iOS app Android app More

Child Identity Theft Takes Advantage Of Kids' Unused Social Security Numbers

Child Identity Theft

First Posted: 08/22/11 10:27 AM ET Updated: 12/23/11 05:19 PM ET

For $40 to $80, websites illegally sell 9-digit "credit privacy numbers," which are clean Social Security numbers mostly belonging to children, according to Jennifer Walker, who works in the Office of the Inspector General of the Social Security Administration.

And if thieves are unable to buy or steal a child's Social Security number, they may be able to guess it. In fact, children's numbers are easier to predict than adults' numbers thanks to a government program created in 1987, according to Alessandro Acquisti, associate professor at Carnegie Mellon University.

The Social Security Administration's program encouraged parents to apply for their newborn's Social Security numbers at birth to prevent identity thieves from hijacking their child's Social Security numbers before they could apply for them.

But the program had the opposite effect because Social Security numbers have been issued in a predictable sequence based on when and where a child was born. So when nearly all children began receiving Social Security numbers at birth, thieves could infer all nine digits based on publicly available information, Acquisti said.

In June, the Social Security Administration hoped to fix this by assigning a randomized series of numbers, but the more predictable Social Security numbers will remain in effect for people born before this summer.

"We're talking about hundreds of millions of Social Security numbers that are still potentially predicable," Acquisti said. "We've made the job of identity theft way too easy."

LEAKY SOURCES OF IDENTITIES

While they have long focused on financial institutions, online thieves have also begun targeting organizations that store vast amounts of children's Social Security numbers, such as health care providers and schools. But those agencies often fail to properly safeguard the information or promptly disclose data breaches when they occur.

Last July, a Bronx man was charged with filing false tax returns by using Social Security numbers of children who were patients of pediatric cancer and other hospitals in New York City.

In January, health care insurer Health Net learned that computer servers containing data on nearly two million members, employees and health care providers went missing. But the company waited nearly two months to report the breach, according to the San Francisco Chronicle. Then it began offering free credit-monitoring services to enrollees whose information may have been compromised.

That was when Simon Umscheid learned his 6-year-old son Ian was apparently the victim of identity theft. After the data breach at Health Net, an identity thief set up several bank accounts and bought jewelry and cable television service under his son's name, racking up about $14,000. Umscheid said the fraud is being resolved, but he remains angry with Health Net, which also suffered a major data breach in 2009.

"It's incredibly frustrating," he said. "My son obviously doesn't understand what's going on and we haven’t talked to him about it. You feel victimized."

Meanwhile, at least 26 states now collect Social Security numbers from students to track their future performance in the workplace, according to the Data Quality Campaign.

But schools have struggled to secure children's identities. The education sector represented 12 percent of all data breaches last year, according to the security firm Symantec. And this year, data breaches at schools have continued.

In one example, officials at Lancaster County School District in Lancaster, S.C., sent letters in April notifying parents that hackers had broken into a system housing the Social Security numbers of about 25,000 students. In June, two laptops containing Social Security numbers of 10,000 students and staff from northern Illinois were stolen from a car, according to the Privacy Rights Clearinghouse.

"There are likely many schools that have exposed data that don’t understand how exposed it is," said Robert Hamilton, senior manager of product marketing at Symantec.

Some parents have fought efforts to collect sensitive information on their children. After strong opposition from parents and school boards, the Maine legislature this year removed language in a state law that required schools to collect student's Social Security numbers.

Such groundswells of protest should happen more often, privacy advocates say. Parents should be skeptical when giving out their child's Social Security numbers, particularly when there is no apparent need for it, Dennedy said.

"There's not enough education in the marketplace to tell parents to push back when someone asks you for their Social Security number to join a church canoe trip," she said at a forum last month. "They probably won't be trying to get a credit card in the canoe. I'm not sure why they're even asking for that kind of information."

Stephanie McManis, 31, says her identity was stolen when she was 12

A STRUGGLE TO REGAIN HER NAME

For victims of child identity theft, the damage can take years to unwind. After graduating college in 2001, Stephanie McManis applied for her first credit card, but was rejected.

Only after she requested her credit report did she learn that someone else had used her identity since she was 12 years old, she said. Her credit report was "inches thick," she said, filled with unpaid mortgages, car loans, cell phone contracts and credit card debt.

McManis filed a report with her local police department and authorities tracked down the woman who was using her identity and living just a few hours away in Avon, Ohio, just west of Cleveland.

Avon Police Officer Kevin Krugman, who investigated the case, said the Social Security numbers of the two women are one digit off and he believed the confusion was caused by "nothing more than a clerical error" by someone at a credit agency, not identity theft.

"Their identities are tied together for good until they take care of it," Krugman said.

But privacy advocates familiar with McManis' case still believe she is a victim of identity theft. Dennedy said local police departments often do not want to conduct thorough investigations of identity theft because they do not have the time or resources. And if it was an honest mistake, Dennedy said, why is this woman still using McManis' Social Security number today?

"Cops don’t want to believe it's identity theft because they have to close their cases," Dennedy said. "They don't understand the harm. Even if it was an honest mistake, and you still can't get a house or a loan, the impact is the same. You're still stuck with someone else's bad credit."

A few years ago, McManis was denied a mortgage on a house because the other woman had filed for foreclosure. The issue was eventually straightened out, but the calls from collection agencies asking for hospital bill payments continue.

To this day, McManis does not know how her identity was stolen. She knows the woman's name and has found her Facebook page, but has never contacted her directly because she does not want to appear to threaten her. The woman did not return calls for comment.

"I'm angry at her but also frustrated with the system," McManis said. "I shouldn’t have to prove myself when I've had good credit my whole life."

5 tips for parents to protect their children from identity theft:

1. Don’t carry around a child’s Social Security card. This increases the risk of losing the card, which is the most common way identity thieves obtain a child’s information.

2. Be discriminating when asked for a child’s personal information. If it has to be provided, ask how it will be stored. If the information will not be retained, inquire how any record of it will be destroyed or returned.

3. Cross-shred documents with personal identifying information before disposing of them.

4. Don’t post children’s pictures online. Most digital cameras have geocoding features that embed within images the location where pictures were taken. This gives identity thieves information they can use to steal children’s identities.

5. Don’t give children their Social Security numbers until they understand how and why to protect the numbers.

Source: Identity Theft 911

FOLLOW HUFFPOST TECH