Originally, SSNs were used to keep track of earnings, contributions, and old-age, disability, and survivor benefits for people covered by the Social Security program. Increasingly, however, SSNs have been used for a wide variety of purposes by private firms and federal, state, and local governments. Cases in which ineligible foreign-born individuals have obtained or used SSNs to secure employment and receive Social Security benefits, and increasing incidents of identity theft, have focused attention on the need to prevent abuse of SSNs. An estimated 96 percent of workers in the U.S., including many foreign- born citizens and noncitizens, are required to pay Social Security payroll taxes, also called Federal Insurance Contribution Act (FICA) taxes. When workers pay Social Security taxes, they earn up to 4 coverage credits each year. Generally 40 credits--equal to at least 10 years of work--entitle workers to Social Security benefits when they reach retirement age. Social Security benefits are based on workers' covered earnings during their career. Different requirements apply in cases where workers become disabled or die with relatively short work careers. Although the Social Security Act provides that people meeting the work and contribution requirements accrue benefits, the act also generally prohibits payment of benefits to people who are not lawfully present in the U.S. as specified by DHS regulations. In fiscal year 2005, SSA assigned about 1.1 million original SSNs to noncitizens, representing about one-fifth of the 5.4 million original SSNs issued that year. Fewer than 15,000 of these were cards with "nonwork" SSNs issued to noncitizens unauthorized to work in the U.S. under immigration law. SSA also issues replacement cards to people who have already been assigned SSNs, but have lost their card. In fiscal year 2005, SSA issued over 800,000 such replacement cards to noncitizens, about 7 percent of the 12.1 million replacement cards issued that year. SSA uses different procedures for assigning SSNs depending on whether individuals are born in the U.S. or are foreign-born and depending on their citizenship or immigration status. Almost all individuals born in the U.S. or in U.S. jurisdictions are U.S. citizens at birth; however, some foreign-born individuals can also become U.S. citizens if their adoptive or birth parents are U.S. citizens or if they become naturalized citizens. Because foreign-born citizens are eligible for the same types of SSNs and benefits as U.S.-born citizens, we will focus for the remainder of this testimony on noncitizens. Immigrants are noncitizens who may lawfully reside and work permanently in the U.S. About 600,000 to 1.1 million noncitizens come to the US each year as immigrants. Nonimmigrants include noncitizens who come to the U.S. lawfully (for example, with temporary visas) and those who reside in the U.S. unlawfully (in violation of the Immigration and Nationality Act). Nonimmigrants who remain in the U.S. without DHS authorization overstay their nonimmigrant visas or enter the country illegally. As of 2004, an estimated 10.3 million unauthorized noncitizens lived in the U.S., according to the Pew Hispanic Center's analysis of March 2004 Current Population Survey and other Census data. The State Department, DHS, SSA, and employers have responsibilities to help ensure that noncitizens who are not authorized to work are denied employment. The State Department identifies who among people abroad seeking to come to the U.S. is eligible to enter the U.S. and who is eligible to work in the U.S. DHS denies entry to people who are ineligible and enforces immigration requirements in cases where people enter the U.S. illegally or work without authorization. In cooperation with the State Department and DHS, SSA assigns SSNs to eligible noncitizens. Employers are required to inspect employees' work authorization documents. A regular Social Security card can be one of the key documents that employers use to verify that employees are authorized to work. In some cases, however it may be difficult to distinguish a regular card from a nonwork card. Specifically, cards for individuals not eligible to work did not contain the restriction "NOT VALID FOR EMPLOYMENT" until May 1982. Finally, the SSA ensures that benefit payments go only to people who have earned them and who are lawfully present in the U.S. or in another country with which the U.S. has an agreement for reciprocal cross border payment of benefits. The Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA) was enacted in response to the terrorist attacks of September 11, 2001 to reform our nation's intelligence community and strengthen terrorism prevention and prosecution, border security, and international cooperation and coordination. IRTPA included several specific provisions for strengthening the SSN enumeration process and documentation requirements for obtaining SSNs and cards. For example, the act required minimum standards for birth certificates and directed the Department of Health and Human Services to establish these standards in consultation with DHS, SSA, and others. IRTPA also required that SSA limit the number of replacement cards it issues annually; adopt measures to improve verification of documents presented to obtain an original or replacement Social Security card; independently verify any birth record presented to obtain an SSN; prevent the assignment of SSNs to unnamed children and adopt additional measures to prevent assignment of multiple SSNs to the same child; form an interagency taskforce to establish standards to better protect Social Security cards and SSNs from counterfeiting, tampering, alteration, and theft; and provide for implementation of security requirements by June 2006. The Social Security Protection Act (SSPA) of 2004 imposed new restrictions on the payment of Social Security benefits to noncitizens. Before these provisions went into effect, all payments into the system would count toward insured status, regardless of whether or not the noncitizen was authorized to work by DHS. Under this new law, noncitizens who apply for benefits with an SSN originally assigned after 2003 must have work authorization at the time their SSN is assigned or at some later point before applying for benefits to gain insured status under the Social Security program. If the individual never had authorization to work in the United States, none of his or her earnings would count toward insured status and neither the worker nor dependent family members could receive Social Security benefits. SSA also has specific procedures to award benefits for foreign-born workers who work in both the U.S. and in another country with which the U.S. has a totalization agreement. These are bilateral agreements intended to accomplish three purposes. First, they eliminate dual social security coverage and taxes that multinational employers and employees encounter when workers temporarily reside in a foreign country with its own Social Security program. Under these agreements, U.S. employers and their workers sent temporarily abroad benefit by paying only U.S. social security taxes, and foreign businesses and their workers benefit by paying only Social Security taxes to their home country. Second, the agreements provide benefit protection to workers who have divided their careers between the U.S. and a foreign country, but do not qualify for benefits under one or both Social Security systems, despite paying taxes into both. Totalization agreements allow such workers to combine (totalize) work credits earned in both countries to meet minimum benefit qualification requirements. Third, totalization agreements generally improve the portability of Social Security benefits by authorizing the waiver of residency requirements. The U.S. has totalization agreements in effect with 21 countries--several western European countries, and others including Canada, Australia, Japan, South Korea, and Chile. (See table 4 in App. I for a list of countries with which the U.S. has totalization agreements.) In coordination with the State Department and DHS, SSA determines who is eligible for an SSN by verifying certain immigration documents and determining if an individual's card requires a work restriction. Our 2003 report identified improvements SSA had made in its enumeration processes, but also pointed to continued weaknesses, some of which SSA and the Congress have since addressed. Under current law U.S. citizens are eligible for SSNs whether they were born in the U.S. or elsewhere. Depending on their immigration status, noncitizens may be eligible for one of three types of Social Security cards: regular cards, those cards valid for work only with authorization from the DHS, and nonwork SSN cards. 1. Regular Social Security card: The first and most common type of card is for individuals who are eligible to work. Individuals issued these SSNs receive a Social Security card showing their name and SSN without marked restriction. To be eligible for this card an individual must be one of the following U.S. citizen (whether foreign-born or not), noncitizen lawfully admitted to the U.S. for permanent residence (an immigrant), noncitizen with permission from the DHS to work permanently in member of a group eligible to work in the U.S. on a temporary basis (e.g., with a work visa, certain authorized workers in an approved exchange program). 2. DHS-authorized work card: A much less common type of Social Security card is issued to noncitizens who are eligible to work under limited circumstances. They receive a card showing the inscription "VALID FOR WORK ONLY WITH DHS AUTHORIZATION." To be eligible for these cards noncitizens must have DHS permission to work temporarily in the U.S. SSA issues these cards to eligible workers, such as certain foreign students and spouses and children of exchange visitors. 3. Nonwork card: The third type of card is for people not eligible to work in the U.S. SSA sends recipients of these SSNs a card showing their name, SSN, and the inscription "NOT VALID FOR EMPLOYMENT." To be issued these cards, noncitizens who are legally in the U.S. and do not have DHS permission to work must have been found eligible to receive a federally-funded benefit or are subject to a state or local law that requires them to have an SSN to get public benefits. Examples include Temporary Assistance for Needy Families, Supplemental Security Income, Social Security Survivor benefits, Medicaid, and Food Stamps. As of 2003, SSA had issued a total of slightly more than 7 million nonwork Social Security cards, but in recent years SSA has greatly reduced the number it issues. Our 2003 report identified improvements SSA had made in its enumeration processes, but also pointed to continued weaknesses, some of which SSA and the Congress have since addressed. We found that SSA has over the years improved document verifications and developed new initiatives to prevent the inappropriate assignment of SSNs to noncitizens. For example, SSA requires third-party verification of all noncitizen documents, such as a birth certificate, with DHS and the State Department before issuing an SSN. SSA also requires field staff to visually inspect documents before issuing an SSN. However, many field staff we interviewed at that time were relying heavily on DHS's verification and neglecting SSA's standard inspection practices, even though both were required. We found that SSA's automated system for assigning SSNs was not designed to prevent issuing SSNs if field staff bypass required verification steps. We also found that SSA has undertaken new initiatives to shift the burden of processing noncitizen SSN applications and verifying documents away from its field offices. In late 2002, SSA began phasing in a new process for issuing SSNs to noncitizens, called "Enumeration at Entry" (EAE). Through this initiative, immigrants 18 and older can visit a State Department post abroad to apply for an SSN at the same time they apply for a visa to come to the U.S. The State Department and DHS authenticate the documents and transmit them to SSA, which then issues the SSN. Also, SSA was planning to expand the program over time to include other noncitizen groups, such as students and exchange visitors. In addition, SSA established a specialized center in Brooklyn, New York, which focuses exclusively on enumeration and utilizes the expertise of DHS immigration status verifiers and investigators from SSA's Office of the Inspector General. More recently, SSA established a similar center in Las Vegas, Nevada. At the time we did our field work for the 2003 report, SSA had not tightened controls in two key areas of its enumeration process that could be exploited by individuals seeking fraudulent SSNs: the assignment of SSNs to children under age 1 and the replacement of Social Security cards. SSA requires third-party verification of the birth records for U.S.-born children age 1 and over, but calls only for a visual inspection of birth documents for children under age 1. In our field work, we found that this remains an area vulnerable to fraud. Working undercover and posing as parents of newborns, our investigators were able to obtain two SSNs using counterfeit documents. Since then the IRTPA was enacted and requires SSA to independently verify any birth documents other than for purposes of enumeration at birth. Until the passage of the IRTPA, SSA's policy allowed individuals to obtain up to 52 replacement cards per year, leaving it vulnerable to misuse. While SSA requires noncitizens applying for a replacement SSN card to provide the same identity and immigration documents as if they were applying for an original SSN, SSA's requirements for citizens were much less stringent. Individuals could obtain numerous replacement SSN cards with relatively weak or counterfeit documentation for a wide range of illicit uses, including selling them to noncitizens. Our 2003 report contained six recommendations to SSA. As shown in table 1 below, SSA has implemented all, except one concerning enhancement of its Modernized Enumeration System to prevent issuance of SSNs without use of required verification procedures. In the interim, however, SSA now requires staff to use a software tool that documents verification procedures. Although SSA has implemented our recommendation concerning an evaluation of the Enumeration at Entry program, the results of the evaluations prompted the SSA's Office of Inspector General and Office of Quality Assurance and Performance Assessment to recommend several additional measures to correct errors during the early implementation of the program. To determine whether noncitizens are eligible for SSA benefits, SSA has implemented new procedures including some required by the SSPA. The SSPA tightened restrictions on payment of benefits to noncitizens who are not authorized to work. Generally both citizens and noncitizens in the U.S. accrue credits through paying Social Security payroll taxes. Noncitizens must also have authority to work in the U.S., and be lawfully present in the U.S. at the time they apply for benefits. Under some circumstances, unauthorized workers may receive benefits based on work credits they accrued while working without an immigration status permitting employment in the U.S., with a nonwork SSN or without a valid SSN during their work years. If noncitizens later receive a valid SSN and become eligible to work, they can show SSA their wage records and request credit for earnings from prior unauthorized work. If they establish legal immigration status, they may then receive benefit payments based on the earlier periods of unauthorized work. There are some exceptions for the lawful presence requirement, such as for workers covered under the terms of a totalization agreement. However, our work shows that SSA's processes for entering into totalization agreements have been largely informal and do not mitigate potential risks. The enactment of the SSPA in 2004 tightened the eligibility requirements for paying Social Security benefits to noncitizens. Before SSPA, noncitizens who worked in covered employment could in some circumstances eventually earn SSA benefits without obtaining a work- authorized SSN. If noncitizens had no SSN, but were entitled to benefits, SSA would assign a nonwork SSN so their Social Security eligible earnings could be recorded. SSPA provides that in order to accrue benefits noncitizens with a SSN issued on or after January 1, 2004 must have authorization to work in the U.S. at the time that the SSN is assigned, or at some later time. Without work authorization, noncitizens and their dependents or surviving family members cannot receive any benefits. See table 2 below. Nonetheless to receive benefits while in the U.S., noncitizens must be legally present in the U.S. under immigration law regardless of when they were first assigned an SSN. Previously if noncitizens accrued Social Security benefits and resided outside the U.S., they could under some circumstances receive those benefits without ever having been legally present in the U.S. Since SSPA required all noncitizens originally assigned an SSN on or after January 1, 2004, to have a work authorized SSN to accrue benefits, those living outside the country must also obtain a work- authorized SSN. Obtaining a work-authorized SSN requires both lawful presence in the U.S. and an immigration status permitting work in the U.S. However, a noncitizen may receive benefits outside the U.S. if he or she is a citizen of a country that has a social insurance or pension system that pays benefits to eligible U.S. citizens residing outside that country or is a worker covered under a totalization agreement. A noncitizen not meeting any of these exceptions will have his or her benefits suspended beginning with the seventh month of absence. In general, totalization agreements between the U.S. and other countries provide mutually beneficial business, tax and other incentives to employers and employees, but the agreements also expose both countries to financial costs and risk. Our recent reports on totalization agreements identified two fundamental vulnerabilities in SSA's existing procedures when entering into totalization agreements. First, our analysis demonstrated that the agency's actuarial estimates for the number of foreign citizens who would be affected by an agreement (and thus entitled to U.S. Social Security benefits) have overstated or understated the number, usually by more than 25 percent. As a result, depending on the size of the foreign population covered by an agreement, the actual cost to the Social Security trust fund from a given agreement could be greater or smaller than predicted. In response to our recommendation to improve its process for projecting costs to the trust fund from totalization agreements, SSA responded that it cannot eliminate all variations between projected costs and subsequent actual experience. Secondly, our work has shown that SSA's processes for entering into these agreements have been largely informal and have not included specific steps to assess and mitigate potential risks to the U.S. Social Security system. For example, we found that SSA's procedures for verifying critical information such as foreign citizens' earnings, birth, and death data were insufficient to ensure the integrity of such information. Inaccurate or incomplete information could lead to improper payments from the Social Security trust fund. In response to our recommendations, SSA developed several new initiatives to identify risks associated with totalization agreements. For example, SSA developed a standardized questionnaire to help the agency identify and assess the reliability of earnings data in countries that may be considered for future totalization agreements. In addition, SSA is conducting numerous "vulnerability assessments" to detect potential problems with the accuracy of foreign countries' documents. SSA is also exploring a more systematic approach for independently verifying foreign countries' data, such as the use of computer matches. (For a summary of the status of recommendations, see table 3 below.) Laws and policies are in place to ensure that SSA treats noncitizens fairly in the issuance of SSNs, the provision of benefits, and in cases where they are covered under the terms of totalization agreements. Recent legislation and revisions to SSA policies represent some progress in these areas. While SSA is making progress in improving the program's integrity by strengthening its procedures for verifying documents and coordinating with other agencies and foreign governments, opportunities remain for additional progress. SSA plans further enhancements to the Enumeration at Entry program in order to protect against errors, fraud and abuse. In addition, a more systematic approach to verifying data from other countries with which we have totalization agreements can help ensure proper payments of benefits and prompt notice of the death of beneficiaries. SSA will, however, continue to face challenges in its dealings with noncitizens. Changes in immigration laws and shortcomings in the enforcement of those laws make it difficult for SSA to identify noncitizens who are eligible for SSNs and for benefit payments. Continued attention to these issues by both SSA and the Congress is essential to ensure that noncitizens receive benefits to which they are entitled and the integrity of the Social Security program is protected. Mr. Chairman and Members of the Subcommittee, this concludes my prepared statement. I'd be happy to answer any questions you may have. For further information regarding this testimony, please contact Barbara D. Bovbjerg, Director, Education, Workforce, and Income Security Issues at (202) 512-7215. Blake L. Ainsworth, Assistant Director; Alicia Puente Cackley, Assistant Director; Benjamin P. Pfeiffer; Anna H. Bonelli; Jeremy D. Cox; Jacqueline Harpp; Nyree M. Ryder; Daniel A. Schwimer; and Paul C. Wright also contributed to this report.

Summary:
In 2004, an estimated 35.7 million foreign-born people resided in the United States, and many legitimately have SSNs. Many of these individuals have Social Security numbers (SSNs) which can have a key role in verifying authorization to work in the United States. However, some foreign-born individuals have been given SSNs inappropriately. Recent legislation, aimed at protecting the SSN and preventing fraud and abuse, changes how the Social Security Administration (SSA) assigns numbers and awards benefits for foreign-born individuals. The chairman of the Subcommittee on Social Security asked GAO to address two questions. First, how does SSA determine who is and is not eligible for an SSN? Second, how does SSA determine who is and is not eligible for Social Security benefits? SSA determines who is eligible for an SSN by verifying certain immigration documents and determining if an individual's card requires a work restriction. Some foreign-born individuals are eligible for one of three kinds of Social Security cards depending in part on their immigration status: (1) regular cards, (2) those valid for work only with authorization from the Department of Homeland Security (DHS), and (3) those that are not valid for work--non-work cards. As of 2003 SSA had issued slightly more than 7 million non-work cards to people who need them to receive benefits for which they were otherwise entitled. Both SSA's Inspector General and GAO have identified weaknesses in SSA procedures for assigning SSNs and issuing cards, also known as enumeration. For example, working undercover and posing as parents of newborns, GAO investigators were able to obtain Social Security cards by using counterfeit documents. Congress has enacted recent legislation strengthening the SSN enumeration process and documentation requirements. SSA is implementing the law and is improving document verification and now requires third-party verification of noncitizen documents such as birth certificates and visual inspection of documents before issuing an SSN. SSA also continues to strengthen program integrity by, for example, restricting the number of replacement cards. Congress and SSA have also improved laws and procedures designed to strengthen program integrity in the payment of benefits to the foreign-born. Due to provisions of the Social Security Protection Act of 2004, some foreign-born individuals who were not authorized to work will no longer be eligible for benefits. To be entitled to benefits, the law requires noncitizens originally assigned an SSN after 2003 to have a work-authorized SSN. Amendments to the Social Security Act in 1996 require individuals to be lawfully present in the U.S. to receive Social Security benefits, though some noncitizens can receive benefits while living abroad, such as noncitizens who have worked in the U.S. and in a country with which the U.S. has a totalization agreement. SSA's totalization agreements coordinate taxation and public pension benefits. The agreements help eliminate dual taxation and Social Security coverage that multinational employers and employees encounter when workers temporarily reside in a foreign country with its own Social Security program. Successful implementation of these agreements requires the countries involved to carefully coordinate and verify data they exchange. Computer matches with foreign countries, for example, may help protect totalization programs from making payments to ineligible individuals. SSA is exploring options for undertaking such exchanges.