Holding EDD Accountable for Identity Theft: Lawmakers Pass New Law Citing 5-Year CBS13 Investigation
SACRAMENTO (CBS13) — Citing a five-year CBS13 investigation, lawmakers passed a bill that will force the Employment Development Department (EDD) to stop putting people at risk of identity theft by mailing full Social Security numbers (SSN).
It is already against the law to mail a SSN, but for years, the EDD has claimed it was exempt from the current law. The governor signed the bill Friday, clarifying that EDD is not above the law, amid new concerns over wide-spread pandemic-related EDD mail theft and fraud.
Follow Our Continuing Coverage
CBS13 Investigates EDD Identity Theft Concerns
When CBS13 first asked the Employment Development Department what it would take for them to stop mailing full Social Security numbers in violation of state law, the media representative at the time laughed and said the law didn't apply to state agencies. She added that nothing we could report would change that.
Now, after five years, countless victims and more than a dozen investigative reports that prompted a joint legislative hearing and a state audit, this law finally makes it clear to the EDD, and every state agency, that they are not above the law.
Years of Outrage and Concern
From consumer advocates to the Federal Trade Commission, our findings over the past five years have sparked outrage and concern.
"I think everyone who saw your story would agree that it's common sense, don't put a social security number on a piece of correspondence sent through the mail," Assemblyman Mike Gatto said in 2015.
Following our initial reports, lawmakers in the Assembly Privacy and Consumer Protection Committee first demanded the EDD stop mailing full social security numbers back in 2015. The agency said it would by the end of the year.
In 2016 CBS13 learned EDD was still printing full SSNs on disability documents. In 2017, CBS13 Investigative Reporter Julie Watts discovered her own SSN printed on her own EDD documents for Paid Family Leave while she was on maternity leave. Watts had opted into the EDD's "online only" option, but EDD said she could not opt out of receiving duplicate mailed statements with her full SSN.
That story let to a Joint Legislative Audit Hearing in 2018 and a scathing report by the California State Auditor in 2019.
However, five years after the initial reports, the EDD continues to print full SSNs on documents sent to millions of Californians in violation of state law.
Now, amid the pandemic, the issue may impact more than a quarter of all Californians as a record number of people are applying for unemployment, disability or paid family leave due to COVID-19.
The Risk
EDD documents contain enough information to steal someone's identity and their benefits. "It's easy, its fast and it's a fast come up," convicted identity thief Tiffany Thrasher explained during a jailhouse interview.
Because the EDD is mailing full SSNs, one EDD document may contain enough information for a crook to steal someone's identity, apply for credit in their name, file false tax returns and even commit Social Security and Medicare fraud using their social security number.
For the victim, identity theft mitigation can be a life long process because you never know when or where a crook may try to use your stolen identity. For some types of fraud, that doesn't appear on your credit report, you may not realize you've been compromised for years.
In many cases, identity thieves will wait a while before using a stolen identity in hopes that the victim has let their guard down.
EDD's Victims
CBS13 has heard from countless viewers over the years with identity theft concerns related to EDD documents.
"Someone knew that my document might give them a Social Security number to sell," said Mary Shaw, a seasonal tax preparer.
Shaw was forced down the costly and time-consuming road of identity theft protection after her EDD documents were compromised. "And that's a lot of work and it's ongoing," Shaw pointed out.
Whitney was among many other viewers with EDD mail theft issues.
Nicole's SSN was on full display in the envelope window.
Several, like the Howards, got other people's sensitive documents along with their own documents. "How in the world did this piece of paper get into an envelope addressed to me?" Jodie Howard wondered during a 2015 interview.
When Maxine Hines, a former IRS employee, called the EDD to complain about identity theft concerns, "they kinda laughed a bit and said, 'yeah a lot of people complain,' " Hines said.
New Pandemic EDD Mail Theft Concerns
Now, amid the pandemic, there are new concerns of wide-spread EDD-related mail theft and fraud.
People across the state are finding their mailboxes stuffed with EDD documents that list their address with other people's names.
As the EDD explained in a recent press release: "(P)erpetrators are often using stolen identity information from national and global data breaches," to apply for benefits in other people's names. According to the EDD, "scammers will often try to intercept, redirect, or gather mail associated with these claims," putting people at greater risk of mail theft.
CBS13 has also heard from many viewers who applied for EDD benefits but their EDD debit cards were stolen or never arrived. Someone intercepted and activated their cards, drained their unemployment funds and, in some cases, re-routed their mail to a new address so they didn't realize they'd been compromised right away.
Call center reps tell CBS13, while there are as many as 6 identifiers they can request to very someone's identity, some only use the SSN. All a crook might need to activate a stolen debit card and change someone's forwarding address is one EDD document with their social security number.
CONTINUING COVERAGE: "California Un-Confidential"
CBS13 Investigates: EDD Identity Theft Concerns
- July 7, 2015
- State Employment Development Dept. Puts Millions Of Californians At Risk For Identity Theft
- July 20, 2015
California Lawmakers Demand Change To EDD Practice Of Putting Social Security Numbers On Documents - October 5, 2015
California EDD Stops Printing Full Social Security Numbers On Mailers Following KPIX5 (CBS13) Reports - May 18, 2016
Americans Collecting Disability And Unemployment At Risk Of Identity Theft - January 29, 2018
California Agency Still Making ID Theft Easy By Mailing Out Social Security Numbers - May 29, 2018
Why California Continues To Put Millions At Risk Of ID Theft: The EDD Responds - August 12, 2018
Lawmakers order EDD Audit Following KPIX (CBS13) Investigation - March 29, 2019
Audit: EDD Put Millions At Risk Of Identity Theft - April 2, 2019
EDD Audit Confirms CBS13 Investigation – Calls On EDD To Stop Putting Millions At Risk - July 26, 2020
Coronavirus Unemployment: Will Another Audit Fix the EDD? - September 15, 2020
Coronavirus Unemployment: Is The EDD Putting People At Risk Of Identity Theft?
It's Already Illegal to Mail SSNs
Current state law prohibits mailing a Social Security number "unless state or federal law requires" it. For years, the EDD claimed it was required to mail Social Security numbers.
EDD initially said, "It is not administratively feasible…to print only the last 4 digits…" adding that the Federal Social Security Act requires it "to use Social Security numbers in the administration of its programs."
However, the Social Security Administration confirmed in 2015 that the EDD is not required to print the numbers on mailed documents.
The EDD later cited several state laws that gave the EDD director the ability to "permit the use of any information in his (or her) possession to the extent necessary." However, the laws do not "require" that they mail the number.
The state auditor later confirmed our findings that the EDD is not "required" to mail full SSNs under state or federal law. In short, they are in violation of the law that prohibits mailing SSNs.
Five Years, a Hearing and an Audit
In 2018, Spokesperson Loree Levey said the EDD was "not aware of any cases where its forms (led to) identity theft" adding that claimants were rarely compromised.
However, postal inspection records obtained by CBS13 following that interview revealed hundreds of recent mail thefts involving EDD documents.
So, three years after EDD first claimed it had already stopped mailing Social Security numbers, CBS13 took our finding back to lawmakers and Assemblywoman Catherine Baker summarized our reports before a bi-partisan Joint Legislative Audit Committee.
CBS13 learned that the EDD director met privately with committee members ahead of the hearing to try to convince them to deny the audit. Instead, the committee voted unanimously to embed the State Auditor inside the EDD to examine why the EDD had failed to redact the SSNs and what could be done to immediately stop mailing the full numbers.
The audit, released in 2019, read like a compilation of our reports and confirmed our findings including that the EDD was aware people had been compromised and that it's not required to mail Social Security numbers.
A Law to Stop EDD From Breaking the Law
The auditor recommended lawmakers "amend state law to require all state agencies to develop and implement plans to stop mailing documents that contain full SSNs to individuals by no later than December 2022." The recommendations outlined a multi-step process to help agencies come into compliance.
"You've been reporting on this for five years, Assemblymember Chad Mayes said in an interview with CBS13 investigative reporter Julie Watts earlier this year. "It should have already been fixed so we're gonna put a law on the books to make it abundantly clear that they can't keep doing this practice."
Mayes authored the bill that was recommended by the auditor.
"With all of your reporting, all of the colleagues that I've chatted with about this issue, everybody's saying this is unacceptable, which is why we're going to have to pass a law and hopefully the governor will sign it," Mayes said.
The auditor recommended the law include a punitive component for agencies that failed to remove SSNs from mailed documents by 2023. "The Legislature should require the agency to provide access to and pay for identity theft monitoring for any individual to whom it mails documents containing SSNs," the recommendation said.
That could have amounted to a financial penalty for an agency like the EDD. Claimants would not have to prove they were compromised by an EDD document. The act of mailing a full SSN would have triggered the need for EDD to pay for fraud prevention and identity theft monitoring services. That could be costly for an agency like the EDD, which has mailed millions of SSNs since the start of the pandemic alone.
That penalty was in the initial bill that Mayes authored, and the version that unanimously passed the assembly. However, CBS13 has learned it was "hostilely removed" from the legislation in the 11th hour by the Senate Appropriations Committee.
In email communications obtained by CBS13, the EDD told the Department of Finance "The EDD does not expect to provide fraud prevention services as we intend to meet the bill's January 1, 2023 deadline." However, that plan assumed the agency would be moving forward with it's system modernization project (BSM) that would allow them to automatically redact SSNs on some forms.
The EDD Strike Team, commissioned by the governor to look into EDD payment delays, recommended the agency pause the BSM project. The strike team did not look at fraud concerns and it's not clear how that recommendation may impact the agency's plans to remove SSNs by the 2023 deadline.
The final bill passed with bipartisan support and was signed into law by California Governor Gavin Newsom on Friday.
While it does not include a financial penalty, this law finally makes it clear to the EDD, and every state agency, that they are not above the law.
Better Protect Yourself From EDD-Related Fraud
1. Informed Delivery: If you've filed for unemployment, it's a good idea to sign up for USPS Informed Delivery. The service scans and emails a copy of each envelope that leaves the post office, so you can track if EDD sent a letter that never arrived.
2. Credit Freeze / Security Freeze: Considering the increased risk of identity theft, these days everyone should consider a credit freeze, also known as a security freeze. You must freeze your credit with all three credit bureaus, you can find more information here from the Federal Trade Commission.
3. AnnualCreditReport.com: Check to see if you've already been compromised by reviewing your credit report red flags like loans or credit cards you didn't apply. Annualcreditreport.com - the only site authorized by the federal government - allows you to access one report a year, for free, from each of the three credit bureaus. (Pro Tip: You can separate the three bureaus and check your report with one bureau every four months, allowing you to check your report for free throughout the year.)
NOTE: While getting a credit freeze and checking your credit report can help protect you from financial ID theft by preventing crooks from taking out credit or loans in your name, it won't prevent or identify other types of fraud (i.e. EDD, Social Security or tax fraud).
EDITOR'S NOTE: This story was originally published on 9/20/20 and updated 9/25/20 after the Governor signed the bill into law.
Follow Our Continuing Coverage
CBS13 Investigates: EDD Identity Theft Concerns
NOTE: CBS13 Investigative Reporter Julie Watts was based at the CBS San Francisco station (KPIX) when this investigation began and has continued the work after moving to CBS Sacramento. The stories have aired on CBS stations across California.
