Social Security number

Q&A: Safeguarding your personal data is hard. Here are a few tips.

May 13, 2024 By Liz Weston

Dear Liz: I was recently alerted that my Social Security number has been found on the dark web. My information was part of the AT&T breach that took place recently. I am no longer an AT&T customer and haven’t been for several years, but they have not made any contact with me. What do I do to keep myself safe and how do I get my information removed from the dark web? Why hasn’t AT&T reached out to me?

Answer: As a consumer, you don’t have much power. Companies often demand your personal data, such as Social Security numbers, before they’ll do business with you. Once your information is in their databases, you have no control over what happens to it. And if your information is leaked, there’s no way to remove it from the dark web.

You can’t even be sure how your information got there, given the sheer volume of database breaches in recent years. If you’re an adult with a Social Security number, chances are pretty good that number can be found on the black market sites where criminals buy and share information, says Eva Velasquez, chief executive of the Identity Theft Resource Center, a nonprofit that helps identity theft victims.

In other words, your data may have been compromised long before the latest incident, which AT&T says affected 73 million current and former customers. AT&T began notifying impacted customers via letters or email starting in April. Those customers should have received an offer for free credit monitoring.

There are a few things you can do to make yourself a bit less vulnerable to identity theft, such as putting freezes on your credit reports, not clicking on links in texts or emails if you didn’t initiate the transaction and using digital wallets or other secure payment methods.

Also, don’t be your own worst enemy. Beware of sharing personal information (birth dates, address, phone number, etc.) on social media. Consider limiting your audience to people you know and trust, Velasquez says.

The Identity Theft Resource Center also recommends using passkeys, a technology that replaces passwords, whenever you’re offered that option. If a passkey is not available, the center suggests using passphrases of 12 characters or more rather than shorter passwords. A passphrase is a sequence of words that can be personalized for easier memorization, typically with numbers added and a mix of capital and lowercase letters. The center gives an example of a passphrase for a 2015 University of Texas graduate: “H00kEmH0rns2015.” You’ll still need unique passphrases for every account and site. You also should turn on two-factor authentication or multi-factor authentication where available. This requires an extra step, such as getting a code on your phone or from an app, but this will make your accounts harder to compromise.

Q&A: Freezing Your Social Security Number

December 26, 2017 By Liz Weston

Dear Liz: Recently you answered a question about whether Social Security files could be “frozen” to help prevent fraudulent activity, and your response was no. I had just researched that question after the Equifax breach, and found out the Social Security Administration does have a way to block electronic access to your records now, so I had that set up for me. The administration advised that it can be done whether you have an online account or not (I don’t). There is additional information about this on the Social Security website: https://secure.ssa.gov/acu/IPS_INTR/blockaccess

Answer: When you block electronic access to your Social Security file, no one, including you, is able to see your records or change your information online or through the administration’s automated phone service. Blocking access could prevent someone from tampering with your record, but it also could prevent you from detecting misuse of your Social Security number if someone is using it for employment or tax fraud. Blocking access certainly won’t prevent other kinds of identity theft involving credit, medical care or criminal arrest. A better approach might be to set up an online Social Security account to prevent someone else from doing so fraudulently, and to monitor that account regularly.

There is another government service, myE-Verify, that enables you to “lock” your Social Security number. That may prevent someone from using your number to get a job, but only if an employer uses the service to determine applicants’ eligibility to work in the U.S. — and many employers don’t. Even if you succeed in preventing employment fraud, your number could still be used in other types of identity theft. Also, a Social Security lock expires after one year, so you’d need to renew it annually if you want to keep it in place.

Unfortunately, there’s no easy way to prevent your Social Security number from being misused. As long as those nine digits continue to be used as an all-purpose identifier, we will be vulnerable to all kinds of identity theft.