Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices. ×
The Internet Government Idle

Same Birthday, Same Social Security Number, Same Mess For Two Florida Women (cio.com) 214

itwbennett writes: After 25 years, the Social Security Administration (SSA) has fessed up to giving two Florida women who shared a name and a birthday the same social security number. The women only recently discovered that they shared an SSN, but not before having trouble getting loans and having tax returns rejected. You might think that the SSA would catch something like this, but as it turns out, they are prohibited from trying to verify the legitimate owner of an SSN, except in rare cases, says Ken Meiser, VP of identity solutions at ID Analytics, provider of credit and fraud risk solutions. And the problem isn't as rare as you might think (except for the part about two women with the same name born on the same day in the same state). According to a 2010 study by ID Analytics, some 40 million SSNs are associated with multiple people.
This discussion has been archived. No new comments can be posted.

Same Birthday, Same Social Security Number, Same Mess For Two Florida Women

Comments Filter:
  • by turkeydance ( 1266624 ) on Thursday November 12, 2015 @11:02PM (#50919253)
    8675
  • by XXongo ( 3986865 ) on Thursday November 12, 2015 @11:05PM (#50919263) Homepage
    I would assume that it is not a coincidence that two women with the same name and same birthdate got the same social security number; I expect that when the second application came in, they checked the name and birdhday and assumed that it was a duplication of the first application, and just send out "here is your number".
    • Re: (Score:2, Interesting)

      Maybe. Or maybe these duplicate SSN's are so common and it just happened that this one had the same legal name for both parties as well.

      • by aaarrrgggh ( 9205 ) on Friday November 13, 2015 @12:20AM (#50919503)

        Born in same area, same date, same first three letters of last name-- expect collisions. That is how the formula works for allocation, and I am sure real-time checking wasn't done due to "low probability."

        • by pla ( 258480 ) on Friday November 13, 2015 @09:53AM (#50921193) Journal
          Born in same area, same date, same first three letters of last name-- expect collisions.

          Your SSN doesn't "hash" anything. From 1972 through 2011 (the range applicable to these two women), only the the first three numbers (the area number) actually meant anything in isolation. The middle pair of numbers (the group number) only has meaning within a given area, and even then it just serves to more-or-less evenly subdivide the area. And the final four numbers (the serial number) monotonically increases from 0001 through 9999.

          So rather than a collision, you could more accurately call this a race condition. Two requests go in at approximately the same time without adequate semaphores, and the serial number didn't get incremented early enough in the process to avoid both processes getting the same "next" number available.

          The geek in me would love to know if no one ever received the next number in sequence - Did they double-increment after issuing the number, or did one of them overwrite the other?
      • by ShanghaiBill ( 739463 ) on Friday November 13, 2015 @12:36AM (#50919555)

        For many years, I would just make up a random SSN for forms that didn't seem like they had a legitimate reason to be asking for it. Never, not once, did they later tell me there was a mismatch. So I think there was very little cross-checking going on.

        • by nwf ( 25607 )

          I'd just leave them blank. Blockbuster used to ask for that, and I left it blank. Oddly, I had a card from a store well after it went out of business ages ago and they still accepted it at other ones. I hadn't been at that address for 15 years, but that's a different story.

        • Normally they would use it to check your credit or as a way to verify you identity.

    • Probably. Especially if they both applied at the same time. If some bureaucrat got two requests in the same day, he probably just assumed the 2nd was someone being impatient, and just sent the same information.

      The real question is, will the US government compensate them for their large legal bills caused by the the government screw up.

    • by Jason Levine ( 196982 ) on Thursday November 12, 2015 @11:45PM (#50919385)

      The article definitely makes it sound like it was a mix up due to the two babies having similar names (Joanna Rivera vs. Joannie Rivera), having the same birthday, and being in the same general area.

      After 25 years of confusion, the Social Security Administration reportedly has admitted its mistake at last: In 1990, two Florida hospitals created the same record for two babies with similar first names, the same last name and the same date of birth, and the administration gave them both the same Social Security number.

      The article lists some red flags that should have been raised (two addresses listed as being active, the IRS getting W2 forms from two employers that weren't even near each other, etc). In my experience, though, companies and government agencies don't mind missing red flags. Red flags mean that someone has to put in extra effort to resolve the issue. Ignoring the red flag, though, means that you continue doing what you're doing and it becomes someone else's problem.

      • by dgatwood ( 11270 )

        Ignoring the red flag, though, means that you continue doing what you're doing and it becomes someone else's problem.

        Funny, sad, and true, all at the same time.

        The thing is, the IRS has plenty of incentives to ignore those sorts of problems. After all, a lot of illegal immigrants who pay taxes do so using a fake SSN. So they end up getting forms with two different names, two different employers, two different addresses in different areas, etc., and if they went to investigate, they would just lose revenue

      • by Solandri ( 704621 ) on Friday November 13, 2015 @03:26AM (#50920067)

        The article lists some red flags that should have been raised (two addresses listed as being active, the IRS getting W2 forms from two employers that weren't even near each other, etc). In my experience, though, companies and government agencies don't mind missing red flags. Red flags mean that someone has to put in extra effort to resolve the issue. Ignoring the red flag, though, means that you continue doing what you're doing and it becomes someone else's problem.

        There's a more sinister reason behind it. A huge chunk of W2s under duplicate SSNs are due to illegal immigrants using a fake SSN to work. You can't just make up any number - the IRS will reject that. So (presumably) they or someone they hire gets a real person's SSN, and the illegal immigrant adopts that person's name, identity, and SSN. "Fixing" this problem means creating a sure-fire way to prevent illegal immigrants from working in the country, so nothing is done about it. One party doesn't want to fix it because they want to make these people citizens so they'll vote for that party. An influential fraction of the other party doesn't want to fix it because they want these people to remain as a source of cheap labor.

        I used to do the accounting at a company which I'm pretty sure had a not-insignificant number of illegal immigrants. Employers are only allowed to ask potential employees for certain pieces of ID [uscis.gov], and the most common one is the Social Security Card. The government has no system by which an employer can verify a SSN matches other info the applicant provides, so all you can do is look at it and see if it seems real (it's super-easy to fake), make a photocopy of it, and keep it in the employee's file. If INS ever comes knocking, that's your proof that you've done your due diligence. Anyway, about a month or two after I completed everyone's W2s, I got a stack of letters from the IRS about "irregularities" with the W2s. Some careful reading between the lines and some web research turned up that these letters are commonly generated when two W2s are issued for the same person whose name and SSN match but other details (like address) differ. As an employer, you just sign saying that the employee swears that that's their real SSN, mail it back, and it becomes the government's problem. I'd like to do more as an employer, but my job is running a company, not immigration enforcement. The government doesn't even provide me with tools to verify it anyway. And the potential liability for incorrectly ratting someone out as illegal is huge.

        • by swillden ( 191260 ) <shawn-ds@willden.org> on Friday November 13, 2015 @06:29AM (#50920475) Homepage Journal

          "Fixing" this problem means creating a sure-fire way to prevent illegal immigrants from working in the country, so nothing is done about it. One party doesn't want to fix it because they want to make these people citizens so they'll vote for that party. An influential fraction of the other party doesn't want to fix it because they want these people to remain as a source of cheap labor.

          Semi-OT, but I just want to throw out my favorite low-cost, low-effort fix for getting nearly all illegal immigrants out of the country.There are two steps:

          1. Make it a criminal offense to hire a worker not vetted as legally able to work by the E-Verify system, and beef up the E-Verify system so it validates with roughly the same level of assurance as the US Passport issuance system. By "criminal offense" I mean "non-trivial mandatory jail time for the most senior company officer who approved/ordered the hire".

          2. Offer permanent resident alien status (green card) to any undocumented worker who turns in his employer. The alien gets the green card whether or not E-Verify supports his right to work, to reduce the risk to the alien of coming forward. Phase this step in a year or two after the first, but make sure everyone knows it's coming.

          I doubt the program would actually give out many green cards for shady employers. It would probably give a few out for bugs in the E-Verify system.

          However, you're right that this won't happen because neither party really wants illegal immigration ended. My specific plan would also generate lots of objections among conservatives aghast at the idea of giving green cards to some "undeserving" people, even though the numbers would be small and the approach would be dramatically cheaper (theoretically appealing to conservatives) than other alternatives.

        • by LWATCDR ( 28044 )

          You left out the third reason.
          We bet to collect taxes and SS from those workers. They can never collect the ss because they are illegals and that helps keep ss afloat.
          And both sides want the cheap labor and use then for an advantage.

        • by jdavidb ( 449077 )

          "Fixing" this problem means creating a sure-fire way to prevent illegal immigrants from working in the country, so nothing is done about it. One party doesn't want to fix it because they want to make these people citizens so they'll vote for that party. An influential fraction of the other party doesn't want to fix it because they want these people to remain as a source of cheap labor.

          Hmm. Is it okay if I don't want there to be a sure fire way to prevent illegal immigrants from working in the country, but still want the problem to be fixed somehow?

      • If they checked for duplicates, it would prevent illegal immigrants from re-using a stolen number in order to work in the USA. Checking for duplicate use seems like an easy way to prevent illegal immigration, certainly cheaper than a three thousand mile fence. I suspect that government has taken steps to prevent such checking, in order to lower the cost of doing business (for corporations) in the USA.
        • by clintp ( 5169 )

          I work in software for a payroll processor and the "duplicate" SSN problem comes up all the time.

          First off, we're not the employer and really don't care who you hire -- that's your problem. I think your contract with us requires that you perform verification of your employees, but we don't handle it. Give us an SSN, and we'll put it in the system.

          Secondly, we *legitimately* see duplicate SSN's all the time in our database. Most common? Someone holds two jobs at once and we do payroll for both employers,

    • It's more likely that the algorithm used to generate SSNs, given the same input data, generates the same output. After all, it's estimated that there are 40,000,000 dupes out there.
      • by ShanghaiBill ( 739463 ) on Friday November 13, 2015 @12:40AM (#50919573)

        It's more likely that the algorithm used to generate SSNs, given the same input data, generates the same output.

        The "algorithm" is "pull the next number off the list". My sister and I were born in different states, two years apart ... and we have different first names. My parents requested SSNs for both of us at the same time, and they were given two consecutive numbers.

        • Not from the US, but I worked there for a while. It was a long time ago but I'm pretty sure I went to the office, showed my visa and the lady pulled a stack of cards out of her desk. She took the one off the top, put the details in the computer, handed it to me. Ten minutes from finding the place to "have a nice day".

        • by Cerlyn ( 202990 )

          The algorithm *was* pull the last number off of the list.

          As of June 25, 2011, that is not the case anymore [ssa.gov].

          That said, this does not help any of us that are less than 4 years old.

        • Ditto here. In fact, my two brothers and two sisters all share with me SSNs that are a total of 8 digits apart. Only the last digits are different.

          In the 70s two banks helpfully changed my SSN, believing it was an error, merging my checking account with hers. Great fun undoing that. I never did business with either bank again, and until I moved out West we checked before changing banks.

          Duplicate and assumed SSNs should be resolved, but won't be for reasons already expressed. But then we need to secure our

        • It's more likely that the algorithm used to generate SSNs, given the same input data, generates the same output.

          The "algorithm" is "pull the next number off the list". My sister and I were born in different states, two years apart ... and we have different first names. My parents requested SSNs for both of us at the same time, and they were given two consecutive numbers.

          By consecutive I assume that you mean that you have something like 11 and she has 13 or whatever. The SSA has never given out consecutive numbers. They give out odds and then evens and this has always been the case. See Wikipedia [wikipedia.org]. We have a string of consecutive even numbers in my family - four in a row, in fact.

          • By consecutive I assume that you mean that you have something like 11 and she has 13 or whatever.

            No. My sister's SSN and my SSN are exactly the same except for the last digit. Mine ends in 7, hers ends in 8.

            The SSA has never given out consecutive numbers.

            I am a counter-example, so you are wrong. Never say never.

      • by unrtst ( 777550 )

        After all, it's estimated that there are 40,000,000 dupes out there.

        This is a misconstrued / misused statistic.
        The linked page at idanalytics.com says:

        More than 20 million Americans have multiple Social Security numbers (SSNs) associated with their name in commercial records according to a new study announced today from ID Analytics, Inc., a leader in consumer risk management. The study also found that rather than serving as a unique identifier, more than 40 million SSNs are associated with multiple people.

        [bolded by me]
        That is also poorly worded. What association are they referring to? I'm VERY confident they do NOT mean the official SSN database. FWIW, one can verify SSN's using the social security system's SSNVS (social security number verification service): https://www.socialsecurity.gov... [socialsecurity.gov]
        I suspect they mean that SSN's that show up in external databases, such as employment records, fraud reports, credit checks and reports,

      • by Gryle ( 933382 )
        Not necessarily. A rental agency ran a credit check on me a few years back. State law required they give me the results. Turns out I share a social security number with a dead guy from Alabama and a woman twice my age from eastern Texas. The names and birthdates of the other two folks were nowhere close to mine.
    • There was a case where 2 people had the same name dob and state of birth, and they had lived in the same address at different times. That really gummed up the probabilistic matching algorithm

  • by daninaustin ( 985354 ) on Thursday November 12, 2015 @11:09PM (#50919275)
    Most of the duplicates are due to fraud by illegals.
    • by nwf ( 25607 )

      No, they all use 123-45-6789.

      • by DaHat ( 247651 )

        Depends on how good their forger is... A couple decades ago I had someone show up with a social security card in the form 1234-56-789. Somehow they got the groupings out of order and were reminded that they needed a 'real' card.

      • by kbg ( 241421 )

        That's amazing. I've got the same combination on my luggage.

      • That's the one you're supposed to use to get free ACA healthcare.

    • Re: (Score:2, Troll)

      by AK Marc ( 707885 )
      How do the illegals dupe the government into giving out the same SSN to multiple people?
  • by randalware ( 720317 ) on Thursday November 12, 2015 @11:12PM (#50919285) Journal

    The SSA is prohibited from checking out errors with the SS numbers ?
    Who better equiped to straighten out identity theft verifications ?
    There is no National ID system and I don't think we want one.
    Does this mean I don't have to verify my income with the IRS because the government doesn't know who I am ?
    I recieved this SSN in error !
    prove me wrong !

    • Sorry, the S.S.N. is a national id. It is used to identify you in any important document, in particular your tax return and passport. And even if it isn't directly asked for, your bank has it, as well as your credit card companies and anybody who buys your credit report.

      • It shouldn't be allowed for any organization to use a SSN as a secret code. I.e. nobody should have to keep their SSN secret. If I chose to put it on my mailbox, no credit agency should be able to penalize me. It should be of no value to an identity thief.

        The way to accomplish this would be for the govt. to publish Name/Hometown/SSN for everybody.

        It was never meant to be a secret, or a tool for bankers to sort us.

    • Re: (Score:3, Insightful)

      by smhsmh ( 1139709 )

      The US social security number as an id is seriously broken. After consideration, I'd epect my ssn to be in at least 100 poorly-secured databases: bank accounts, insurance accounts, doctor/dentist/hospital facilities, employers, etc. The number is hardly secret, yet there are about 350M persons in the USA and only 1000M distinct ssns.

      A better system would redefine a ssn as two components. A 9 (or 10?) digit public number would signify who you are -- lotsa entities need to know that -- and a 6-7 digit se

      • by raymorris ( 2726007 ) on Friday November 13, 2015 @12:50AM (#50919617) Journal

        > The US social security number as an id is seriously broken. After consideration, I'd epect my ssn to be in at least 100 poorly-secured databases: bank accounts, insurance accounts, doctor/dentist/hospital facilities, employers, etc. The number is hardly secret

        More specifically, it's fine as an IDENTIFIER, and ID must necessarily be different from AUTHENTICATION. My name identifies me (approximately), my password authenticates me.

        To be useful, a personal ID must be more or less public - the name "Barak Obama" is useful only because everyone knows who that is, it's public. Also, in order to be useful, authentication information must be private. So as you said, two pieces of information - one that is the ID, the other is the authentication.

        This seems obvious, but people who should know better routinely treat user names as "a little bit secret". This is wrong. It's either secret, in which case it's hashed so nobody can read it, and it can be trusted to be secret, or it's it's not. Since a user name is not protected as a secret, don't start thinking that maybe it's a little bit secret, kinda maybe, and start putting any trust in people not knowing it. User names aren't hashed, they are sometimes displayed, so they aren't secret. Not even a little bit (especially not a little bit).

         

        • by dgatwood ( 11270 )

          User names aren't hashed, they are sometimes displayed, so they aren't secret.

          That's not strictly true. It depends a lot on the nature of the site. On a banking site, for example, the username could theoretically be an account number. At the very least, the account number is likely to be your initial username when you first sign in to create an online account associated with a brick-and-mortar bank. In that case, the username actually would be secret, and wouldn't be displayed anywhere publicly (and wou

          • > if the forum makes a distinction between the screen name (the visible name) and the actual login name, then the login name (often an email address) can be seen as at least somewhat secret.

            That's precisely what causes the problem. In some well-known forum scripts, the user name (for logging in) isn't different from the visible "screen name". So it appears to be kinda secret. HOWEVER, a less-used feature of the forum uses the username as the identifier in links, something like profile.php?user=dgatwood

  • So, slashdot tells me americans HATE the idea of a centralized, unique ID number. Yet, they have a de-facto standard "unique" ID number, the SSN.

    Can somebody explain?

    • by Hadlock ( 143607 )

      Right, either SSN or Federal Taxpayer ID #

      There's also the federally issued passport, which also has it's own number. I've never really understood why the passport isn't just the de-facto personal ID, it's a global standard ID system recognized by all countries (as far as I know).

      I'm sure there are others, but that's at least three federal unique ID systems for humans off the top of my head. Other certifications like HAM, Pilot, Captain's licenses are all forms of federal ID as well.

      • There's also the federally issued passport, which also has it's own number. I've never really understood why the passport isn't just the de-facto personal ID, it's a global standard ID system recognized by all countries (as far as I know).

        Because:

        1. Passports cost money,

        2. Only a relatively small proportion of US citizens have passports, and

        3. Not every US resident is entitled to a US passport.

      • Re:unique id (Score:4, Informative)

        by BarbaraHudson ( 3785311 ) <barbarahudson@NOSPaM.gmail.com> on Friday November 13, 2015 @12:18AM (#50919491) Journal
        SSNs aren't unique. This has been known for a long time - it was discussed in the C user's journal back in the 80s.
    • Re: unique id (Score:4, Interesting)

      by O('_')O_Bush ( 1162487 ) on Thursday November 12, 2015 @11:22PM (#50919313)
      What is there to explain? Americans hate the idea of the UID *because* they all have direct experience with having a SSN. The way the SSN is, it is like having a password for very important things, but one that you have to give out to every street vendor to verify you as well. Identity theft nightmare for the owner.
      • Re: unique id (Score:5, Informative)

        by ag0ny ( 59629 ) <javi@@@lavandeira...net> on Friday November 13, 2015 @12:15AM (#50919479) Homepage

        The way the SSN is, it is like having a password for very important things, but one that you have to give out to every street vendor to verify you as well. Identity theft nightmare for the owner.

        No.

        The problem isn't what the SSN is. The problem is the way the SSN is used.

        I'm Spanish. In Spain we have a national ID system, and I have my own ID number. However, we don't use this number as a password in order to verify that we are who we say we are. It's used more or less as an index in a database. You can easily find my national ID number with a simple Google search. Mine, and probably every other Spanish citizen's. No big deal about it.

        In you case, what's going on is that a bunch of clueless policy makers working for businesses decided that the SSN would work fine as a way to identify people. It's not. You're using it wrong.

        • by AK Marc ( 707885 )
          Where I am, we have one number for tax, one number for health care, one number for drivers license, one number for passports, and nobody uses any of them improperly. But they are all secret, and not known to anyone who doesn't need to know it.

          SSN is supposed to be secure, but everyone has it and it isn't secure.
          • by ag0ny ( 59629 )

            Where I am, we have one number for tax, one number for health care, one number for drivers license, one number for passports, and nobody uses any of them improperly. But they are all secret, and not known to anyone who doesn't need to know it.

            SSN is supposed to be secure, but everyone has it and it isn't secure.

            Exactly, it's the same thing in Spain. I have one DNI number (Documento Nacional de Identidad, National Identity Document), a drivers license number, and a passport number (used to be the same as my DNI, but now that I live in Japan the number has changed). Spain also has a number for tax purposes, the NIF (Número de Identificación Fiscal, Tax Identification Number), but it's just the DNI + a letter which is a function of the DNI numbers, sort of a CRC.

            We don't go around telling our ID numbers

      • by AK Marc ( 707885 )
        It's illegal for the banks to use SSN for the reasons they do. But nobody enforces the law against the financial sector. So it's not the SSN that's the problem, but laissez faire.
        • So your theory is that the government creates a centralized ID number, it's abused by the most heavily regulated industry we have and the problems are due to lack of enough government involvement in the process?

          Dude, you gotta start sharing whatever you're smoking there...

          • by AK Marc ( 707885 )
            The financial industry isn't heavily regulated. What are you smoking?
            • Re: unique id (Score:5, Insightful)

              by dgatwood ( 11270 ) on Friday November 13, 2015 @02:55AM (#50919985) Homepage Journal

              Banks are, but AFAIK, the credit bureaus aren't. They're the root of the problem. If the credit bureaus really wanted to end so-called "identity theft", they could do it very easily. It would simply require them to invest the money to perform a callback authentication to all registered phone numbers prior to issuing new credit. Boom. No more "identity theft", or at least so many orders of magnitude less that the remainder could be treated as noise.

              I put that in quotes because your SSN isn't a true identity, at least by the cryptographic meaning of the term. It's an identifier. An identity is something that can be used to prove who you are. An identifier is something that stands in for who you are. A proper identity should roughly guarantee non-repudiation. An identifier does not, because it is not secret. It is not possible for someone to steal a true identity, or anything that even approaches one. It is trivial to steal an identifier; it need only be shared once, and then it is no longer secret.

              Thus, "identity theft" is a misnomer. It should be called "SSN theft", or even "unauthorized SSN use". But if we call called it that, then the credit bureaus couldn't pretend that the problem is a serious problem caused by a bunch of bad people, rather than an entirely artificial problem of their own making....

              The again, if everyone who found a false entry on his or her credit report sued the credit bureau for libel, the problem might just take care of itself.

              • by dgatwood ( 11270 )

                Just to clarify, it is possible to steal a digital identity, but it is not possible to steal a digital identity when used correctly, e.g. when you use your private key to encrypt a nonce, and someone else decrypts that nonce with your public key to verify that you really do possess the private key associated with that public key.

              • Re: unique id (Score:5, Insightful)

                by AK Marc ( 707885 ) on Friday November 13, 2015 @03:55AM (#50920117)

                Thus, "identity theft" is a misnomer. It should be called

                Fraud. Nothing more, nothing less. Lies for gain. Why would there be any confusion on the matter? Oh yeah, if you call it bank fraud, the bank would pay for their loss. When you call it identity theft, you blame the victim for the bank's poor security and reduce the bank's loss.

            • Forbes: [forbes.com] "The two sectors currently most affected by the regulatory environment in the U.S. are healthcare and financial services."

              Regdata: [mercatus.org] "Regulation on Credit Intermediation and Related Activities has grown 517.73% since 1997."

              Can you point to any data which shows the financial industry isn't heavily regulated? Simply googling the question is the financial industry heavily regulated [google.com] seems to have a pretty broad consensus of answers in the affirmative. Why do you think otherwise?

    • by billrp ( 1530055 ) on Thursday November 12, 2015 @11:24PM (#50919321)
      Nothing much to explain - we just issue duplicate SSNs to avoid a unique, centralized ID number system.
      • Since all anybody really cares about is the last four digits, we could simplify it at the same time...

    • So, slashdot tells me americans HATE the idea of a centralized, unique ID number. Yet, they have a de-facto standard "unique" ID number, the SSN.

      Can somebody explain?

      It's not unique. 40 million people share one with somebody else according to the article.

      • by amiga3D ( 567632 )

        I know the joke at the local chicken processing plant was that they have over 200 immigrant workers and they all have the same SSN.

      • I'm pretty sure that most of the "40 million" are sharing a SSN with somebody who died *years* ago, and that the number of people like the two women cited as an example is much, MUCH smaller.

        I mean, for ${deity.name}'s sake, there are only ~300 million *AMERICANS*. If one in 8 Americans had SSN collisions with another living person, I can *guarantee* it wouldn't have taken until now to be newsworthy.

        That said, the gov't really needs to add at least a digit or two. Just adding one digit & making every ex

        • Re: unique id (Score:4, Insightful)

          by Wycliffe ( 116160 ) on Friday November 13, 2015 @12:14AM (#50919473) Homepage

          I'm pretty sure that most of the "40 million" are sharing a SSN with somebody who died *years* ago, and that the number of people like the two women cited as an example is much, MUCH smaller.

          I mean, for ${deity.name}'s sake, there are only ~300 million *AMERICANS*. If one in 8 Americans had SSN collisions with another living person, I can *guarantee* it wouldn't have taken until now to be newsworthy.

          That said, the gov't really needs to add at least a digit or two. Just adding one digit & making every existing SSN end with "0" until 2025 (to allow a graceful transition where existing 9-digit numbers would have an easily-derived 10-digit value) would give them enough unique numbers to go a few centuries without ever reusing a number.

          Why would you add the digit on the end and break every system in existence? Much better to add it to the left like a normal number then the zero is completely optional unless you have a 10 digit SSN. Reusing SSNs is a stupid idea. Just start giving babies and new applicants 10 digit, then 11 digit numbers, etc... If everyone in 2016(or 2017 if you want to give a little more time) got a SSN greater than 999,999,999 then existing systems would adapt quickly, many probably already support ID fields greater than 9 digits as there are alternate IDs like passport numbers and foreign IDs already in existence that probably exceed 9 digits. The other alternative would be to go to alphanumeric IDs for new applicants.

          Personally, though, it might be better to break the system and fix it right. Why do you need a non-changing number? Credit card companies and even banks have the ability to reissue you a new number if your previous number is compromised. Credit card companies sometimes even send you a new number every few years just for safety. A standard USA credit card is 16 digits, I would propose a 16 alphanumeric SSN that changes every year and can be invalidated at any time. When you file your taxes, you file it with the current year's SSN and then when it's complete, they send you a new SSN to use the next year. As long as each SSN is chained to the previous one, they you still have the ability to track what is needed but finding a 3 year old number is now worthless.

          • by dgatwood ( 11270 )

            Financial systems already have to cope with two entirely overlapping sets of numbers—taxpayer identification numbers and SSNs. Both are nine-digit numbers. One has a single hyphen after the second digit, and the other has two hyphens. So it isn't as though you can just store the nine-digit number and ignore the rest of the string. To be useful, an SSN really needs to be stored as a ten- or eleven-digit string, and must be compared using string comparisons, not numeric comparisons.

            Thus, it would m

            • A SSN contains 30 bits of information, plus a SSN.TIN bit which is 31 bits, or 4 bytes (with a bit to spare). They way you count it we'd need 11 bytes, minimum. It's easy to forget that, when many/most of these systems were set up, storage cost many orders of magnitude more than they do today. When you're paying on the order of a dollar per kB of information and you're storing data on 200 million people, it gets expensive.

              Today, it's no big deal - we've got data capacity to spare. But there are a lot of leg

            • The FEID and SSN are issued from the same range of numbers by different branches of the federal government, but eins do not overlap with SSN, except in rare accidental cases. I am not aware of any systems that attempt to make any use of the hyphen positions as predictors, but undoubtedly some are even though it is not a useful data point and subject to user error.
      • by XXongo ( 3986865 )

        It's not unique. 40 million people share one with somebody else according to the article.

        Not exactly. If you click through to the link, it says that "more than 40 million SSNs are associated with multiple people." It turns out, when you read through the article, what this means is that at least once somebody made a typo and wrote the wrong social security number. Not cases of a people using the same social security numbers.

      • by Koby77 ( 992785 )
        The 40 million figure is misleading. After working with SSNs, I can tell you that it's mostly not the Social Security Administration accidentally issuing the same number to multiple people. The numbers are associated with multiple people because someone has chosen to use someone else's number fraudulently.
    • Re:unique id (Score:5, Interesting)

      by Jason Levine ( 196982 ) on Thursday November 12, 2015 @11:37PM (#50919365)

      SSN started out merely as an identifying number to record social security payments. After awhile, though, it morphed into a number that identifies you for everything. However, this isn't a very secure number and it can be compromised in any of a dozen different ways. Combine this with a person's name and date of birth and you can do some horrible things to their credit rating while raking up huge debts in their name.

      I know this first hand since I'm a victim of identity theft. Someone got hold of my name, address, DOB, and SSN (how, I'll never know). They opened a credit card in my name. (Despite, I might add, getting my mother's maiden name wildly wrong. So much for that "security question.") The only thing that kept this nightmare from being much, much worse was that they paid for rush delivery of the card and THEN changed the address on the card. The card was sent to me before the address change went through so I was able to shut the account down before any real damage was done. Of course, I still need to have my credit frozen for the rest of my life since my information's out there and could be used at any moment.

      Fortunately, there have been enough identity theft stories in the news to make people aware of the situation. Unfortunately, too many companies require you to give your SSN when they don't really need it and too many people just assume "it's required so I have no choice."

      • Re:unique id (Score:4, Insightful)

        by jtownatpunk.net ( 245670 ) on Friday November 13, 2015 @12:20AM (#50919505)

        Your mother's maiden name isn't an identity check. It's like "What's your first pet's name". Nobody has the name of your first pet in a big database used to verify your identity. It's just a passphrase that can be anything. In fact, you should use something other than your mother's actual maiden name. Anyone can do a bit of research and find out your mother's maiden name. But they can't do research to find out the fake name you used so they won't be able to use that information to take over an established account.

      • I try to get out of it whenever possible. But for all practical purposes, you have no choice. For example, to set up natural gas service. You have option 1) providing your SSN which they will probably keep as insecurely as possible and also probably use for your customer number. Option 2 is putting down an excessively large deposit which must be done using cash at their office an hour away during "business hours" of 9-11AM or 1-3PM M-Th. Or I guess there is option 3 as well which is not heating your home or

  • More than 1 in 10 are associated with multiple people. That is unbelievably poor quality control. You could GUESS at an SSN and 1 out of 3 would not be associated with somebody.
  • by Anonymous Coward

    we had three people with the same SSN. In 1935 in a three month period, 25 million numbers were issued from over a thousand post offices and from several companies, especially rail roads. Of course, there were mistakes made. What I still can't believe after encountering that almost a dozen more times, is that people still insist that SSNs are unique. I currently work for a payroll company, and we have a unique index on our database. People still mistakenly believe that they must be unique despite seeing

  • by jtownatpunk.net ( 245670 ) on Friday November 13, 2015 @12:14AM (#50919471)

    ...my company's accountant told me that someone in Los Angeles had used my SSN and the IRS was trying to garnish my wages. She told them that I was certainly not Mr. Aguilar and that I was not responsible for Mr. Aguilar's debt to the IRS. Seems like a simple thing but she was not supposed to tell me about the incident. Because if the proles ever found out how often this happens, they'd lose faith in the integrity of The System. I, as the taxpayer and rightful SSN holder was never contacted by the IRS to either collect money or warn me that there was someone out there using my SSN, possibly ruining my credit.

    • Re: (Score:2, Interesting)

      by Anonymous Coward

      The problem is that people allow private for-profit credit reporting agencies to rule their lives. These organisations are criminal. Any business can run a credit check on you, affecting your credit rating Heisenberg-style, or make a false report on your credit and are taken at their word. Want to lodge an objection as a lowly individual consumer? That will be a $50 fee., or worse, and there is no guarantee it will mean anything.

      We need to stop letting these crooks (the credit reporting agencies) rule us. T

    • ...my company's accountant told me that someone in Los Angeles had used my SSN and the IRS was trying to garnish my wages. She told them that I was certainly not Mr. Aguilar and that I was not responsible for Mr. Aguilar's debt to the IRS. Seems like a simple thing but she was not supposed to tell me about the incident. Because if the proles ever found out how often this happens, they'd lose faith in the integrity of The System. I, as the taxpayer and rightful SSN holder was never contacted by the IRS to either collect money or warn me that there was someone out there using my SSN, possibly ruining my credit.

      They're just waiting for the interest to build up -

      You should probably get something in writing from them saying that you don't owe anything.

      • They're just waiting for the interest to build up -

        You should probably get something in writing from them saying that you don't owe anything.

        As long as the GP has filed their taxes and keeps a copy of the filing records, the IRS only has 3 years to claim back taxes. You should keep your tax records for a minimum of 8 years as they can go back much further if they claim you never filed. I would recommend keeping your tax records indefinitely.

    • by jittles ( 1613415 ) on Friday November 13, 2015 @09:29AM (#50921041)

      ...my company's accountant told me that someone in Los Angeles had used my SSN and the IRS was trying to garnish my wages. She told them that I was certainly not Mr. Aguilar and that I was not responsible for Mr. Aguilar's debt to the IRS. Seems like a simple thing but she was not supposed to tell me about the incident. Because if the proles ever found out how often this happens, they'd lose faith in the integrity of The System. I, as the taxpayer and rightful SSN holder was never contacted by the IRS to either collect money or warn me that there was someone out there using my SSN, possibly ruining my credit.

      I Had someone using my social security number for work once upon a time. Their company had a mandated retirement program. The IRS never complained about my taxes, even when I e-filed. One year I got a check in the mail for ~$5000 from a company I had never heard of, nor worked for. It was nowhere near me. My social security number and name were on the check. I called them up and asked them if there was some sort of mistake. Got transferred around and ended up talking to someone from HR and accounting in a conference call. They said they weren't allowed to give me any info about who had been using my info but said since it was clearly my name and social security number, I was welcome to cash the check and the money was all mine. Sometimes identity theft can work in your favor!

      • by j-beda ( 85386 ) on Friday November 13, 2015 @11:26AM (#50921999) Homepage

        I Had someone using my social security number for work once upon a time. Their company had a mandated retirement program. The IRS never complained about my taxes, even when I e-filed. One year I got a check in the mail for ~$5000 from a company I had never heard of, nor worked for.

        As an expat US Citizen, maybe I should try to get some illegal immigrant in the USA to use my SSN to do some work to build up my social security credits which have not been growing while I am out of the US....

      • by Quirkz ( 1206400 )

        Did you end up having to pay an early withdrawal penalty for that check? Or income taxes? I mean, that's still probably a win, but it seems that there would be complications.

  • All those in favor of random UUIDs, raise your hands.
    • by Anonymous Coward

      That doesn't solve anything, because they were never meant to be secret in the first place. The "proper" use of an SSN is more like a username, not a password.

      The real problem is that we have a bunch of people stupidly misusing a non-secret piece of information as if it was.

      Similarly, I don't care if my license-plate number is sequential or random, any company that will lend money to someone who knows my name and license-plate is a company that is fucking up, and our laws need to recognize that it is *their

  • So were both of them paying taxes?
  • Vice president of a company that sells a solution to an alleged problem states that the alleged problem really is a really bad problem, citing an amusing anecdote as a hook and a study in which the company that sells the solution claims that the alleged problem really is a problem. A cynic might have some questions...

"The chain which can be yanked is not the eternal chain." -- G. Fitch

Working...