Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Up until recently I was under the impression that the social security number was insufficient information to perform identity theft, and that in practice you will at least need the victim's SSN and name.

However, recent events and stories have made me start questioning this assumption. Is knowing only the social security number sufficient enough for someone to steal an identity? Would it be possible (or realistic) if you also took into account potential social engineering attacks, presumably against state agencies, which could reveal additional private information through leveraging the known SSN?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Absolutely!

The thing to remember is that a social engineering attack, when played out well, can be successful given no personal information other than a name or a role or a position.

The more information an attacker knows about a target, the easier it is for them to build a convincing scenario, but SSN's are trusted as a key piece of your identity in the US, so they are very vulnerable.

share|improve this answer
1  
But theoretically, if there were a SE vector, couldn't someone just start guessing arbitrary SSNs (while following the typical structure for state/age/regions) to just steal a massive amount of data? –  Moses Nov 7 '12 at 19:11
    
Yes. The variable is how difficult an attack is. With just one piece of information you would need a lot of work to persuade staff to divulge other info. If you already have enough to be convincing it gets much easier. –  Rory Alsop Nov 7 '12 at 19:13
    
The trick is that you usually need to know the person's name and SSN as a minimum, and often a date of birth too. As such, randomly guessing SSNs doesn't really make much sense. –  Polynomial Nov 7 '12 at 22:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.