California Agency Still Making ID Theft Easy By Mailing Out Social Security Numbers
SAN FRANCISCO (KPIX 5) -- Two and a half years ago, after a KPIX 5 investigation revealed the state was putting millions at risk for identity theft, officials promised changes.
However, ConsumerWatch reporter Julie Watts recently learned just how little has changed and California lawmakers on both sides of the aisle are furious.
"Don't put your outgoing mail in a mailbox ever. If they see a flag up, it's gone," warned convicted identity thief Cheryl Thrasher.
She told ConsumerWatch all she needed to empty bank accounts, open credit cards and commit crimes in a victims' name was one piece of mail with a social security number.
"It's easy. It's fast and it's a fast come-up," explained Thrasher.
That is the reason most government agencies, banks and even universities stopped using social security numbers as identifiers years ago.
In fact, in 2010 California, passed a law that prohibits printing the number "on any materials that are mailed."
But as KPIX 5 first reported in 2015, viewers like Maxine Hines were horrified to discover the state was still printing full social security numbers on documents mailed out to millions of Californians collecting benefits for unemployment, disability and maternity leave.
"I couldn't imagine why the state of California wouldn't protect the people who live here!" exclaimed Hines.
When she called the Employment Development Department to complain about the massive security risk, she was not pleased with the response the agency gave her.
"She kinda laughed a bit and said, 'Yeah, a lot of people complain,' said Hines.
The Employment Development Department administers benefits to over a million people a year and the Federal Trade Commission's David Newman says envelopes containing such sensitive information are a known target for crooks.
"Anything that's coming from a state agency is likely to be a signal to an ID thief that there might be something useful inside," said Newman.
The EDD was unapologetic when KPIX 5 first questioned the agency about why it was mailing full social security numbers.
First, the EDD said, "It is not administratively feasible to print only the last four digits" and argued that the agency is exempt from state law -- which prohibits mailing the numbers -- because federal law requires they "use social security numbers."
However, The Social Security Administration confirmed to ConsumerWatch that there is no law that requires the state print the numbers on mailed documents.
When Watts pointed that out to the EDD, the agency then pointed to a different state law that says it can disclose "personal information…to the individual to whom the information pertains."
Though the EDD appeared to be violating that law too when several viewers who saw our stories said they had received other people's EDD documents with full social security numbers in the mail.
"How in the world did this piece of paper get into an envelope addressed to me? asked Jody Howard, who told KPIX 5 she received someone else's EDD paperwork.
The agency said it has no mechanism to track how often that happens but KPIX heard from several viewers who'd received others people EDD documents.
After seeing our reports in 2015, members of the Assembly Privacy and Consumer Protection Committee demanded the agency stop printing the numbers.
"I think everybody who saw your story would agree it's common sense; don't put a social security number on a piece of correspondence you send through the mail," said then Democratic State Assemblyman Mike Gatto.
"My immediate reaction, beyond shock, was we gotta fix it," echoed Republican Assemblywoman Catherine Baker in 2015.
The EDD said it would immediately stop printing the numbers on forms that did not "impact program efficiency," like bi-weekly continued claim forms, and promised it would stop printing the numbers on other documents pending approval for more funding.
But now -- more than two years later -- the agency got the funding it asked for to make the fix yet it continues to print full social security numbers on millions of mailed documents. And, KPIX 5 has learned the agency has no immediate plans to stop printing social security numbers.
When Watts returned to Sacramento this month to share the update - or lack there of - with current members of the Privacy and Consumer Protection Committee, legislators were outraged.
"Well, I think it's really appalling," said Assemblywoman Jacqui Irwin. "There's just no excuse to wait that long to remove social security numbers from mailed documents."
Assemblywoman Irwin was shocked to learn that instead of fixing the security risk now, the EDD wants to wait for a complete overhaul of its system.
That project is not even slated to begin until sometime after 2020.
In the meantime, the agency has been urging people to enroll in online services to avoid getting sensitive information in the mail. However, ConsumerWatch reporter Watts is enrolled in online only and is still getting documents in the mail with her full social security number on a regular basis.
Irwin struggled not to laugh when Watts explained which documents the EDD says it can't stop mailing - or printing her social security number on.
While on her recent maternity leave, Watts was enrolled in the EDDs online services and direct deposit, so she was already notified of each disability payment in two places online -- where her social security number is redacted. However, the EDD still mailed her a duplicate paper statement with her full social security number exposed and clearly labeled in two spots every two weeks. According to the agency, "An individual cannot request that the EDD discontinue printing their SSN."
Assemblywoman Catherine Baker was among the members who demanded a fix over two years ago. Today, she is understandably exasperated.
"We went to the moon over 40 years ago. We've got Silicon Valley right in our backyard in the Bay Area," said Baker. "Trying to redact social security numbers in mail that goes to your mailbox is not rocket science. They need to be able to get it done."
So now she is suggesting withholding funding from the agency until it can figure out a temporary fix.
"Clearly this is an agency that is having a hard time complying with the most basic elements of technology," said Baker. "That's where we have got to step in. You give them a chance to do it. They can't get it done."
Both Baker and Irwin now have meetings scheduled with officials from the EDD.
Meanwhile, the postal inspector confirms more mail fraud complaints come from California than any other state. And mail theft is on the rise.
KPIX 5 asked the EDD for an update on the issue more than three weeks ago. The agency finally provided a response just before the story aired stating:
"EDD has made significant progress in its major efforts to remove Social Security Numbers as an identifier in its systems. The department is in its second year of a long-term project to replace its current benefit systems. This project includes an integrated identity management system that does not use SSNs or other personal identifying information.
In the meantime, we have taken action to reduce the use of our customers' identifying information on forms and have moved millions of individuals to online services."
However, the agency did not address why those people enrolled in online services are still being mailed unnecessary documents - like duplicate deposit statements - that display their clearly labeled social security numbers.
[NOTE: This story was updated to include additional information.]