Social Security Numbers: A Key to Identity Theft

According to recent studies, identity theft is rising in the United States. Covid caused more people to stay home, conduct business remotely, and shop online, making it easier for identity thieves to steal credentials, such as names, passwords and other nonpublic personal information. With a few clicks, a full array of identity information, including Social Security numbers, became subject to hacking. Many stolen Social Security numbers were used to create “synthetic identities.” 

A synthetic identity results when a wrongdoer combines different identity elements, possibly of different people, to create a new identity with credentials that seem legitimate on their face. Credit bureaus allow different identities to contain the same Social Security number, although only the actual person’s use of their number is legitimate. If an identity thief obtains a legitimate Social Security number, it is not hard to establish a synthetic identity and even get credit with it. In the fast-paced world of auto dealers on a busy day, it is easy to miss red flags or investigate the legitimacy of a Social Security number.

Verifying one requires a little work. The first thing you should know is how the Social Security Administration assigns numbers. Until June 25, 2011, they were assigned under a uniform numbering system that indicated where the person lived when their number was assigned, and approximately how old they were.  Later-issued numbers have been assigned at random.

Under the old system, the nine-digit SSN comprises three parts: The first set of three digits is called the Area Number. The second set of two digits is called the Group Number. The final set of four digits is called the Serial Number. The Area Number is assigned to states indicating where the person was issued their number. Low digits are assigned to Northeast states, high digits to West Coast states. So, for example, Maine had the lowest area numbers, 004-007, and New York had 050-134.  California was 545-573 and 602-626.  Alaska and Hawaii had the highest area numbers assigned to states: 574 and 575-576, respectively. Even higher numbers are assigned to D.C. and U.S. territories. The full chart of assigned Area Numbers is available here.

The numbering system applies to all persons who were issued numbers before June 25, 2011. This should include substantially all people over age 18 trying to buy, finance or lease vehicles because federal law has required that people obtain Social Security numbers shortly after birth. So, if you have a suspicious customer or if your red-flags service indicates the number may be problematic, ask the person which state he or she lived in when their number was issued and compare it to the chart. If you get the wrong answer, that is a serious red flag for identity theft.

The problem with this approach is that many, but not all, identity thieves know about the chart and numbering system. There is another way to verify a number for a customer you have serious doubts about, even if they name the correct state for their claimed Social Security number. 

Only the number-assigned person has an earnings record for that number. Identity thieves don’t. Also, the Social Security Administration has digitized all its records, many of which, including earnings records, are available only through its website.  Anyone can easily create an account on this website to access their records.

For customers about whom you have serious identity concerns, ask them to access their earnings history on the Social Security Administration’s website using their smartphones. Do not use a dealer device to do this, as it will create a Safeguards issue, and you do not want to keep that information. Ask the customer to show you the earnings record with their name and Social Security number. You do not want to copy it; you only want to see it on their smartphone and put a note in the deal jacket that you verified their number in that way.

You probably have your answer if the person cannot access the earnings record. Identity thieves will object to this approach, claiming privacy or some other right. While legitimate customers may also object, you can explain that you verify their number to protect against identity theft and that you don’t access or copy any record. Most customers should not object if you explain the reason for your request. You do not need to do this for every customer but only those about whom you have identity concerns from your identity-verification service or who cannot name the state where their number was issued.

If you do finance a vehicle to an identity thief, you will want to explain to the lender your diligence in seeking to verify the identity. Identity thieves are getting very sophisticated. Showing your lender that you exercised this level of due diligence may provide a positive outcome. At least it will show your meticulous red-flags process. Remember, identity theft-proofing your dealership may not be possible, but actions like those described above can help mitigate the risk. Good luck.

ABOUT THE AUTHOR

Randy Henrick is an auto dealer compliance expert who provides compliance consulting services to dealers of all types. He served for 12 years as Dealertrack's lead regulatory and compliance attorney and wrote all of Dealertrack's compliance guides while there. Henrick audits deal jackets, writes and reviews compliance policies, acts as an expert witness in litigation, and does training for dealers on auto finance compliance and procedures.

Originally posted on F&I and Showroom