Hacker News Reader

Comment by bullseye | Hacker News Reader

I wrote an application for a banking client a few years ago that required a valid SSN. In addition to using the information available on ssa.gov to check the validity of a number, I built a simple filter to exclude valid, but otherwise fraudulent numbers. While none of the steps I took are a bulletproof measure against identity theft, they do lighten the load a bit.

I cross-referenced the SSN death index to ensure dead people had not risen from the grave to apply for credit. I also excluded the popular "fake" SSNs used in advertising (http://en.wikipedia.org/wiki/Social_Security_number#SSNs_inv...), and I most definitely added Todd Davis's number to the list. This last step seemed like a no-brainer given all of the publicity at the time.

While I can understand a small boutique store not going to those lengths to prevent a fraudulent account, I am a little surprised that AT&T and Verizon were among the casualties.

View on HN

A lot of identity theft occurs when people just make up an SSN and use it to gain employment or credit. If they are lucky, the credit file doesn't exist yet and no one is the wiser.

The "theft" part occurs when someone is assigned that SSN starts using it and finds out that they have $300,000 in bad loans on their credit file. This is usually a kid who is applying for student loans or their first car loan. Then they must spend time/money cleaning up their credit file.

http://news.debix.com/index.php/2008/11/teenager-tarnished-b...

Discolsure: I'm a former employee and current investor in Debix.

Years ago when I first set up my bank account with a big bank(I believe I was 13?), they transposed two of the numbers in my SSN. Ten years later, this mistake was finally caught when somebody attempted to set up an account using their correct SSN, which conveniently was my mistaken SSN.

And that's when I realized how easy it is to steal a person's identity.

According to the SSNVS service information, you are supposed to only use this information for correctly completing IRS W-2.

Verifying the SSN using that service for banking (as I'm reading it) is a clear violation of the system.

Reference (http://www.ssa.gov/employer/ssnvshandbk/ssnvs_bso.htm)

If you were using a different service I'd be interested, as we are always looking for new ways to do validation of accounts.

That was my argument against printing it on my military id. Ignored, of course.

We weren't able to use the online verification service , which is the reason I wrote the program I described. It didn't validate a "good" SSN, but rather filtered out bad ones.

http://www.ssa.gov/ and http://www.socialsecurity.gov both have a lot of useful information about structure and allocation of SSNs if you are looking to do something similar.

Apparently AT&T and Verizon wanted Todd Davis's business ;-)

Its interesting you could do all this with a SSN. The program I mean. If you can do this easily, then why can dead people still vote... I am being serious.

Voter rolls do not contain your SSN (since volunteers man the registry at polling stations it is considered bad form to put something like this on a list that may just walk out the door at the end of election day.) Voter rolls contain name and address at time of registration or last update to registration. These registries are occasionally purged of dead people when possible, but the risk (a few "dead" people voting) is considered slight compared to the cost of keeping the registry up to date or of disenfranchising someone by mistakenly deciding that they were dead.

> These registries are occasionally purged of dead people when possible, but the risk (a few "dead" people voting) is considered slight compared to the cost of keeping the registry up to date or of disenfranchising someone by mistakenly deciding that they were dead.

Reply on news.ycombinator.com