systems officials also indicated that there are unresolved 

issues with the Electronic Death Registration System. These include the 

willingness of the states to adopt this system and SSA’s ability to release 

state-provided death information to financial institutions. For example, 

SSA officials stated that it remains unclear whether states will be willing or 

able to pay the cost of installing automated terminals in the funeral homes, 

hospitals, medical examiner offices, and other locations involved in the 

death registration process. Additionally, SSA has not yet resolved legal 

issues that might preclude the release of state-provided death report 

information to financial institutions.

We inquired about the feasibility of SSA providing death information 

directly to financial institutions and others from an on-line, Web-based 

look-up service. SSA officials said that implementing such a system would 

require significant changes to various SSA systems and might raise privacy 

considerations.

SSA, NTIS, and the credit reporting agencies told us that additional 

resources would be required to process death information more frequently. 

However, NTIS officials expressed some concern that there should be a 

demonstrated demand for the improved service before making these 

investments.

Conclusions In conclusion, it appears that SSA and NTIS could improve the timeliness 

of the distribution of the Death Master File. Improving the timeliness of 

death information to the financial services industry would help to narrow 

the window of time that a criminal has to open new accounts using a 

deceased individual’s identity. Additional education to the financial 

services industry about the availability and contents of the Death Master 

File would also be helpful. Providing more timely death information and 

making financial institutions more aware of a reliable source of such 

information are tangible steps that could be taken to deter criminals from 

using deceased individuals’ Social Security numbers to obtain false 
Page 8 GAO-02-233T 

identities for use in fraudulent activities. However, improving the 

timeliness of death information would not by itself eliminate identity theft 

and is not a panacea for addressing the larger issue of the criminal misuse 

and theft of Social Security numbers. 

Chairwoman Kelly and Chairman Shaw, this concludes my statement. We 

would be pleased to respond to any questions that you or other members of 

the Subcommittees may have.

Contacts and 

Acknowledgments

For further information regarding this testimony, please contact Barbara D. 

Bovbjerg, Director, or George A. Scott, Assistant Director, Education, 

Workforce, and Income Security (202) 512-7215, and Richard J. Hillman, 

Director, or Harry Medina, Assistant Director, Financial Markets and 

Community Investment (202) 512-8678. Individuals making key 

contributions to this testimony include Daniel F. Alspaugh, Emily R. 

Chalmers, Heather T. Dignan, Debra R. Johnson, Kay Kuhlman, and John M. 

Schaefer.