Social Security Numbers: Internet Resellers Provide Few Full SSNs, but Congress Should Consider Enacting Standards for Truncating SSNs
Released: 2006-05-17T00:00:00

Letter

Background

The SSN was created in 1936 as a means of tracking workers’ earnings and eligibility for Social Security benefits. SSNs are issued to most U.S. citizens, and to some noncitizens lawfully admitted to the United States. Through a process known as enumeration, a unique nine-digit number is created. The number is divided into three parts— first three digits represent the geographic area where the SSN was assigned; the middle two are the group number, which is assigned in a specified order for each area number; and the last four are serial numbers ranging from 0001 to 9999. Because of the number’s uniqueness and broad applicability, SSNs have become the identifier of choice for government agencies and private businesses, and are used for a myriad of non–Social Security purposes.

Information resellers, sometimes referred to as information brokers, are businesses that specialize in amassing personal information from multiple sources and offering informational services. These entities may provide their services to a variety of prospective buyers, either to specific business clients or to the general public through the Internet. More prominent or large information resellers such as consumer reporting agencies and entities like LexisNexis provide information to their customers for various purposes, such as building consumer credit reports, verifying an individual’s identity, differentiating records, marketing their products, and preventing financial fraud. These large information resellers limit their services to businesses and government entities that establish accounts with them and have a legitimate purpose for obtaining an individual’s personal information. For example, law firms and collection agencies may request information on an individual’s bank accounts and real estate holdings for use in civil proceedings, such as a divorce. Information resellers that offer their services through the Internet (Internet resellers) will generally advertise their services to the general public for a fee.

Resellers, whether well-known or Internet-based, collect information from three sources: public records, publicly available information, and nonpublic information.

Public records are available to anyone and obtainable from governmental entities. Exactly what constitutes public records depends on state and federal laws, but generally includes birth and death records, property records, tax lien records, voter registrations, and court records (including criminal records, bankruptcy filings, civil case files, and legal judgments).

Publicly available information is information not found in public records but nevertheless available to the public through other sources. These sources include telephone directories, business directories, print publications such as classified ads or magazines, and other sources accessible by the general public.

Nonpublic information is derived from proprietary or private sources, such as credit header data and application information provided by individuals—for example, information on a credit card application—directly to private businesses.

Information resellers provide information to their customers for various purposes, such as building consumer credit reports, verifying an individual’s identity, differentiating records, marketing their products, and preventing financial fraud. The aggregation of the general public’s personal information, such as SSNs, in large corporate databases and the increased availability of information via the Internet may provide unscrupulous individuals a means to acquire SSNs and use them for illegal purposes.

Because of the myriad uses of the SSN, Congress has previously asked GAO to review various aspects of SSN-use in both the public and private sectors. In our previous work, our reports have looked at how private businesses and government agencies obtain and use SSNs. In addition, we have reported that the perceived widespread sharing of personal information and instances of identity theft have heightened public concern about the use of Social Security numbers. We have also noted that the SSN is used, in part, as a verification tool for services such as child support collection, law enforcement enhancement, and issuing credit to individuals. Although these uses of SSNs are beneficial to the public, SSNs are also key elements in creating false identities. We testified before the Subcommittee on Social Security, House Committee on Ways and Means, about SSA’s enumeration and verification processes and also reported that the aggregation of personal information, such as SSNs, in large corporate databases, as well as the public display of SSNs in various public records, may provide criminals the opportunity to commit identity crimes.

We have also previously reported that certain federal and state laws help information resellers limit the disclosure of personal information including SSNs to their prescreened clients. Specifically, we described how certain federal laws place restrictions on how some Internet resellers’ obtain, use, and disclose consumer information. The limitations these laws afford are shown in table 1.

Internet Resellers’ Web Sites Shared Similar Characteristics

The Web sites of the 154 Internet resellers we reviewed had similar characteristics. Most resellers offered a variety of information that could be purchased, from telephone records to credit reports. In addition, Internet resellers also offered to sell information in various ways, from packaged information, such as various information that would be collected through a background check or a search of a person’s criminal records to single types of information, such as a credit score. These resellers usually listed the types of clients that they market their services to and broadly identified their sources of information.

Internet Resellers Offered to Sell a Variety of Information in Various Ways

We found that Internet resellers offered to sell a variety of information to anyone willing to pay a fee. On average, resellers offered about 8 types of services and two offered 20 types of informational services. As shown in figure 1, the majority of resellers offered to sell anywhere from 1 to 10 informational services.

The Internet resellers offering the fewest services tended to specialize in services provided to the public. For example, most of the resellers offering only one service were resellers that specialized in helping locate an individual. Others offered services related to employment or background checks.

Internet resellers also offered different ways for buyers to purchase their information. For example, some offered memberships that allowed online access to the reseller’s information, with the member performing the search. Another reseller offered to sell a software package that would allow a buyer to purchase access to the Internet reseller’s information through the purchased software and allowed many different types of information searches. The majority of resellers would require selected information about the buyer and then would perform the data search and provide an information report to the buyer.

We identified over 50 types of information offered for purchase by these resellers, which we categorized into six major categories including personal, legal, financial, employment, driver or vehicle, and telephone. Table 2 gives examples of the types of information found in these categories.

All the resellers offered to sell information from at least one of the six categories. However, not all resellers offered to sell driver or vehicle information, or telephone information. For example, only 85 of the 154 resellers we reviewed offered to sell some type of driver’s information, while 56 resellers offered to sell telephone information.

We found that Internet resellers either sold their information as a part of a package or sold single pieces of information. For example, resellers sold packaged information such as background checks, criminal checks, or employment checks/tenant screenings. Of the packaged information, we found that background checks provided the most extensive information. A background check may include personal, legal, and financial information, such as name, SSN, address, neighbors, relatives, and associates information. Such checks may include national, state, or county criminal records searches and bankruptcy and lien information. Other packages, such as criminal records packages, may include national, state, and county criminal records searches, sex offender searches, and civil litigation. Employment checks/tenant screenings may include current and past employment, SSN verifications, and national, state, and county criminal records searches.

Internet Resellers Usually Identified Their Clients

Over 80 percent of Internet resellers identified the clients to whom they marketed their information. Internet resellers identified their clients in several ways. About 60 percent of the time, resellers used the information sections of their Web sites to identify their clients. Web pages such as “Frequently Asked Questions,” “Help,” or “About Us” were frequently used to identify their clients. For example, the “About Us” Web page generally provided a brief description about the Internet reseller’s business and would often describe the clients it marketed to. Other ways in which resellers marketed to their clients were through testimonials or in a separate section on their Web page.

Internet resellers marketed their services to a variety of clients. As shown in table 3, individuals, businesses, and attorneys were the most frequently identified clients. Some of the businesses resellers identified were Fortune 500 companies and retailers. For the financial institution clients, resellers mostly identified banks. In addition, most of the Internet resellers’ clients were from the private sector, although some had government and law enforcement agency clients. Finally, we found that most of the resellers had multiple types of clients. About 30 percent of the resellers identified only one type of client.

Three-Quarters of Internet Resellers Identified Their Sources of Information

About 75 percent, or 115, Internet resellers identified the source of their information on their Web sites. Most of these resellers obtained their information from public or nonpublic sources or a combination of both sources. For example, a few resellers offered to conduct a background investigation on an individual, which included compiling information on the individual from court records and using a credit bureau to obtain consumer credit data. Some used only public records as their only source of information. The most frequently identified public records were court records, department of motor vehicle records, real property records, legal judgments, and bankruptcy records. We found about one-third of the Internet resellers used only one source of information. More often, they used a combination of the three sources. Figure 2 below shows the various combinations of sources of information.

Most Attempts to Purchase SSNs Failed

Most of our attempts to purchase SSNs from a select group of resellers failed. Of the 154 Internet resellers’ Web sites we reviewed, 53, almost 35 percent, offered to sell SSNs. We attempted to purchase SSNs from 21 resellers that were chosen because they required minimal information about prospective buyers or about the person whose SSN we wanted to obtain. Of the 21 resellers from which we tried to purchase SSNs, only 5 provided some form of an SSN. As shown in table 5, the reasons for being unable to obtain SSNs from 16 of the 21 resellers varied.

Nine resellers, a majority of the resellers that did not sell SSNs to us, did not explain why but simply did not provide the information we sought. Four of the remaining resellers attempted to contact us to request legal documentation to support a permissible purpose for obtaining the information. However, since we attempted to purchase SSNs as a member of the general public, we could not provide the requested information. One of these resellers sent us an e-mail asking us to fax a signed letter stating our reason for obtaining a person’s SSN and a copy of our driver’s license to verify our identity, which we could not provide. We contacted the other three to find out why prospective buyers were required to have a permissible purpose. One reseller told us that the company is audited every year by the government and that a legal document request was part of its security screening of its customers. The other two stated that some form of legal documentation, such as a certified copy of a court order, was required in order for their companies to release the information.

In addition to receiving one full and four truncated SSNs, we also received other information related to our purchases. Given that we only received SSNs as a part of packaged information, we were not surprised that we received additional information about the person whose SSN we were trying to obtain. For example, the two Internet resellers that provided some form of SSN in a background check report also provided the following information: the person’s current and previous addresses, date of birth, a list of other names associated with the person, a list of their neighbors, tax liens and judgments against the person, and properties owned by the person.

However, in one case we received unexpected and unrequested information. In this case, we did not receive the SSN of the person whose number we requested, but instead received the truncated SSNs of the person’s past and present neighbors, information we did not request.

Five of the 21 resellers from whom we attempted to purchase SSNs did provide us with some form of an SSN. We received one full nine-digit SSN and four truncated SSNs. All five resellers that supplied an SSN provided the SSN as a part of a package of information. As shown in table 6, the full SSN was obtained as a part of a background check, and the four truncated SSNs were provided as a part of a “people locator” package, a background package, and an employment trace. We attempted to order SSNs from five resellers that offered to sell the SSN alone, and we were unable to obtain an SSN from those resellers.

We also found a wide range of the costs for information services when we tried to purchase SSNs. The packages of information we attempted to purchase ranged from about $4 to $200 compared to the costs to purchase individual SSNs that ranged from about $15 to $150. The range of costs from the five resellers that provided some form of the SSN was about $20 to $200. The Internet reseller that provided the full SSN did so for $95.

Of the four resellers that gave us truncated SSNs, three of these disclosed on their Web sites that they would provide full SSNs, but only under certain circumstances. For example, one reseller said that, by law, it cannot provide a person’s SSN to any third party. Another required the customer to have a legitimate reason for requesting the information under laws such as GLBA. This reseller said it may not provide the full SSN if the customer did not meet those requirements. None explained why they only provided the first five digits.

All resellers that provided truncated SSNs showed the first five digits and masked the last four digits. We interviewed industry representatives and privacy experts to determine if this way of truncating the SSN was the standard practice among private sector entities. Industry representatives and privacy experts told us that entities in other industries may truncate the SSN differently from the truncated SSNs we bought from Internet resellers. For example, consumer data industry representatives said that members of their association decide for themselves how and when to truncate SSNs. One consumer reporting agency we spoke to told us that it truncates the SSN by masking the first five digits on reports it provides directly to consumers, by displaying only the last four digits. Some privacy experts said that certain entities that use SSNs as identifiers on lists, such as universities, also truncate the number by masking the first five digits. In addition, SSA also masks the first five digits of the SSN on the Social Security Statements mailed to individuals over the age of 25 who have an SSN and have wages or earnings from self–employment.

On the basis of our discussions with government officials and industry representatives, we could not identify any industry standards or guidelines for truncating SSNs. None of the officials we spoke to knew for certain why either method—masking the first five digits or the last four digits— was used or how such methods came into use. In addition, when we asked officials which way of truncating the SSN better protects it from misuse, there was no consensus among them, and no one knew of any research regarding this issue. Some officials said that although truncation could provide some protection for SSNs, it is unlikely to be foolproof. There are also few, if any, federal laws that require or regulate truncating the SSN. Currently, FCRA has a specific provision relating to truncating SSNs. Under this law consumers can request that their SSN be truncated to display only the last four digits on any consumer report they request about themselves. The Judicial Conference of the United States issued rules, effective in December 2003, requiring that SSNs be truncated to mask the first five digits in newly filed electronically available bankruptcy court documents.

Federal agency officials whom we spoke to said that Congress or SSA should decide how SSNs should be truncated. The Social Security Act of 1935 authorized SSA to establish a record-keeping system to help manage the Social Security program and resulted in the creation of the SSN. Through a process known as enumeration, unique numbers are created for every person as a work and retirement benefit record for the Social Security program. According to SSA officials, the law does not address the use of the number by private and public sector entities. SSA officials said that SSA regulates only the agency’s use of SSNs and does not have legal authority over SSNs used by others.

Applicability of Federal Privacy Laws to Internet Resellers Cannot Be Determined

Federal privacy laws that restrict the disclosure of personal information could be applicable to Internet resellers, but there was insufficient evidence on the resellers’ Web sites we reviewed to determine if they met specific statutory definitions. Federal privacy laws such as the FCRA, GLBA, and DPPA apply primarily to entities that meet specific statutory definitions. For example, FCRA applies primarily to a consumer reporting agency, which is defined as any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing “consumer reports.” In addition, these laws allow for disclosure of personal information for certain permissible purposes, and those who request or receive information from an entity meeting those statutory definitions may also have obligations under these laws. For example, FCRA generally prohibits “consumer reporting agencies” from furnishing “consumer reports” to third party users unless it is for a permissible purpose; before providing “consumer report” information to prospective users, however, the prospective user must certify the purposes for which the information is sought and that it will be used for no other purpose. GLBA and DPPA also contain prohibitions against re-disclosure of personal information covered by those laws.

FCRA, GLBA, and DPPA could apply to Internet resellers that identify themselves as one of the statutorily defined entities covered under the laws—which are consumer reporting agencies for FCRA, financial institutions for GLBA, and state motor vehicle departments for DPPA—or that received information from such entities. We found four resellers that identified themselves as one of the statutorily defined entities. Three stated on their Web sites that they were consumer reporting agencies and the other stated it was a credit bureau. However, we did not find similar information on the remaining 150 resellers’ Web sites to determine what type of entity they were. In addition, we found that some resellers identified the source of their information generally, but did not link information sources to particular pieces of information. For example, about 7 percent of the resellers identified “Department of Motor Vehicle records” as the source of some of their information and offered to search for personal information based on a driver’s license number, license plate number, or vehicle identification number. However, most did not specify which personal information came from the “Department of Motor Vehicle records” or any state motor vehicle departments. Therefore, we could not determine if FCRA, GLBA, and DPPA were applicable to the majority of resellers we reviewed.

Our review of the resellers’ Web sites found 79 of them, about 50 percent, referenced one or more federal privacy laws. As shown in figure 3, the most frequently mentioned laws were FCRA, GLBA, and DPPA.

We also found 5 out of the 154 Internet resellers referenced state laws on their Web sites. Two stated adherence to the California Investigative Consumer Reporting Act, which allows a consumer to review any files concerning that consumer maintained by an “investigative reporting agency.” One cited two California consumer laws. One law allows California consumers to remove their names from credit bureau mailing lists used for unsolicited pre-approved credit offers for a minimum of 2 years. It also provides identity theft victims and other consumers with increased rights regarding consumer credit reports, including requiring the deletion of inquiries resulting from identity theft. The other California law prohibits consumer credit reporting agencies that furnish reports for employment purposes from reporting information on the age, marital status, race, color, or creed of any consumer and requires the user of the report to provide written notice to the consumer. The law also requires that the consumer be provided a free copy of the report upon request. Another reseller cited a Florida statute that governs divulging investigative information, and yet another reseller stated adherence to the Michigan Private Detective License Act. Both state laws regulate the activities of private investigators.

Conclusions

Although personal information is widely available on the Internet to anyone willing to pay a fee, SSNs appear to be difficult to obtain from the Internet resellers we contacted. Few of the Internet resellers’ Web sites we reviewed offered to sell an individual’s SSN outright, and even those that did make such an offer did not follow through. Thus, the perception that anyone willing to pay a fee can easily obtain someone’s SSN does not appear to be valid. Our experiences indicate that it is more likely that a buyer would not be able to purchase an SSN or would receive a truncated version of an SSN from Internet resellers.

However, our work does suggest that someone seeking an SSN may be able to obtain a truncated SSN, and depending on the entity, the SSN may be truncated in various ways. Standardizing the truncation of the SSN could provide some protection from SSNs being misused. Under a standardized approach, the same digits of the SSN would be the only information transmitted, no matter the source from which the SSN is obtained. Given SSA’s role in assigning SSNs, SSA is in the best position to determine whether and if truncation should be standardized, but because the agency does not have specific authority to regulate truncation, SSN truncation will continue to vary.

Matter for Congressional Consideration

Since there is no consistently practiced method for truncating SSNs, and no federal agency has the authority to regulate how SSNs should be truncated, Congress may wish to consider enacting standards for truncating SSNs or delegating authority to SSA or some other governmental entity to issue standards for truncating SSNs.

Agency Comments and Our Evaluation

We provided a draft of this report to the Social Security Administration for comment and received a written response from the administration (included as app. II). SSA agreed that standardizing the truncation of SSNs would be beneficial and supported our recommendation for congressional action. In addition, SSA stated that while it does not have the legal authority to compel organizations to truncate SSNs or to specify how such truncating should be done, it would be willing to publish information on best practices for truncating SSNs on SSA’s Web site. We also provided a draft of this report to the Federal Trade Commission for technical review and received comments that were incorporated as appropriate.

We are sending copies of this report to the Chairman of the Federal Trade Commission, the Commissioner of the Social Security Administration, appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on GAO’s Web site at http://www.gao.gov/.

If you have any questions concerning this report, please contact me at (202) 512-7215. Contact points for our offices of Congressional Relations and Public Affairs may be found on the last page of this report. Other contacts and acknowledgments are listed in appendix III.

Appendix I: Scope and Methodology

To describe readily identifiable Internet resellers, we created a list of Internet reseller Web sites. To create a list of readily identifiable Internet reseller Web sites, we used Internet search techniques and keyword search terms that we thought the members of general public would use if they were trying to obtain someone else’s Social Security Number (SSN). We conducted our searches using three major Internet search engines— Google, Microsoft Network (MSN), and Yahoo. Within each of these search engines we conducted our searches using keywords such as, “find social security number,” “find ssn,” “purchase social security number,” and “public records search.” We chose these keywords based on the advice of privacy experts and the team’s judgment on terms that would yield Web sites that sell personal information including the SSN. Our searches resulted in 1,036 Web sites that we then reviewed to determine whether they were live sites, redirected sites, or duplicate sites that were operated by the same reseller. Nineteen percent of the 1,036 Web sites took us to another Internet reseller Web site that was included in our list. Most of these redirected sites took us to two Internet resellers that offered online membership—allowing access to their databases and affiliate programs, which allowed others to link their Web sites to the resellers’ Web sites. More than one-half of the 1,036 Web sites were inactive at the time a GAO analyst attempted to access the site. In addition, we found a few Web sites were operated by the same reseller and were similar in appearance. As a result, we ended up with a list of 226 sites that we included in our review. We recognize that had we used different search engines, different keywords, and a different point in time we may have identified a different list of sites.

To describe the types of readily identifiable Internet resellers that have SSN-related services and characteristics of their businesses, we developed a Web-based data collection instrument (DCI) for GAO analysts to document selected information contained on the Internet resellers’ Web sites. We used the DCI to record information from the Web pages that contained items that addressed the types of SSN-related services and information that the resellers sold, the sources of the information, and the types of clients to whom the site marketed. To ensure that the entry of the DCI data conformed to GAO’s data quality standards, each DCI was reviewed by one of the other GAO analysts. Tabulations of the DCI items were automatically generated from the Web-based DCI software. Supplemental analyses were conducted using a statistical software package. For these analyses, the computer programs were checked by a second, independent analyst. Our analyses found 154 Internet resellers with SSN-related services.

To determine the extent to which Internet resellers sell Social Security numbers, we analyzed data collected from the review of Internet resellers just described, attempted to purchase SSNs from a nonprobability sample of Internet resellers, and collected data about the transactions. We used information collected from the DCI to derive a nonprobability sample of Internet resellers to purchase SSNs. The criteria we used to select the resellers for our attempted purchases included the following (1) the Web site advertised the sale of an SSN without the customer’s having to provide the SSN of the subject of our inquiry, (2) the Web site advertised the sale of an SSN to the general public, and (3) the transaction could be made online through the Internet reseller’s Web site using a credit card. We collected information about the purchases including cost, the information that was required about the search subject and the purchaser (including the permissible purpose), whether the site contacted us to verify our information or our permissible purpose, and whether the SSN was provided and, if it was, whether the full or a truncated SSN was provided. In addition, we interviewed staff from the Federal Trade Commission, officials from the Social Security Administration, one of the three national consumer reporting agencies, the Consumer Data Industry Association (an international trade association that represents consumer information companies), and five privacy experts to obtain their views about the use of SSN truncation as a means for safeguarding the number. We also reviewed prior GAO work and performed literature and Internet searches about SSN truncation.

To determine the applicability of federal privacy laws to Internet resellers, we reviewed federal laws and the resellers’ Web sites for information about the resellers’ type of entity and sources of information. However, in most instances these resellers did not have sufficient information on their Web sites to determine if they were in compliance with these laws. Specifically, we were unable to determine whether most of these resellers met the definitions specified by these laws such as “financial institution,” “consumer reporting agency,” or an “officer, employee, or contractor” of a “State Motor Vehicle Department.” We also were unable to determine the resellers’ specific sources for particular pieces of information. Although Internet resellers generally did not provide information about the entity and sources of information, they generally cited, and we recorded, whether they stated adherence to any federal privacy laws.

Appendix II: Comments from the Social Security Administration

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact above, Tamara Cross, Assistant Director, Margaret Armen, Patrick Bernard, Richard Burkard, Ellen Chu, John Cooney, Benjamin Federlein, Evan Gilman, Richard Harada, Joel Marus, Andrew O’Connell, Stanley Stenersen, Jacquelyn Stewart, and Lacy Vong made important contributions to this report.