We hear about massive data breaches all too often. Somehow, a company mistakenly releases private customer information, or it is stolen outright.
This might include your name and address, email address, phone number and your Social Security number.
Thieves who have your Social Security number can cause a host of trouble. They might file a false tax return in your name and snatch your refund. They may open credit card accounts or even mortgages using your information.
“Your Social Security number is the skeleton key to your life and should be protected like the jewel of the nile that holds all of your personal information,” said Adam Levin, a former head of the N.J. Division of Consumer Affairs and founder of Credit.com.
The nightmares can go beyond financial ones. If they use your number to get medical care, your medical records — your blood type, conditions you have and more — could be intermingled with the crook. Then when you need care, your own health could be at risk.
There’s not much you, the consumer, can do to prevent mishaps by the companies that have your personal information.
“The sad fact of the matter is that Social Security numbers are out there, and we can’t put the genie back in the bottle,” said Ed Mierzwinski, consumer protection director for U.S. Public Interest Research Group, or PIRG.
He said New Jersey has some of the strongest state laws in terms of notification when there are security breaches.
But the laws — including the ones that are now being considered on the federal level — are not enough, because breaches still happen. You need to make sure you don’t willingly give your Social Security number just because someone asks. Plenty of entities regularly request this identifier when they don’t need it, and when you’re not legally required to give it.
The Social Security number, born in 1936, was not created to keep track of everything about your life. It was meant just to keep track of workers’ earnings histories to calculate eventual Social Security benefits.
But now, it’s used as a universal identifier.
You simply should never give your Social Security number unless you have to. More on that in a moment.
WHEN YOU MUST GIVE IT
There are plenty of times when providing your Social Security number is required, and rightly so.
Any time you’re involved in business that requires notification to the Internal Revenue Service (IRS) is a legitimate time to hand over your number.
That includes dealings with any government agency to which you apply for benefits, or if you enter into a real estate transaction, or if you open an investment account or a bank account.
Same goes for your employer.
By law, they need your Social Security number as an identifier for reporting transactions to the IRS.
Then there are other times when it’s not a legal requirement, but a requirement by the business.
For example, it’s okay to hand over your number if you’re applying for any kind of a loan, including a credit card, car loan or a mortgage. The lender will require your number so it can check your credit report. Same goes for certain businesses that check your credit report before providing service, such as utilities, prospective landlords and insurance companies.
And if you want to order your free credit report at annualcreditreport.com, your Social Security number is required.
If you don’t want to give your number to some of these entities, they may choose not to do business with you.
WHEN YOU SHOULDN’T GIVE IT
It’s common for doctor’s offices to ask you for your Social Security number when you fill out paperwork with your contact information and medical history. But they don’t need it.
“Doctors take the Hippocratic oath to ‘first do not harm,’ not realizing that having files with exposed personally identifiable information and unencrypted patient information can definitely hurt the patient,” Levin said.
Levin said he once asked his doctor why his office asks for Social Security numbers, and the doctor replied that he didn’t know. It’s just what they have always done, the doctor said.
Perhaps having a Social Security number would be helpful for debt collection, but, as Levin said, consumers have a choice but often blindly defer to the doctor.
Public schools also often ask for your Social Security number, but there’s not really a good reason a school needs it. If a school needs to verify your address, your utility bill or other bill should suffice. Same goes those who run other children’s activities, such as camps and sports programs. They may need your child’s birth certificate to confirm the child’s age, but there’s no need for a Social Security number.
Even supermarkets, drug stores and other businesses with loyalty programs, such as airlines, sometimes ask for your number on the application. You should just leave it blank.
If these entities insist on having the number, ask why. Find out what they use it for, where they keep it and how they plan to protect your information. Even if they say they have a solid plan, remind them that hackers are pretty talented at getting into all kinds of supposedly secure networks, and laptops can get lost or stolen.
If that doesn’t work, ask what will happen if you refuse to provide your number, and ask the entity to show you what law requires you to hand it over.
Chances are? The entity won’t be able to.
You could offer to negotiate and see if they will agree to an alternate identifier or password.
That’s the new trend among colleges, which have traditionally used Social Security numbers to identify students. Sure, schools need a Social Security number for financial aid purposes, but there’s no need for the number to be used by the student all over campus. Instead, many have created different kinds of ID numbers.
Many, but not all.
New Jersey schools, thanks to the law, are among those who have taken on the change.
NJSA 18A:3-28 says higher education institutions may not display any student’s Social Security number to identify that student for posting or public listing of grades, on class rosters or other lists provided to teachers, on student identification cards, in student directories or similar listings, unless otherwise required in accordance with applicable state or federal law.
Levin says this appears to be a very strong privacy law in favor of students, and he called it a clear and unambiguous warning to higher education.
Importantly, the law also does not allow the school to nullify the rule, even if a student signs a consent form or waiver, Levin said.
“In our age of mandatory binding arbitration, this is an absolutely amazing protection for student privacy rights,” he said.
PIRG’s Mierzwinski said that it shouldn’t be that hard for all schools to come up with another alternative student identifier.
“Colleges, despite teaching computer science and having computer science departments, do not appear to be immune to hacks,” he said. “Most state’s departments of motor vehicles have gone beyond the Social Security number, so why can’t colleges?”
Have you been Bamboozled? Reach Karin Price Mueller at Bamboozled@NJAdvanceMedia.com. Follow her on Twitter @KPMueller. Find Bamboozled on Facebook. Mueller is also the founder of NJMoneyHelp.com.