With the recent hack at Equifax where names, addresses, SSNs, etc are now likely in the hands of criminals, would changing one's last name be protective from impersonation similar to how one would change one's password if it is compromised?

This assumes that Equifax has cleaned up its vulnerability and thus if your last name is registered as one that is different from the one in the hands of criminals, the criminals using one's old last name wouldn't get past the first page of say a credit card application.

Same protection would apply for changing one's address. Of course the SSN can't be changed unfortunately.

Is this sound reasoning or is there some obvious factor I'm overlooking?


It sounds like an idea, but there is a few things that I want to point out here,

Changing a last name officially takes a while

It really does take a while, please see this link. It also depends, if you have like a thousand employees, would you make all of them fill out the form and wait for a response from the SSA? Would it be convenient? You should answer that question yourself.

Second and most important, social engineering attacks

After you've done the first process, it comes to securing the last names from the attackers since they already have all of the information about the workers but the last names.

It is very easy to get the last names under this circumstance

When your workers are out to get a drink, the attackers could act like a friend, start a conversation, ask to see their ID that they don't believe their age, and they could see the new last name there. Or the easiest, just ask for their full name.

They could steal their wallets,

follow them home, hack their personal pcs in their houses and know what they're all up to from there.

There is also tons of social engineering attacks that could be made to know the last name of a person. It is easy.

So as an answer, no it is not worth it but it may depend. You could change the last name of a CTO or some high ranked worker, and tell him about the situation, so that he is very very very much careful on not giving away any info to a stranger. He should not be pulling out his ID in public. That's how it could be reasonable from my point of view.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.