Nine Easy Numbers Away From ID Theft

Carnegie Mellon professor Alessandro Acquisti and graduate student Ralph Gross discovered that Social Security numbers are easily predicted using public data. Below, Acquisti tells how.

Please describe your findings.

We found that Social Security numbers, which are supposed to be confidential, are predictable from publicly available data. We can start with someone's birthday, add the state where they were born and, based on these two pieces of information, infer their Social Security number.

Subscribe to Kiplinger’s Personal Finance

Be a smarter, better informed investor.

Save up to 74%

Sign up for Kiplinger’s Free E-Newsletters

Profit and prosper with the best of expert advice on investing, taxes, retirement, personal finance and more - straight to your e-mail.

Profit and prosper with the best of expert advice - straight to your e-mail.

Sign up

How?

The assignment scheme for Social Security numbers has been publicly available for many years. Take that scheme, combine data from other sources, apply statistics and data-mining tools, and you can end up with information that is significantly more sensitive than what you started with.

Who is most at risk?

It's easiest to predict the Social Security numbers of people from less-populous states and those born after 1988, when a number of policy initiatives made it more likely that parents would apply for a newborn's Social Security number right away. On average, we can identify the entire nine-digit number in fewer than 1,000 attempts for 9% of people born after 1988. That makes those numbers no more secure than a three-digit PIN.

How do you go from there to identity theft?

To make the algorithm work, you need only information that's public or semi-public for most of us. An attacker has to find a way to exploit the information, and unfortunately, there are many ways. For example, attackers can use botnets -- networks of compromised computers controlled by someone, somewhere. Botnets can be used to run automated queries on an online system, such as an online credit-card application, to verify a Social Security number.

How can we prevent such exploitation?

We need to stop using Social Security numbers as both identifiers and authenticators. The numbers were created to identify earnings in the Social Security program. Your phone number is another example of an identifier. But the password for your voicemail is an authenticator, a secret fact that proves you are who you claim to be. No sane person would use the same digits as identifier and authenticator, but that's exactly the way we use Social Security numbers.