Could your pre-schooler be in foreclosure on a home in another state? Could your eight-year-old have racked up nearly $8,000 in student loans? What about $7,500 in credit card balances? It doesn't sound possible—but these are just some of the stories told by victims of child identity theft.
With no criminal records, no credit history, and Social Security numbers that have never been used to apply for jobs or file taxes, children make extremely attractive identity theft targets. A 2012 study published by AllClearID found that minor children are 35 times as likely to be victims of identity theft as adults. And the Center for Identity's research shows that for children, the Social Security number is the most valuable—and therefore most vulnerable—identity attribute.
A Universal Identifier
When the Social Security Act was signed into law in 1935, the role of a Social Security number was very different than today. “Social Security numbers were created to keep an accurate record of an individual's earnings, so that the employer, the Internal Revenue Service, and the Social Security Administration (SSA) could work together to keep track of them," says Sarah Schultz-Lackey, regional communications director for the SSA's Dallas area. “The SSN was never meant to be a universal identifier, but unfortunately, that's what it is right now. People are using the number for all kinds of purposes it wasn't meant for, and that has made it much more valuable."
The Center for Identity's Identity Threat Assessment and Prediction (ITAP) tool backs up Schultz-Lackey's statement. Different identity attributes have different values and different levels of risk of exposure; the Social Security number is both the most sought-after by thieves and has the largest financial impact when stolen. This is changing when it comes to adults' Social Security numbers, however. A 2014 study by Javelin found that data breaches have driven down the price of stolen credit and debit card data, making that information more attractive to cyberthieves. In 2013, only 16 percent of those whose Social Security numbers were exposed became fraud victims, as opposed to 39 percent of those whose credit or debit card information was breached.
Children at Risk
When it comes to children, however, the Social Security number is still the cyberthief's greatest prize. The AllClear ID study, which scanned the accounts of 27,000 children, found that 2,875 of them—nearly 11 percent—had someone else using their Social Security numbers.
“People use [stolen SSNs] to open bank and credit card accounts, to get loans, and to pay for utilities and rent," says the SSA's Schultz-Lackey. “We've also seen people illegally working under children's Social Security numbers."
Many children have multiple fraudsters using the same Social Security number over periods of years. One victim in the AllClear ID study discovered at age 19 that her Social Security number had been in fraudulent use for a decade, at a cost of nearly $1.5 million.
The advice most often given to parents concerned about identity theft is to monitor their child's credit report. While it's true that this can help—for a child whose Social Security number is not in use, the existence of any credit report activity is a red flag—it doesn't catch every thief. A credit report only checks a number's history in relation to one name and birth date; in many cases, fraudsters attach a stolen Social Security number to completely different identity attributes. A credit check on your child's name in this instance would turn up nothing.
Still, credit monitoring is worth it, particularly if you set up a fraud alert with the credit report agencies. With an alert in place, anyone who tries to use the number (including the number's owner) must further verify their identity before they're able to take out a loan, set up utilities, and so on. Once you set up a fraud alert with one credit reporting agency, they will notify the others at your request. Fraud alert is good for three months, after which you can choose to renew it or let it expire.
Keeping the SSN Safe
Security experts say that reducing our near-ubiquitous use of the Social Security number might make it less valuable and less vulnerable. “If you feel that a company or organization is unnecessarily asking for your child's SSN, you can politely refuse and ask if there is other information that you can provide instead," says Bill Carey, vice president of marketing for Siber Systems, publisher of a password management software called RoboForm.
The SSA's Schultz-Lackey agrees. “We always tell people to stop and think, 'What is my privacy worth to me?' Ask how that information will be used and why it's needed," she says. “Although companies have the right to refuse service if they ask for a Social Security number and you decline to give one, we have found that many times the company will agree [to accept other information instead]."
The medium matters, too. Both Schultz-Lackey and Carey warn that giving a Social Security number via the Internet can be risky. According to Schultz-Lackey, people often fall victim to websites cleverly disguised as official government sites. “Make absolutely certain that the address ends in .gov, not .com or .org," she says. For his part, Carey advises parents to forego the Web altogether when it comes to Social Security numbers.
If you choose to give a Social Security number over the phone, similar cautions apply. As Schultz-Lackey points out: “The government will never call you looking for this information. We contact by mail, because it's more secure, and we always include a phone number and address in the letter. Look up the phone numbers. Ask questions. We're as interested in protecting your information as you are."
“The world of technology is a wonderful thing," she finishes, "but it has opened up another portal for thieves, and everyone needs to be vigilant. The number of people committing fraud is very low—but those people are very busy."
—Tricia C. Bailey
The Center for Identity's ongoing research is always providing new insights on the best ways to protect your children from identity fraud and abuse. Subscribe to our IDWise e-newsletter to stay on top of threats and best practices.