4

If a hacker were to get the last 4 digits of your SSN (and maybe some other info like name, etc), what could they do?

To avoid the possibility that they could guess the other digits from date/location of birth and only focus on what they could do with the last 4, assume the person was not born in the US.

| improve this question | |
  • They can search dozens of databases of leaked info to see if they find a match. There are a max of 100,000 unique values in the remaining 5 digits (3+2) numeric digits. So if they know anything else they can narrow it down even further. If they know the first letter of your first name, now 25 other letters can be excluded. Two letters 674 combinations can be excluded and so forth and so on. – cybernard Nov 20 '17 at 13:23
  • I just used the last 4 digits of my SSN to activate a debit card, it was literally the only thing other than the card itself needed – Richie Frame Nov 23 '17 at 1:26
2

Far too many places use the last 4 of a SSN for customer support representative (CSR) validation. It's supposedly one of those "pieces of information" only you would know, but, sadly, is more often better known that we'd like to think. It can then be used as part of a social engineering attack to gain access to, or control of, an account. Here's an account of how something similar was used to gain control of a reporter's Apple account and wipe all his devices.

As Honan explained, Amazon allowed users to add a credit card number to an account simply by calling Amazon and providing a name, e-mail address, and billing address. After hackers used this method of adding a credit card number to Honan's account, they hung up—and then called Amazon back to claim they'd lost access to the account. At this point, they provided the fake credit card number, convincing Amazon to let them add a new e-mail address to the account. The next step was going to the Amazon website and requesting that a password reset e-mail be sent to that e-mail address. From there, the hackers could view the last four digits of Honan's credit cards on Amazon's website.

With those four digits (and Honan's username and billing address), hackers convinced Apple to send a temporary password that let them take over his iCloud account and wreak all sorts of havoc. "The very four digits that Amazon considers unimportant enough to display in the clear on the Web are precisely the same ones that Apple considers secure enough to perform identity verification," Honan wrote.

I can't tell you how often I've had a CSR just take the last 4 of my social as proof that it's me.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.