I am designing a web site that contains external suppliers to register and keep their information with the company up to date. We already have a db with EIN, SSN numbers and their addresses.
One of the enhancements users wanted is to display a list of addresses when a known ein/ssn is entered during registration.
This avoids creating a duplicate address in the back end for the same address. It also gives them a more fluid registration process. Architect is objecting to this on the grounds of security.
I can implement a lock feature if you enter more than 3 unsuccessful attempts at guessing ein/ssn, your account is locked for an hour/day.
Is this good enough? Any alternative ways you can think of without letting somebody try ssns and display addresses. Are there any established standards?