When Companies Ask for Your Social Security Number, Try Saying No
Story by Heidi Mitchell, Wall Street Journal, 5/31/24
It seems like every time we have to fill in a form, we get asked for nine very valuable numbers.
Looking for a gym membership? A certification? A loyalty card at the supermarket? Very often, the business will request our Social Security number—and very often, we provide it without a second thought.
But in doing so, we leave ourselves open to cybercriminals. Thieves who get access to your Social Security number can use it to commit serious fraud, such as applying for credit cards, loans and government benefits in your name.
In many cases, there’s a simple solution to this: Just say no. According to privacy and security experts, in many situations we shouldn’t have to turn over our number. And if we refuse to give it, organizations often will back down.
“Skip it if you’re filling out something that isn’t a legal document, related to a loan or opening a financial account,” says Rachel Tobac, chief executive of SocialProof Security, which helps companies protect themselves from malicious hackers. “If somebody then comes up to you and says, ‘Unfortunately, it stinks, but we really need to get your Social Security number to verify you,’ you can simply ask them to access your records with some other form of ID and see what happens. Sometimes, they should be able to.”
Numbers at risk
It’s important to know that businesses and other organizations are absolutely allowed to ask for your number. “Businesses, banks, schools, private agencies, etc., are free to request someone’s number and use it for any purpose that does not violate a federal or state law,” the Social Security Administration says on its website.
In some important or official situations, of course, you can’t get around it: You must turn over your Social Security number to get what you need. You must supply it to anyone running a credit check, for instance, or to government agencies that provide benefits such as student loans and veterans’ assistance.
Then there are the businesses and groups that don’t technically need the numbers—which are designed to track workers’ wages and benefits—but they are now used as a convenient identifier and even as a password or login mechanism. “Social Security numbers have migrated into bureaucratic systems, hospitals, educational institutions and eventually into private record-keeping,” says Sarah Igo, a professor of history at Vanderbilt University. “These numbers are not secure, yet they have become a sort of proxy national identification number.”
No single federal law regulates the collection and privacy protection of Social Security numbers for all agencies, according to experts, and at the state level, laws can vary widely—when there are laws.
What’s more, you don’t have a ton of recourse if someone asks for your number. “The decision is theirs,” says Social Security Administration spokesperson Nilsa Henriquez. “However, they should know that refusing to give the number might mean doing without the purchase or service for which the number was requested.”
No sweat
But in practice, experts say, if you refuse to provide a number, requesters will sometimes agree to drop the matter. They don’t want to sour a relationship with a customer, and very often they are asking for it out of inertia—they don’t care about the numbers but already have forms printed up with a space for them. The businesses often don’t even know why they ask for the information.
Eva Velasquez found herself in that situation when she took her son to a new dentist. The office asked her to supply not only his Social Security number, but also her own. “I wasn’t comfortable putting them on the form, so I politely asked if it was necessary,” says Velasquez, the president and CEO of the Identity Theft Resource Center, a nonprofit that helps victims of identity crimes. They told her she could leave the numbers off the form.
In many cases, your driver’s license or passport should be enough to verify that you are who you say you are, according to experts. “I would simply politely explain how Social Security numbers are often used for identity theft, and seeing as a customer is not required to provide them, could they please offer an alternative?” says Chester Wisniewski, director and global field chief technology officer at Sophos, a cybersecurity company.
Alan Butler, executive director and president of the Electronic Privacy Information Center, an advocacy group that defends privacy online, urges people to ask plenty of questions to show their concerns.
“Ask them, where will it be stored? For how long? Will it be encrypted? Who will have access to it? These are legitimate questions,” he says.
Answers to these questions will help determine whether their practices and procedures are adequate enough to earn your trust. It is difficult to evaluate what constitutes a true red flag, says Wisniewski, so go with your gut. “But if they ask you to send your number by email, that’s not a good sign,” he adds.
Filling the blanks
These strategies won’t work in one common situation, though: filling out an online form. In those cases, Tobac requests a paper version from the organization that posted the form online.
“Oftentimes online, you won’t be able to proceed to the next page without filling out everything in red or with an asterisk, and that commonly includes your Social Security number,” she says. “In that case, I recommend calling them up and asking for a paper version, which most companies have to provide to comply with the Americans with Disabilities Act.”
Then she simply leaves the boxes for her Social Security number blank. “Let them push back,” she says.
Of course, in some cases, a company won’t back down—and you have to decide if your concerns about privacy outweigh the consequences. “Sometimes, you are going to find yourself in a take-it-or-leave-it situation where they’ll say, ‘Well, taking down your Social Security number is our policy,’ ” says Butler. “And you’re not going to not send your kid to summer space camp over the potential risk of their website being hacked, right?”
Perhaps, though, by walking away, some experts say, consumers will be pushing companies to move away from identification mechanisms like Social Security numbers and toward other methods.
“We have to put pressure on institutions to change the way that they verify identity from this outdated verification method that so many cybercriminals have access to from breaches,” says Tobac. “It costs money and time and resources to update the way they authenticate that we are who we say we are. And without pressure, they won’t change. And that leaves all of us at risk.”