Social Security benefits are based on a worker’s lifetime earnings in covered employment. As the agency responsible for issuing SSNs and paying retirement, survivors, and disability benefits to insured persons, SSA must have accurate records of every worker’s earnings. Inaccurate earnings records can create benefit payment errors. Through a process known as enumeration, SSA assigns a unique SSN to each individual who meets the requirements for one. Currently, SSNs are issued to most U.S. citizens at birth. They are also available to noncitizens lawfully admitted to the United States with permission to work. Lawfully admitted noncitizens may also qualify for an SSN for nonwork purposes when a federal, state, or local law requires that they have an SSN to obtain a particular public benefit or service. SSA must obtain documentary evidence from such applicants regarding their age, identity, U.S. citizenship, or lawful alien status, and if they were previously assigned an SSN. Thus, SSA maintains a historical record of each worker’s annual earnings, which is identified by the worker’s name and Social Security number. The earnings reporting process begins at the end of each calendar year, when employers submit reports of their workers’ earnings to SSA on IRS Form W-2 (Wage and Tax Statement). To prepare the W-2, employers generally use certain information that workers provide on Form W-4, which is the document that determines the amount of federal income taxes that will be withheld from the worker’s pay. If the SSN and name on an earnings report submitted by the employer do not match information in SSA’s Master Earnings File (MEF), the reported earnings are placed in the ESF, which is a repository for earnings reports for unidentified workers. The ESF is an online file that can be updated throughout the day by all SSA field offices and various centralized components, although the updates are performed via batch mode. Removal of earnings reports from the ESF occurs only when a report can be matched and posted to a worker’s MEF record. This process is termed “reinstatement” by SSA. Thus, the number of reports in ESF on a given day fluctuates as earnings are reinstated to the correct Social Security records. Table 1 reflects the ESF reports remaining, listed by decade, corresponding to the tax year of earnings for which each report applied, since inception of the Social Security program. SSA uses various processes to post reported workers’ earnings to valid Social Security records. Generally, employers send SSA one W-2 each year that reports the annual earnings for each of their workers. Upon receipt of these earnings reports, SSA electronically validates whether it has established a Social Security record for the reported SSN and surname shown on the W-2. SSA does this by electronically matching the worker’s surname and SSN on the W-2 to information in its number identification file (Numident) that contains demographic information about every SSN holder. When the SSN and the first seven characters of the surname are identical on the W-2 and the Numident file, SSA posts those earnings to the indicated record in its MEF. SSA is able to place about 90 percent of employer-submitted earnings reports received each year in an appropriate MEF record. (Fig. 1 shows SSA’s process in more detail.) For the 10 percent of the reports that fail this initial validation test, SSA performs more than 20 of what it calls “front-end validation routines” that manipulate either the reported name or the SSN in a variety of ways to correct common reporting mistakes so that SSA can find an MEF record and prevent the posting of the earnings to the ESF. SSA’s front-end routines identify Social Security records for about 60 percent of the reports that are initially categorized as mismatches each year. In manipulating worker information to find a valid record, the automated front-end routines assume either the SSN is correct and there is a problem in the reported name or vice versa. For example, one front-end routine for reported name errors tests whether the first name and the surname have been reversed on the employer-filed W-2. The name reversal routine compares the first name from SSA’s Numident file with the surname on the W-2. If they are the same and the first initial for the middle and surname match the information on the W-2, then SSA assumes it has found the proper record and posts the earnings. Other front-end routines check whether digits in the SSN are transposed or inaccurate or whether the name on the report contains transposed or missing letters. Another front- end routine involves searching for reinstated items that in the past have included the same reporting error occurring in the current year’s earnings report. Over the past several years, such routines have allowed SSA to post an annual average of 15 million earnings reports to individual MEF records, rather than to the ESF. Table 2 summarizes the performance of these front-end routines for the past 5 reporting years. It shows that SSA found about 76 million valid records for reported earnings for tax years 1998 to 2002. If the front-end routines do not identify a valid record, SSA posts the earnings in the ESF. SSA subsequently performs what it calls “back-end” processes on the items, consisting of electronic and manual actions to match the earnings to a worker’s MEF record. For one such process, SSA uses corrections of reported names and SSNs generated under IRS’s automated routines. SSA then attempts to find the W-2 in the ESF and validate the corrected name and SSN that IRS provides against SSA’s records; when both conditions are met, SSA accepts IRS’s corrections and reinstates the item to the worker’s record. Under another process, which SSA calls decentralized correspondence, or DECOR, SSA sends letters to addresses listed on each invalid W-2, seeking information to resolve the identity issue (or to the employer if the W-2 lacks a valid address). If the worker does not respond, SSA then sends a letter to the employer that filed the report soliciting assistance in resolving the problem. Other types of correspondence involve Young Child Earnings Records and Earnings After Death, for which SSA sends letters to employers and/or the persons whose SSNs appear on the reports; SSA automatically posts such earnings reports to the ESF because the persons named in the reports are, respectively, either (a) 6 years of age or younger (thus unlikely to have earnings through employment) or (b) have a date of death recorded on their Numident record for a year prior to the tax year for which earnings on Form W-2 have been reported. Upon receiving satisfactory documentation clarifying the earnings and linking them to the proper SSN, SSA reinstates earnings reports to the individuals’ MEF record. SSA also uses yet another process, known as FERRET, that compares worker addresses on the W-2 with addresses that IRS has from individual tax returns. In its Operation 30 routine, SSA staff compare ESF earnings reports with valid SSNs with information in the Numident record. Staff check whether nicknames, surname derivations, and other obvious mistakes in spelling might be the cause of the posting problem. Table 3 shows that in 2001 (the last year for which data were available), selected back-end routines reinstated almost 600,000 earnings reports totaling almost $4 billion. SSA has two other electronic back-end routines that have produced a large number of reinstatements. In a process called SWEEP, SSA periodically reruns ESF items through its records to determine whether updated information has been added to the Numident or whether newly developed validation routines might permit reinstatements. In 2003, SSA reinstated 123,741 items through SWEEP, covering tax years 1977-2001. GAP SWEEP is a newly developed routine that scans earnings records for valid SSNs in the ESF and assesses whether yearly gaps in earnings exist in the MEF record and might be linked to similar earnings in the ESF. If a link can be made, SSA uses slightly less stringent name match rules; if the name can be validated, the item is reinstated. As of May 2003, SSA has reinstated through the GAP SWEEP routine over 1.5 million items (across all tax years back to 1937), representing $6.1 billion in earnings. Still another back-end process involves a manual review of worker- submitted evidence and a check of automated data. Workers (and their dependents and survivors) may visit local SSA offices to have earnings reinstated through the Item Correction (ICOR) process. Individuals provide SSA staff with evidence, such as W-2s, earnings statements, and tax returns, to document earnings that are missing from their Social Security record. Upon receiving adequate proof that links an earnings report to the individual, SSA field staff manually reinstate the earnings, subject to an accuracy check by a peer or supervisor. SSA provided information indicating that in fiscal year 2003, field staff had made about 244,000 earnings reinstatements through the ICOR process. Furthermore, each year SSA mails a Social Security statement to workers and former workers age 25 and over who are not yet receiving benefits. The statement lists the amount of earnings posted to the person’s Social Security record by year and encourages persons to contact SSA about any missing earnings. Such earnings might have been placed in the ESF because of a name or SSN mismatch. Reinstatements related to Social Security statements are included in the ICOR data discussed above. Earnings reports in the ESF have serious data problems. Such data problems include missing SSNs or names, never issued numbers, and employer use of the same SSN to report earnings for multiple workers in a single tax year. In addition, a small portion of employers account for a disproportionate number of ESF reports, and employers in certain industry categories are more likely than others to submit reports with invalid worker identity information. Out of the 84.6 million reports in the ESF for the 16 tax years that we examined (1985-2000), some of the more serious or obvious problems were that 8.9 million had all zeros in the SSN field and 1.4 million had reported SSNs that were never issued. In addition, over 270,000 of the reports had various name problems. For example, 60,476 had no surname; 261,744 had no first name; 3,760 reports contained nonalphabetic characters in the name field, such as ?, /, %, <, &, *, @, even though SSA has developed automated routines to delete such characters from the name field. For the 16-year period we examined, we also found that some employers used one SSN to report earnings for more than one worker in a given tax year. Table 4 depicts the number of times that employers used one SSN to report earnings of multiple workers in a tax year. For example, one case we found involved 10 W-2s in the ESF under one SSN for tax year 2000 from one employer. Each of the reports under the SSN had different names and different earnings, and together the earnings on the 10 reports totaled about $44,000. Table 4 shows that employers used one SSN in 10 different reports in a single tax year and did this 308 times over the 16- year period of analysis. These employer reports accounted for 3,080 W-2s with $4.7 million in earnings recorded in the ESF. Table 4 also shows that most employers using one SSN to report earnings for multiple workers did this for relatively few reports (from 2 to 9). However, there were a few employers who used one SSN for over 100 reports (128 separate occurrences—see shaded area of table 4). The most egregious case that we identified involved an employer who used one SSN for 2,580 different earnings reports in a tax year. Some employers exhibited a pattern of such errors year after year. Between 1985 and 2000, about 61,000 employers used one SSN for more than one worker in multiple tax years. Table 5 shows that most employers using one SSN to report earnings for multiple workers did this in a period ranging between 1 and 9 years. However, there were slightly over 1,000 employers who used one SSN to report the earnings of more than one worker in 10 or more of the 16 tax years that we analyzed (see shaded area of table 5). We found 43 employers did this every year of the entire 16-year period we analyzed. The majority of employers submitted a relatively small number of the total number of earnings reports in the ESF. For example, table 6 shows that 3.4 million employers had fewer than 10 reports for the period we analyzed. In contrast, while only about 8,900 employers (0.2 percent of all employers with reports recorded in the ESF for tax years 1985-2000) had 1,000 or more reports in the ESF, they accounted for over 30 percent of the total number of ESF reports (see shaded area of table 6). One measure of employer reporting problems is to identify those that, year after year, submit reports that are posted to the ESF. For example, relatively few employers—about 24,000—had a report in each of the 16 years, accounting for a total of 14.6 million reports. Although those 24,000 employers represented only 0.5 percent of all employers, they had submitted about 17 percent of the total number of reports. In addition, we found that employers with a high number of reports in the ESF had a consistent pattern of misidentifying their workers on their annual earnings reports to SSA. For example, one employer averaged about 13,300 reports placed in the ESF per year over the period we analyzed, ranging from a low of 5,971 to a high of 33,448. Finally, certain types of businesses appear to be disproportionately associated with earnings reports in the ESF. We obtained data from SSA that described the types of businesses for 1.8 of the 4.3 million employers with earnings reports in the ESF for the period examined. Figure 2 shows that of the 83 total broad industry categories, 5 of the categories alone accounted for 43 percent of these reports: eating and drinking establishments, construction and special trades, agricultural production- crops, business service organizations, and health service organizations. Our analysis of industry types may not be representative of all 4.3 million employers with reports in the ESF, because information on the industry categories for other 2.5 million employers was not available. However, it is consistent with an analysis reported by SSA’s OIG. In September 1999, the OIG examined earnings reports from 100 employers with the most suspended wage items. OIG reported that 67 percent of these employers were in industries that it categorized as services, restaurants, and agriculture. It also noted that SSA’s experience is that employers who rely on a workforce consisting of relatively unskilled or migrant workers are the major source of suspended earnings reports. SSA successfully reinstates a substantial number of earnings reports associated with frequently used SSNs in the ESF. Overall, the majority of reinstated earnings we examined were posted to the Social Security records of U.S.-born workers. In recent years, however, the number of foreign-born workers receiving reinstatements from these SSNs has significantly grown. Further, our analysis of data indicates that the reinstated earnings for foreign-born workers may often relate to unauthorized employment. To obtain information about reinstatements made to repeatedly used SSNs, we analyzed the 295 SSNs that appeared most frequently in the ESF for tax years 1985-2000. Each of these SSNs had 1,000 or more earnings records posted to them for these 16 tax years. Of the reports associated with these SSNs since 1937, SSA reinstated 13.1 million to the records of about 11.7 million individuals. Overall, the 295 SSNs have about 9.58 million reports for which the actual worker is still unidentified, representing about $14.5 billion in unposted earnings. Of these 9.58 million reports that remain in the ESF, about 8.9 million are under the all-zero SSN (000-00-0000). The average unposted earnings associated with the 9.58 million reports were about $1,513. However, the range was wide. Table 7 shows that almost 25 percent of the reports had unposted earnings of $100 or less, and about 3 percent of the reports had unposted earnings over $10,000. About 84 percent of the reports had earnings of $2,000 or less. Since 1937, SSA has made 13.1 million reinstatements of earnings from the 295 SSNs to 11.7 million different persons. SSA maintains limited data on the characteristics of persons who receive reinstatements. However, the data did allow us to document an individual worker’s gender, birth date, and country of birth, as well as when his or her SSN was issued. Overall, about 59 percent of these recipients were male. About 10.5 million, or 90 percent, of all persons receiving the reinstatements were born in the United States. Males represented about 59 percent of the U.S.-born population also. For those who are still living (10 million), the median age of U.S.-born persons with reinstatements was 49 years old. The remaining 1.2 million persons were born in other countries, with Mexico being the predominant country of birth (about 26 percent of all foreign-born). About 62 percent of the reinstatements to foreign-born workers went to men. The median age of the foreign-born recipients of reinstated earnings who were still living was 53 years old. The data show that U.S.-born workers are the primary recipients of reinstatements associated with the 295 SSNs we analyzed. However, when we examined reinstatement activity in later years, the percentage of foreign-born persons receiving such reinstatements has grown over time. For example, table 8 shows that in 1989 foreign-born recipients more than doubled from about 8 percent before 1986 and in 2003 grew to nearly 21 percent. This percentage is higher than the estimated 14 percent of foreign-born workers currently in the U.S. labor force. Our analysis also shows foreign-born recipients of recent reinstatements from the 295 SSNs we analyzed are predominantly male—about 65 percent. The top four countries of birth for workers who received reinstatements were Mexico, Canada, Germany, and Cuba. Workers from these four countries represented nearly 40 percent of all foreign-born individuals receiving reinstatements from the SSNs we analyzed. Table 9 shows the top 10 countries of birth for the foreign-born persons with reinstatements we analyzed. In addition to the growth in the percentage of foreign-born persons receiving reinstatements, the extent of probable unauthorized work related to such reinstatements has been growing. In order for a person to legally work in the United States, he or she must have a valid SSN. Thus, any earnings reports filed for a tax year before a worker’s valid SSN was actually issued by SSA are potential indicators of unauthorized employment. Data we analyzed show that historically about 7 percent of foreign-born workers with reinstatements from repeatedly used SSNs had earnings prior to SSN issuance. However, when we examined reinstatement activity associated with more recent work years and earnings, the percentage of reinstatements to foreign-born persons with work activity prior to SSN issuance is significantly higher—an average of about 32 percent of such reinstatements occurring between 1986-2003. (See table 10). Further, in some years, these reinstatements for potentially unauthorized work have been in excess of 50 percent of all reinstatements to foreign-born recipients. Current employer requirements for obtaining and reporting worker identity information create an environment in which inaccurate or false names and SSNs can be used for employment purposes, leading to difficulties associating reported earnings with the correct Social Security record. In addition, even though IRS can penalize employers for failing to file complete and correct information on Form W-2 and DHS can examine and penalize problem employers’ hiring practices, enforcement efforts have been limited and may facilitate careless reporting. Finally, although employers have access to several systems to verify worker names, SSNs, and work authorization status, these systems have limitations and are underutilized. Both the IRS and DHS have requirements that employers must follow when gathering or reporting key information supplied by newly hired workers. IRS requires workers to complete an IRS Form W-4, which identifies workers for tax withholding purposes, and DHS requires workers and employers to complete a DHS Form I-9 (Employment Eligibility Verification Form) for identity and work authorization. IRS regulations permit employers to use information on the I-9 to identify workers. However, these requirements are limited and do not provide reasonable assurance that workers’ names, SSNs, or work eligibility status will be accurately obtained and that earnings associated with these workers will be properly credited to valid Social Security records. Under IRS regulations, employers rely primarily upon newly hired workers to self-report information, such as their name and SSN, and are not required to corroborate this information. This process involves new workers filling out Form W-4, which includes the worker’s name, SSN, address, tax filing status (single or married), and number of tax exemptions claimed. While workers must report their names and SSNs to employers, under current IRS regulations, they do not have to present their Social Security card for inspection when they are hired. Also, the law does not require employers to independently corroborate the worker’s name and SSN information with SSA. Workers that do not have an SSN, however, must submit evidence that they have applied for one, such as a letter from SSA. As currently implemented, IRS’s limited requirements provide few safeguards to ensure that employers solicit and report accurate worker information. If examined by IRS, employers must simply show that they requested worker name and SSN information. Employers do not have to show that they attempted to corroborate this information with SSA. Lack of verification reduces the opportunity to detect worker misuse of SSNs and identity information and, ultimately, lead to earnings reports being placed in the ESF and possibly underpaid Social Security benefits. As our analysis shows, millions of reports that SSA receives each year from employers contain incomplete or incorrect information and cannot be posted to valid Social Security records. DHS also requires employers to solicit key information from workers to prevent unauthorized employment. The 1986 Immigration Reform and Control Act (IRCA) requires employers to verify the identity and work eligibility status of individuals hired after November 6, 1986, and prohibits employers from knowingly hiring or continuing to employ persons who are unauthorized to work in the United States. Form I-9 was created to obtain information from new workers so that their employers could verify the workers’ eligibility for employment, so as to preclude the hiring of individuals not authorized to work in the United States. In the section of the Form I-9 that newly hired workers must complete, the form asks new workers to list their name, address, and SSN. (According to DHS, providing the SSN is actually optional for workers). Such workers also must provide employers with specific documents as proof of identity and work authorization. These include state driver’s licenses to establish identity, Social Security cards and birth certificates to establish work authorization, and various types of immigration documents to establish a person’s identity and work status. If a furnished document appears to be genuine and appears to relate to the person presenting it, the employer must accept the document and record what was actually reviewed. Employers must also maintain a Form I-9 on file for 3 years from the date of hire or 1 year from the date of termination, whichever is longer. While the IRCA requirement is more demanding than IRS’s regulations, employers still rely primarily on visually examining numerous types of documents with no independent corroboration with the issuing agencies. Fraudulent identity and work authorization documents are widely available, can be of high quality, and are difficult to detect by employers who are not document experts. In prior work, we testified that DHS employer sanction data indicated that, between October 1996 and May 1998, about 50,000 unauthorized aliens had used 78,000 fraudulent documents to obtain employment. In June 2002, we again testified that hundreds of thousands of unauthorized workers have used fraudulent documents to circumvent processes designed to prevent their hire. Such documents would likely be associated with erroneous earnings reports later filed by employers and recorded in the ESF. Both IRS and DHS have authority to impose penalties on employers who fail to follow their regulations for obtaining and reporting key information for newly hired workers. However, IRS’s requirements are so limited that employers are unlikely to be penalized. While DHS has a worksite enforcement program to address unauthorized employment, its resources devoted to such activities have been minimal in recent years. Thus, those employers who do not want to prepare accurate report information have little incentive to do so and failure to prepare accurate reports can contribute to ESF postings. IRS has authority to assess penalties against employers who submit incomplete and inaccurate information on worker’s W-2s, including SSNs. However, IRS may waive such penalties if reporting problems are due to “reasonable cause.” For example, employers may demonstrate that a reporting error was due to events beyond their control—such as the worker provided false identity or SSN information. Employers must also demonstrate that they acted responsibly to avoid errors and correct them promptly. When employers are notified by IRS that a worker’s reported SSN is incorrect, the employer must make up to two annual solicitations for the correct SSN. If the worker does not comply with the requests, IRS requires no further actions. The reasonable cause standard, however, does not apply if an employer acts with “intentional disregard.” Intentional disregard applies, for example, when an employer knows or should know W-2 reporting requirements but demonstrates a pattern of ignoring them. We recently reported that IRS’s regulations for obtaining and verifying worker names and SSNs are so minimal that it is unlikely IRS would ever penalize employers. IRS’s own analysis bears this point out. In 2003, IRS reported on a review of 78 employers it defined as egregious filers of earnings reports: those who filed either a high number or a high percentage of their reports with incorrect worker names and SSNs. The report that was prepared covered 50 (large and mid-sized businesses) of the 78 businesses IRS reviewed. IRS’s evaluation concluded that all of the employers had met the reasonable cause standard because events beyond their control had caused the errors. That is, the workers had provided employers with incorrect information. IRS also concluded that the employers acted responsibly under current regulations because they solicited names and SSNs from workers and obtained signed W-4s or I-9s. We are concerned, however, that although the employers met IRS’s technical requirements for soliciting names and SSNs in these cases, there was no assurance that the information was accurate because they relied exclusively on worker-supplied information, with no independent corroboration with SSA or any other public or private data source. Thus, workers using fraudulent SSNs as identity information would go undetected. The IRS report detailed specific actions that could improve the accuracy of earnings reports, such as requiring employers to review the Social Security card for prospective new workers and verify the SSN with SSA. In discussing this issue, IRS officials expressed concern that requiring the verification of names and SSNs may cause some employers to cease withholding taxes and reporting income from unauthorized workers, rather than risk losing such workers. Further, increased compliance would likely come at the expense of other compliance activities. The net effect of such a response would be a decrease in tax collections and compliance. IRS also expressed concern that worker verification systems do not always supply timely responses and that mandating such a system could pose an undue administrative burden on employers. Nevertheless, IRS agreed with our August 2004 report recommendation that it analyze options and consider how best to increase the accuracy of employer reporting. Such an effort would include re-examining its reasonable cause standard and penalty process. DHS has primary responsibility for ensuring that employers verify the identity and work authorization status of newly hired workers, as required by IRCA and the Illegal Immigration Reform and Immigrant Responsibility Act (IIRIRA) of 1996. Under IRCA, employers are prohibited from hiring or continuing to employ a person not authorized to work in the United States, provided that the employer knows that the person is not authorized to work or has lost such authorization. Employers are also prohibited from hiring an individual for employment in the United States without verifying his or her employment eligibility via the Form I-9. A violation of either of these prohibited practices can subject an employer to civil monetary penalties. Employers engaging in a pattern or practice of knowingly hiring or continuing to employ unauthorized workers can be subject to fines and imprisonment. However, over time, DHS has devoted limited and decreasing resources to general worksite enforcement. For example, the number of employer investigations and intent to fine notices have dropped substantially (see fig. 3). The number of work years devoted to worksite enforcement has also dramatically declined in the past 5 years, from 278 in 1999 to 105 in 2003, a decrease of 62 percent (see fig. 4). DHS officials noted several reasons for these declines, including a change in its enforcement strategy around 1999 because of limited resources to arrest and detain millions of unauthorized workers. Fining employers also came to be viewed as ineffective by DHS because the process could take more than a year. DHS began to place more emphasis on cooperative efforts such as auditing employer Form I-9s to identify unauthorized workers and conducting seminars on fraudulent documents and worker verification services. DHS also told us that the events of September 11, 2001 caused a substantial redirection of worksite enforcement activity toward unauthorized workers in critical infrastructure facilities, such as airports, power plants, and military bases. DHS coordination with SSA to identify persons who do not have work authorization has been limited, despite a 1996 law requiring such activity. Section 414 of IIRIRA requires SSA to provide DHS with an annual listing of persons who have earnings but do not have SSNs authorizing them to work. For years, SSA has provided DHS with annual data on about 575,000 such persons. The data include annual earnings amounts, worker names and addresses, and employer names and addresses as well. However, DHS reported that it has made little use of this information in its worksite enforcement efforts. In explaining why, DHS officials noted that the data came from SSA in an electronic format that was incompatible with their systems. They also noted that DHS records do not usually contain SSNs for aliens and SSA’s records do not contain the DHS identification number assigned to aliens, so it is difficult to match SSA’s listing to DHS’s records. In order to facilitate the use of the data, in 2004, DHS and SSA agreed on a new format that SSA is to use to report data to DHS. Also, DHS told us that it has recently begun to use a contractor to make the SSA data more usable and available for possible enforcement actions. While Congress developed this IIRIRA provision for reasons other than reducing ESF earnings postings, some additional level of DHS activity in this area might provide a deterrent against individuals who use invalid or false SSNs that contribute to ESF earnings reports. Employers do not widely use worker verification services offered by both SSA and DHS. These services provide a valuable opportunity to prevent many unintended or careless mistakes when hiring new workers and reporting worker earnings. However, they have some limitations in detecting the misuse of another person’s name and SSN, and they remain underutilized. SSA began offering employers the ability to voluntarily verify the accuracy of worker-supplied SSNs and names to help them file more accurate annual earnings reports. SSA does not charge employers for this service, and over the years, it has developed several different verification methods to meet their needs. For example, employers may: Provide SSA with a magnetic tape or a diskette of their workers’ names and SSNs. SSA will verify the names and SSNs for up to 250,000 workers at a time. According to SSA, it takes about 30 days for SSA to respond, after it receives the request. SSA data show that about 6,000 of the 6.5 million U.S. employers sent SSA over 53 million verification requests in 2003. For about 12 percent of the requests, SSA could not verify the worker’s name and SSN. Call a toll-free 800 number to verify names and SSNs. SSA staff will immediately verify information for up to 5 workers at a time. In fiscal year 2003, SSA data show it received about 1.1 million calls from employers, but SSA does not track how many different employers used the service. SSA officials believe that a limited number of employers use the service. In fact, they believe that some larger employers with significant turnover have dedicated staff whose job is to call the 800 number throughout the day to bypass the 5-worker per call verification limit. Thus, these employers would represent a disproportionate number of calls to the service. Provide a hard-copy listing of workers’ names and SSNs that can be faxed, mailed, or hand-delivered to local Social Security offices. SSA staff verify information for a maximum of 50 workers at a time. Response times are subject to office workloads; SSA stated that, generally, such response takes 1 to 2 weeks to process, but may take longer. Our visits to 8 SSA field offices indicated that at these offices very few employers utilize this method of verification. SSA verifies the information received from employers by comparing it with information in its own records. SSA then advises the employer which worker names and SSNs do not match. While the service is an important tool to improve reporting accuracy, the information SSA cross-matches against varies depending upon the mode of verification employers select. For two of the methods (requests through the 800 number or at local offices), employers must provide SSA with a worker’s name, SSN, date of birth, and gender. In contrast, verifications for SSA’s most predominant mode of verification—electronic batch processing, do not include a match against workers’ date of birth and gender. Although employers do not have to submit dates of birth and gender, SSA will match against those two pieces of information if employers voluntarily submit them. By not requiring a match against dates of birth for this verification mode, SSA exposes itself to potential fraud and identity theft. In particular, persons using the name and SSN of persons much younger or older than themselves for employment purposes would remain undetected, despite the verification process. In discussing this limitation, SSA staff responsible for the verification services acknowledged that the requirements should be consistent, especially at a time when identity theft is a growing problem and homeland security is a major concern. However, as of November 2004, there was no initiative under way at SSA to address this inconsistency. SSA’s verification systems have other limitations. As previously noted, the response time varies among the different methods. Slow response times are a negative feature for businesses concerned about the competitive implications of using these systems. For example, some businesses fear that by using the service, they will give nonusing competitors an advantage in obtaining workers in a tight labor market. In an attempt to make verification more attractive to employers, SSA has been testing a Web- based system, which is designed to respond to employer requests within 24 hours. Requests of up to 10 worker names and SSNs will be instantaneous. SSA expects that this verification method will become available in 2005. DHS also operates a pilot program for employment eligibility confirmation in conjunction with SSA. To reduce employment of unauthorized alien workers, Congress required (in IIRIRA of 1996) that DHS develop and test three pilot programs to assist employers in verifying workers’ identity and work eligibility status. Accordingly, the Basic Pilot Program was developed and made available to employers in six states starting in 1997. The Basic Pilot requires participating employers to electronically verify the status of all newly hired workers within 3 days of hire. Verification requests are routed electronically to SSA to check the validity of the SSN, name, and date of birth provided by the worker and whether SSA has information indicating that the worker is a citizen or a noncitizen with permanent work authorization. If the submitted information matches SSA’s records, SSA immediately transmits an employment authorization response via DHS to the employer. If SSA is unable to verify the SSN, name, date of birth, or work eligibility status, a tentative nonconfirmation response is transmitted to the employer. The employer must notify the worker of the tentative nonconfirmation and check the accuracy of the information originally submitted. If the employer finds errors in either the Form I-9 that was completed or the data entered into the Basic Pilot system, the employer should resubmit the verification request with corrected data. If no such errors are found, however, the employer must advise the worker to visit an SSA field office within 8 federal workdays from the date of the response to resolve any discrepancies in his or her SSA record. If SSA is able to verify the SSN, name, and date of birth of a newly hired noncitizen, but is unable to verify the work eligibility status, it electronically refers the query to DHS, for a check against DHS’s automated records. If DHS confirms that the person is work authorized, the employer is immediately notified. If DHS cannot verify work authorization status for the submitted name and SSN, the query is referred to DHS field office “status verifiers” for additional research. According to DHS, responses for queries referred to the status verifiers generally occur within 24 hours. When the record searches cannot verify work authorization, DHS sends a tentative nonconfirmation response to the employer. If workers wish to contest such a response from DHS, they must call a toll-free telephone number provided by DHS within 8 federal workdays from the date of the response to resolve any discrepancies in their DHS record. If employment authorization cannot be verified, employers may terminate employment. A 2002 study of the Basic Pilot found that work authorization for queried workers was never resolved in about 13 percent of queried cases. In most of these cases, the workers never contested the tentative nonconfirmation response. However, like SSA’s verification service, the Basic Pilot has not been widely utilized. As of June 2004, about 2,500 of 2.1 million eligible businesses operating in the pilot states have actually registered to participate. Those participants made about 365,000 initial verification requests over a 2-year test period. The study also identified some problems with the pilot, such as erroneous nonconfirmation rates and program software that was not user friendly. In July 2004, DHS reported on actions being taken to address these weaknesses. These actions included improving federal data base accuracy to expedite data entry on persons entering the country as well as updating changes in immigrant work authorization status, switching to a Web-based verification system, providing better training for employers, and monitoring participating businesses. In 2003, Congress required DHS to expand the verification service to all 50 states by December 2004. The Basic Pilot Program became available to employers in all 50 states on December 20, 2004. Furthermore, to improve its effectiveness and increase participation, DHS recently converted the program to a Web-based system, which became available on July 6, 2004. While DHS staff recognize its potential value in identifying unauthorized workers, they noted that by law, employers cannot be charged for this service and that the agency lacks sufficient funds to operate a system that would be used extensively. DHS officials did not have operational cost data for the verification service. However, in June 2002, contractors that studied the program for DHS estimated that federal costs to make verification of work eligibility and identity mandatory would be about $159 million annually. Despite the various tools used by SSA to aid in the proper crediting of worker earnings, the number of earnings reports in the ESF is substantial. Having effective policies and processes for verifying key SSN, identity, and work authorization information for the nation’s workforce is critical to SSA, which is tasked with accurately paying retirement, survivors, and disability benefits. Sound verification processes are also critical to the administration of tax and immigration laws. However, at present, employers have few requirements to accurately identify their workers and file accurate and complete earnings reports. In fact, millions of earnings reports are submitted each year with erroneous or missing SSN and name information, and the same employers often file substantial numbers of such reports year after year, creating administrative problems for SSA and IRS and the possibility that Social Security benefits to such workers will not be accurately calculated. Under current IRS reporting requirements, employers who chronically and willfully file inaccurate earnings information will likely never be deemed noncompliant or penalized. We acknowledge IRS’s concern that more stringent employer reporting and verification requirements could have tax compliance implications and pose additional administrative burdens on the many employers who are already attempting to fulfill their reporting obligations. Although IRS’s regulations meet statutory requirements, we are concerned that its current requirements are so minimal that even the employers with a long standing history of chronically filing reports with critical errors are never sanctioned. In accordance with our prior recommendation, IRS is currently examining options for strengthening employer requirements for soliciting and verifying worker names and SSNs and developing a formal penalty program. As this effort progresses, SSA’s ESF data could be valuable to IRS in developing criteria as to what employer reporting patterns and activities constitute “intentional disregard” and improve IRS’s ability to target and penalize problem employers. At present, it is also unlikely that DHS will take enforcement action against employers and workers who submit inaccurate information to SSA to conceal unauthorized work activity. We recognize that in the post- September 11 environment, DHS enforcement resources have been needed in critical infrastructure industries and that data-sharing initiatives with SSA have thus received less priority in recent years. However, it is important that some level of coordination be reestablished to best leverage SSA’s data on potential unauthorized work activity and DHS staff resources to target the most egregious employers. Finally, any effort to verify worker-supplied identification and work authorization information warrants a thorough and accurate process. SSA currently offers several options for employers who choose to verify worker-provided information and has continually sought to upgrade its services. However, for the predominant mode of verification—electronic batch file—employers are not required to submit employee dates of birth for verification against SSA’s records. Thus, persons using the names and SSNs of persons much older or younger than themselves to seek employment would not be detected under current processes. This represents a critical flaw in SSA’s service. DHS’s Basic Pilot Program offers another option for addressing an important element affecting ESF postings—individuals who are not authorized to work in the United States. However, DHS officials believe they will likely experience capacity problems in the future if significantly more employers begin using the service, in part because of the number of cases requiring manual intervention to verify employment status. Accordingly, it is crucial that any deliberations pertaining to strengthening employer verification requirements include an informed discussion among the affected federal agencies as to the systems requirements and safeguards necessary to ensure the integrity, timeliness, and efficiency of the verification service. To better ensure that workers are accurately identified on Form W-2s necessary for the efficient administration of Social Security and tax laws, we recommend that the Commissioner of the Internal Revenue Service Coordinate its ongoing effort to reassess employer requirements for soliciting and verifying worker names and SSNs with SSA. This could include utilizing SSA’s ESF data to identify employer reporting patterns and activities that could constitute intentional disregard and using such data to develop criteria to better target and penalize only those employers who chronically submit inaccurate earnings reports or requiring such employers to verify worker identity information with SSA. Ensure the development of any new reasonable cause requirements occurs in consultation with SSA and DHS, which operate employee verification services. Such consultation could facilitate systems improvements to ensure the integrity, timeliness, and efficiency of existing verification services. We recommend that the Commissioner of the Social Security Administration require employers seeking verifications, via SSA’s electronic batch process, to submit the workers’ dates of birth, for matching against SSA’s records. We recommend that the Secretary of the Department of Homeland Security take steps to determine how DHS can best use SSA-supplied data on potential illegal work activity and specific industries associated most frequently with such activity to support its worksite enforcement efforts. We obtained written comments on a draft of this report from the Commissioners of SSA and IRS and the Department of Homeland Security. The comments have been reproduced in appendixes II, III and IV. Each agency also provided additional technical comments, which have been incorporated in the report as appropriate. SSA noted that it is continuing to assist the employer community in verifying worker information and welcomed the opportunity to work with IRS and DHS to improve verification operations. The agency also reiterated its commitment to continued outreach to employers and other federal agencies, as well as to facilitate accurate reporting via its Employer 800 number service and Employer Service Liaison Officers (ESLOs) located in each region. SSA agreed to investigate further our recommendation that it should require employers who use the electronic batch process to submit workers’ dates of birth for matching against its records. However, SSA noted that such a requirement could create additional burdens for the employer community and workload increases for SSA staff responsible for investigating mismatches. We acknowledge SSA’s concerns in this area. However, given the volume of verification requests processed through SSA’s batch process each year, and the potential vulnerabilities associated with not matching against workers’ dates of birth, we continue to believe prompt action is needed. Addressing our recommendation would also make SSA’s batch verification process consistent with the agency’s other modes of verification, whereby workers’ dates of birth are a required element for matching against SSA’s records. In its comments, IRS acknowledged that employers’ submission of earnings reports with inaccurate SSNs increases the quantity of suspense file postings, although it expressed the view that these mismatches stem from inaccurate or incomplete information provided by workers. The agency also noted that it is currently conducting compliance checks in coordination with SSA on those employers with the most egregious cases of reporting incomplete or inaccurate worker SSNs to SSA. Accordingly, IRS agreed with our recommendation that it work closely with SSA in its ongoing efforts to reassess current employer requirements for soliciting and verifying worker names and SSNs. IRS also concurred with our recommendation that the agency ensure that the development of any new reasonable cause requirements occurs in consultation with SSA and DHS, which operate worker verification services. DHS noted that while its general worksite enforcement program has had decreasing resources recently, since September 11 DHS has refocused its enforcement activities on removing unauthorized workers employed in critical infrastructure facilities. Such enforcement activities have resulted in removing over 5,000 unauthorized workers who were employed in industry categories that have been the historical targets of traditional worksite enforcement operations—food service, janitorial, agriculture, and construction, among others, but employed in critical infrastructure facilities. Therefore, DHS contends that although there is a decrease in the number of criminal cases and civil fines, there is still a significant effort under way to remove unauthorized workers. DHS also explained that although it will take the necessary steps to determine the best use of the annual SSA-provided listing of persons with earnings who lack work authorization, there are various impediments to accomplishing this task. Regarding DHS’s comments, we have summarized both the reasons for DHS’s switch in enforcement priorities and the impediments to using the SSA-provided listing. We acknowledge DHS’s current efforts to determine how it can best use the listing and we support cost effective ways by which the listing might identify illegal work activity and specific industries associated most frequently with such activity, to further worksite enforcement efforts. As agreed with your offices, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days after its issue date. At that time, we will send copies of this report to the Commissioner of the Social Security Administration, the Commissioner of the Internal Revenue Service, and the Secretary of the Department of Homeland Security, the Director of the Office of Management and Budget, appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on GAO's Web site at http://www.gao.gov/. If you have any questions concerning this report, please contact me at (202) 512-7215 or Dan Bertoni at (202) 512-5988. Other major contributors are listed in appendix V. To obtain information describing the various electronic processes that the Social Security Administration (SSA) uses to post earnings reports to worker records and resolve errors in reported worker names and Social Security Numbers (SSN), we reviewed numerous SSA Office of the Inspector General, GAO, and contractor reports on the Earnings Suspense File (ESF). We met with SSA officials who manage the earnings posting process and examined SSA’s Program Operations Manual System to identify and document processes and procedures for posting earnings to and reinstating earnings from the ESF. We reviewed information from SSA that described the various validation routines it uses in attempting to find valid matches of names and SSNs for earnings reports that do not initially match its records. We obtained management data on the number of earnings reports that these routines either posted to its records or reinstated from the ESF. We also visited eight SSA field offices located in New York, New Jersey, Virginia, and California that processed significant numbers of earnings reinstatements in 2003 to discuss their reinstatement activities and document procedures for reviewing and validating evidence submitted by individuals seeking to have earnings reinstated from the ESF. To determine the characteristics of earnings posted in the ESF, we obtained and analyzed an electronic copy of the ESF for tax years 1985 to 2000. We selected these years because they covered (1) a substantial period of time and (2) postings to and reinstatements from the ESF that occurred after legislation enacted in 1986 granted amnesty to unauthorized immigrants. Further, during this period, SSA also enhanced its earnings records in a way that provided more detailed information about reinstated earnings. The earnings records that we examined covered only reports on current wages, including reports that were filed late. The ESF contained 84.6 million records that met our criteria at the time we obtained the file in January 2003; these records were submitted by a total of 4.3 million different employers. The file we obtained contained information reporting employer’s identification number, the reported worker’s name and SSN on the invalid earnings report, the amount of unposted earnings, and the tax year of the report. From SSA, we were able to obtain Standard Industrial Classification codes for 1.8 million of the employers who had earnings in the ESF to identify the types of employers who had filed the earnings reports that we analyzed. (Because of confidentiality requirements, we were unable to arrange for timely access to similar codes for about 2.5 million employers in the file from the Census Bureau, which controls this information). To analyze the reinstatement of earnings reported under repeatedly used SSNs, we first examined the ESF to identify the frequency that each SSN appeared for tax years 1985 to 2000. On the basis of our examination, we selected SSNs that appeared most frequently in the ESF for our reinstatement analysis. Specifically, we selected 295 SSNs that had 1,000 or more reports in the ESF for the tax years analyzed. Overall, the 295 SSNs had about 9.6 million earnings reports representing about $14.5 billion in unposted earnings still in the ESF at the time that we received a copy of the file. We then obtained a complete copy of SSA’s earnings reinstatement file that contained over 142 million records across all SSNs that had received reinstatements to identify the reinstatements made from these 295 reported SSNs. By comparing the 295 SSNs with data in the reinstatement file, we identified that over the years SSA had reinstated about 13.1 million earnings reports from these 295 SSNs to 11.7 million individuals. For the 11.7 million individuals, we obtained selected information from SSA’s Numident, Master Earnings File, and Master Beneficiary Records. This information allowed us to identify the valid Social Security record that received each reinstated earnings report and obtain demographic information about each valid record holder receiving the reinstatement, such as age, gender, date when the person’s SSN was issued, and place of birth. To identify factors that contribute to ESF postings, we examined provisions of law that authorize (1) penalties for employers who file earnings reports with inaccurate SSNs and hire workers who are not authorized to work in the United States and (2) the disclosure of information on persons with nonwork SSNs to the Department of Homeland Security (DHS). We met with Internal Revenue Service (IRS) and DHS officials and obtained available enforcement data on the use of these penalties. We did not, however, evaluate their specific enforcement efforts. We analyzed information about worker verification tools that SSA offers to assist employers to report their workers’ earnings and DHS offers to identify their workers’ eligibility status under immigration laws. We also reviewed a detailed contractor study covering DHS’s implementation of the Basic Pilot Program. To assess the reliability of databases used, we reviewed reports provided by SSA and its Office of the Inspector General, which contained recent assessments of these databases. We also interviewed knowledgeable agency officials to further document the reliability of these databases. In addition, we checked the data for internal logic, consistency, and reasonableness. We determined that all the databases were sufficiently reliable for purposes of our review. Our work was conducted between October 2002 and December 2004 in accordance with generally accepted government auditing standards. In addition to those named above, the following team members made key contributions to this report throughout all aspects of its development: William Staab and Paul Wright. In addition, Jean Cook, Gerard Grant, Luann Moy, Daniel Schwimer, Vanessa Taylor, and Wayne Turowski made contributions to this report.

Summary: Each year, the Social Security Administration (SSA) receives millions of employer-submitted earnings reports (Form W-2s) that it is unable to place in an individual Social Security record. If the Social Security number (SSN) and name on a W-2 do not match SSA's records, the W-2 is retained in the Earnings Suspense File (ESF). SSA's ability to match earnings reports is essential to calculating Social Security benefits. Because of concerns about the size of the ESF, GAO was asked to determine (1) how SSA processes workers' earnings reports, (2) the types of errors in ESF reports and the characteristics of employers whose reports are in the ESF, (3) how often earnings from repeatedly used SSNs have been reinstated and who receives the earnings from theses reports, and (4) what key factors contribute to ESF postings. Upon receiving over 250 million earnings reports annually from employers, SSA uses various processes to post such reports to workers' Social Security records. For reports in which worker names and SSNs exactly match SSA's information, the earnings are credited to the appropriate Social Security record. When SSA encounters earnings reports that do not match its records, SSA attempts to make a match through various automated processes. Such processes have allowed SSA to identify valid records for an average of 15 million reports annually. However, about 4 percent of the reports still remain unmatched and are retained in the ESF. SSA uses additional automated and manual processes to continue to identify valid records. The most recent data show that SSA posted ("reinstated") over 2 million earnings reports in the ESF to valid records from such processes. Earnings reports in the ESF have serious data problems and are particularly likely to be submitted by certain categories of employers. Such problems include missing SSNs and employer use of the same SSN for more than one worker in the same tax year. Additional problems include missing surnames or names that include nonalphabetic characters. Forty-three percent of employers associated with earnings reports in the ESF are from only 5 of the 83 broad industry categories. Among these industry categories, a small portion of employers account for a disproportionate number of ESF reports. SSA has reinstated a substantial number of earnings reports with SSNs that appear repeatedly in the ESF. We analyzed the most frequently occurring 295 SSNs, which appeared in ESF 1,000 times or more between tax years 1985 and 2000. Of the earnings reports associated with these SSNs, SSA reinstated 13.1 million to the records of about 11.7 million workers. Although most reinstatements were for U.S.-born workers, in recent years the percentage of reinstatements to foreign-born workers has markedly increased. Also increasing is the percentage of foreign-born workers that received reinstatements for earnings in years prior to receiving a valid SSN--a potential indicator of unauthorized employment. Three major factors contribute to ESF postings. Under IRS regulations, employers must ask new hires to provide their name and SSN, but are not required to independently corroborate this information with SSA. DHS requires employers to visually inspect new workers' identity and work authorization documents, but employers do not have to verify these documents, and they can be easily counterfeited. Further, IRS regulations are minimal; IRS has no record of assessing a penalty for filing inaccurate earnings reports; and DHS enforcement efforts against employers who knowingly hire unauthorized workers has been limited in recent years because of shifting priorities following the events of September 11, 2001. Last, although SSA and DHS offer employers verification free of charge, these services are voluntary, have some limitations, and remain underutilized.