At this rate is there any data on Americans that hasn't leaked? I don't feel like it's far fetched request to allow a one time change of SSNs given how poorly companies and the government have handled our data.
The fact that a criminal knows your SSN doesn't absolve companies of being defrauded by those criminals through their own lax verification.
You should not be liable when entity-A leaks your data and entity-B suffers a loss to someone who has your data. There is no way you could have prevented that eventuality and none of the responsibility should fall on you.
Data security and identity verification will not improve so long as we tolerate laws that pretend we are the victims of these attacks and should suffer the losses, instead of recognizing that the entity that failed to properly identify a criminal is the actual victim.
The losses must be borne by the parties that are truly capable of preventing "identity theft," or nothing will change.
Honestly sounds like a great system. Not a single flaw here.
I wish that was a joke.
My wife (American) has found it utterly impossible to replace her social security card that went missing at least 7 years ago, despite several attempts. It would be nice to have so she can interact with the DMV when back in the US, and suchlike.
At least where we live now, the equivalent card is infinitely replaceable within days with a simple online form, and the person number is of extremely limited value to fraudsters.
Admittedly, I got the last one close to 20 years ago, but it was an easy process then (I walked into a building, requested it, they mailed it). My parents gave me the other two.
I once looked into getting a replacement card because I'm not sure where mine is, and I didn't bother after reading this (https://www.ssa.gov/number-card/replace-card): "You may not need to replace your card if you know your Social Security number. In most cases, a physical card isn't necessary."
I thought, yeah, I guess I've never actually needed it, so if SSA isn't worried then I won't worry either.
Government: Here's a number unique to you just for tax-related purposes. No, you can't change it and no, there's no security besides the anti-forgery measures on the card, which is why you can't laminate it. Here it is, you can't have spares, and getting a replacement is annoying, so keep it safe.
Companies: Cool! You've got a tax-filing number? We're gonna use that as your personal secret password for all sorts of important shit because that's super-easy on our end. Remember, if anybody else abuses it then it's totally your fault and not ours. [0]
What alternative exists in countries without an ID system such as the US or UK? Rely on names, date of birth, place of birth? Conflicts are possible in big cities. Not everyone will have a driver's license. So yeah, it's quite easy to decide to use a unique number that everyone already has.
The best alternative is the state ID. In every state you can get a state ID and/or a driver's license (which in almost all states is also a state ID).
They contain a unique identifier and that identifier can be changed by the state if needed down the line.
A federal ID standard would be nice of course but that's never going to happen due to some reasonable concerns (poor implementations resulting in loss of privacy) as well as some absolutely batshit insane ones (the ID system is the mark of the devil).
I'd personally prefer that we establish a standard for a sane distributed trust federated ID system and then pressure the states into gradually adopting that rather than pushing it up to the federal level where it'll then get fucked up and everyone will be stuck with it forever.
https://en.wikipedia.org/wiki/Real_ID_Act
However:
"... on April 27, 2020, the extended deadline after which identification documents would have to satisfy the Real ID Act standards to be accepted by federal agencies was again extended, by one year to October 1, 2021. On May 3, 2021, it was further extended to May 3, 2023, and on December 5, 2022, it was extended once more to May 7, 2025."
But if there's a gold star on your federated state's driver's license, you have it.
That's not the type of solution I'm talking about.
I'm talking about having an independent standards organisation (hell even NIST) produce a standard that supports federation and gradual onboarding by states and territories and then having the states each adopt it until it becomes a defacto national standard without any congressional involvement beyond the federal government also agreeing to accept it.
Real ID is a mess because it's not an ID system. It's really just an ID card system with a few other bits attached to address specific federal government concerns. That's not meaningfully useful for providing unique (and preferably privacy preserving) identifiers for companies, banks, and other non-government entities like what many european countries have.
SSA says you can, but with a caveat that a victim should've "attempted to fix problems resulting from the misuse but continues to be disadvantaged by using the original number". I don't know how much of a barrier there is, but theoretically the number is changeable.
You should be able to get replacements, but there is a lifetime limit of 10 replacements after 12/17/2005 [1]. I think that means the one from when I lost my wallet in my bedroom doesn't count! (lol, I know, but I had given up all hope, and then months later found the wallet just hanging out between the mattress and the bed frame)
Equifax provided 140 million people's information to the world. It was "shielded" behind a default password that was never changed.
Their penalty? Profits, because they bought an identity protection firm, provided 2 years of free monitoring, for a lifetime problem, then gleefully charged fees for the protection, that their own malfeasance literally caused.
Ok, chances are good you’d just get some other compromised ID, what’s the upside?
Maybe there is something better than some numeric characters?