The last four digits of your social security number
Because of identity theft and privacy concerns, many businesses ask for only the last four digits of our Social Security numbers. There seems to be an assumption that only four digits of a nine-digit-number shouldn’t be a concern.
“How hard would it be for someone to guess the first five digits of my Social Security Number if they only had the last four?”
The obvious answer is, about 9,999 times easier than if they didn’t know the last four.
In fact it’s even easier than that. Your Social Security number is not a random set of digits. The last four numbers are created sequentially. They have no other relation to you. The rest of your Social Security number, however, is determined by where you requested it; usually, this is where you were born.
The first three digits of your Social Security number are an “area number”. If someone can determine what area the person applied for the SSN in, they can determine the first three digits; it is currently based on zip code. There are currently no more than 772 area codes.
You can check the state ranges against your SSN at the Social Security Number Allocations page on the Social Security Administration web site.
The middle two digits are the “group number”. This is probably more difficult to determine, but they are distributed in a pattern. In any case there are only 99 of them, usually less. For any specific area code, the Social Security Administration publishes the highest group number used.
There are also some other Social Security numbers that have been invalidated. For example, if the last four digits are 1120, identity thieves know at least one area code/group number combination that it is not.
When you give out the last four digits of your Social Security number, you are giving out what is probably the least-easily determined part of it. Once a criminal has the last four, if they truly want your identity (as opposed to just anybody’s identity), they ought to be able to bring down the total possibilities to no more than several hundred.
Giving out the last four digits of your Social Security number makes your entire number a lot more vulnerable. Armed with a computer and an on-line authorization site that doesn’t care if an SSN is checked every day, they probably won’t have any problem finding the rest. Your only hope is that they won’t want to.
- January 18, 2010: Tumbling to SSN privacy
-
Being right isn’t always satisfying. In June 2006, I wrote:
Giving out the last four digits of your Social Security number makes your entire number a lot more vulnerable. Armed with a computer and an on-line authorization site that doesn’t care if an SSN is checked every day, they probably won’t have any problem finding the rest. Your only hope is that they won’t want to.
Hadley Leggett interviewed privacy researcher Alessandro Acquisti in a July 2009 article on Wired:
There’s only a few short steps between making a statistical prediction about a person’s SSN and verifying their actual number, Acquisti said. Through a process called “tumbling,” hackers can exploit instant online credit approval services—or even the Social Security Administration’s own verification database—to test multiple numbers until they find the right one.
And that was without having the last four digits. Social Security Numbers should never have been used as a combination username and password.
- Social Security number (Wikipedia)
- “The SSN is frequently used by those involved in identity theft, since it is interconnected with so many other forms of identification, and because people asking for it treat it as an authenticator. It is generally required by financial institutions to set up bank accounts, credit cards, and obtain loans, partially because it is assumed that no one except the person to whom it was issued will have it. Ironically enough, Social Security cards used to have the caption ‘Not for identification’, indicating that the cards and their number are not intended to be a form of identification.”
- Social Security Number Allocations
- “The first three (3) digits of a person’s social security number are determined by the ZIP Code of the mailing address shown on the application for a social security number.”
- High Group List of SSNs
- “This list shows the SSN area and group numbers that are in the process of being issued as of the date at the top of this page.”
More social security numbers
- Tumbling to SSN privacy
- Guessing social security numbers based on the statistical analysis I talked about in “The last four digits of your social security number” now has a name: “tumbling”.
More security
- Form validation with in_array in PHP
- When validating form input, you often will use an array of valid responses. Watch out if some of those valid responses are integers!