Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
If a hacker were to get the last 4 digits of your SSN (and maybe some other info like name, etc), what could they do?
To avoid the possibility that they could guess the other digits from date/location of birth and only focus on what they could do with the last 4, assume the person was not born in the US.
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
Far too many places use the last 4 of a SSN for customer support representative (CSR) validation. It's supposedly one of those "pieces of information" only you would know, but, sadly, is more often better known that we'd like to think. It can then be used as part of a social engineering attack to gain access to, or control of, an account. Here's an account of how something similar was used to gain control of a reporter's Apple account and wipe all his devices.
As Honan explained, Amazon allowed users to add a credit card number to an account simply by calling Amazon and providing a name, e-mail address, and billing address. After hackers used this method of adding a credit card number to Honan's account, they hung up—and then called Amazon back to claim they'd lost access to the account. At this point, they provided the fake credit card number, convincing Amazon to let them add a new e-mail address to the account. The next step was going to the Amazon website and requesting that a password reset e-mail be sent to that e-mail address. From there, the hackers could view the last four digits of Honan's credit cards on Amazon's website.
With those four digits (and Honan's username and billing address), hackers convinced Apple to send a temporary password that let them take over his iCloud account and wreak all sorts of havoc. "The very four digits that Amazon considers unimportant enough to display in the clear on the Web are precisely the same ones that Apple considers secure enough to perform identity verification," Honan wrote.
I can't tell you how often I've had a CSR just take the last 4 of my social as proof that it's me.
