EDD Audit Confirms CBS13 Investigation - Calls On EDD To Stop Putting Millions At Risk Of Identity Theft
SACRAMENTO (CBS13) - Following four years and dozens of CBS13 reports, a permanent fix is finally in the works to prevent state agencies from mailing your social security number. This follows a state audit of the Employment Development Department (EDD) that found the agency has been putting millions of Californians at risk of identity theft.
Follow Our Continuing Coverage
CBS13 Investigates EDD Identity Theft Concerns
The audit, that was prompted by a CBS 13 investigation and found the EDD mailed 17 million documents with full Social Security numbers (SSNs) printed on them in 2018. State law prohibits mailing SSNs unless required under a different state or federal law. The audit found no law that requires the EDD to mail SSNs, despite the agency's repeated claims to the contrary.
The audit also found the agency will compromise at least another 13 million people this year, including some of the state's most vulnerable – people collecting unemployment, disability, and maternity leave benefits.
The EDD has long defended its practice of mailing SSNs by claiming there is no evidence that anyone has ever been harmed. However, we've heard from dozens of viewers over the years who complained of everything from misdirected mail to mail theft involving EDD documents.
"Someone knew that my document might give them a social security number to sell," Mary Shaw told CBS13 after one of her EDD documents went missing from the mail.
ALSO READ: Audit: EDD Put Millions At Risk Of Identity Theft
The seasonal tax preparer often has to advise her clients of the risk of mailing sensitive documents. That's why she was so frustrated to find that, despite her best efforts, the EDD compromised her security by mailing her full SSN along with other sensitive information.
Mary uses a mail tracking service that emails her images of every document that leaves the post office. That's how she discovered one of her EDD documents never arrived. The incident forced her down the time-consuming and costly road of credit monitoring and fraud alerts.
"That's a lot of work and it's ongoing," Mary complained.
Mary is not alone. Another viewer, Whitney, also contacted us after a mail-theft incident involving EDD documents and a viewer named Nichole sent us photos of an EDD envelope where her SSN was on full display through the envelope's window.
CONTINUING COVERAGE: "California Un-Confidential"
CBS13 Investigates: EDD Identity Theft Concerns
-
- July 7, 2015
State Employment Development Dept. Puts Millions Of Californians At Risk For Identity Theft - July 20, 2015
California Lawmakers Demand Change To EDD Practice Of Putting Social Security Numbers On Documents - October 5, 2015
California EDD Stops Printing Full Social Security Numbers On Mailers Following KPIX5 (CBS13) Reports - May 18, 2016
Americans Collecting Disability And Unemployment At Risk Of Identity Theft - January 29, 2018
California Agency Still Making ID Theft Easy By Mailing Out Social Security Numbers - May 29, 2018
Why California Continues To Put Millions At Risk Of ID Theft: The EDD Responds - August 12, 2018
Lawmakers order EDD Audit Following KPIX (CBS13) Investigation - March 29, 2019
Audit: EDD Put Millions At Risk Of Identity Theft - April 2, 2019
EDD Audit Confirms CBS13 Investigation - Calls On EDD To Stop Putting Millions At Risk - July 26, 2020
Coronavirus Unemployment: Will Another Audit Fix the EDD? - September 15, 2020
Coronavirus Unemployment: Is The EDD Putting People At Risk Of Identity Theft?
NOTE: CBS13 Investigative Reporter Julie Watts was based at the CBS San Francisco station (KPIX) when this investigation began and has continued the work after moving to CBS Sacramento. The stories have aired on CBS stations across California.
- July 7, 2015
The Howards were among many to report that the EDD mailed them other people's sensitive EDD documents.
"I was like, 'How in the world did this piece of paper get into an envelope addressed to me?'" Jody Howard said.
The audit documented several similar, known security incidents involving mass printing or mailing errors by the EDD.
According to Postal Inspection records, there are hundreds of recent complaints specifically citing compromised EDD documents. However, the auditor pointed out that there are likely many more victims because most people who are compromised will never know that it was due to an EDD document.
Lawmakers first demanded the agency stop printing the numbers after seeing our reports back in 2015. In response, the EDD vowed to remove all SSNs from mailings by the end of the year. The agency also claimed in a follow-up email to CBS13 that there were new "online options that did not require the mailing of documents."
However, in 2018, CBS13 discovered the EDD was not only still mailing SSNs, but they were mailing them to EDD customers who enrolled in online services and asked not to receive paper mail.
We brought our findings back to lawmakers in 2018 and Assemblywoman Catherine Baker (ret.) requested an audit of the EDD, citing our findings and the EDD's unwillingness to abide by state law.
EDD Director Patrick Henning fought hard to keep the auditor out of his office, defending his agency's ability to handle the issue themselves.
"We are the best at keeping people's information private," Henning told lawmakers.
The EDD has a history of audits under Director Henning, who set up private meetings with committee members to try to avoid yet another audit. When questioned about the meetings, Henning told CBS13 he simply felt the state had "other priorities."
Lawmakers on the Joint Legislative Audit Committee disagreed with Henning's assertion and voted unanimously to embed the state auditor inside the EDD for five months. The audit confirmed that the EDD had no plans to stop printing SSNs for at least another five years.
It also found that, although at least half of the people who sign up for EDD benefits online request not to receive paper documents in the mail, the EDD continues to send them paper documents with their full SSN.
"The state has an obligation to protect the personal information we receive," said Margarita Fernandez, a spokesperson for the auditor.
The audit outlined a plan for the EDD to stop printing social security numbers on the most frequently mailed documents within the year and remove them entirely from all documents by 2021. It also called on lawmakers to amend state law and prevent any agency from mailing these numbers in the future.
UPDATE: Assembly Member Chad Mayes (I-Palm Springs) has introduced legislation in response to the audit.
While it is already illegal to mail someone's Social Security number, AB-499 would add a financial penalty for state agencies that chose to ignore the existing law.
If passed, any time EDD prints someone's full Social Security number on a mailed document, the agency would be required to pay for identity theft protection and mitigation services for that person — whether or not the document is compromised.
The act of mailing the SSN would trigger the penalty and, considering the EDD mails millions of SSNs a year, it is unlikely the agency could afford the penalty and would be forced to finally stop printing SSNs.