An interesting story floats around many NBC stations and other major news outlets about a site that protects you from identity theft. It goes along the lines of, "Do you want to make sure your social security and credit card numbers are not stolen? Then come to this website, enter your social security number or your credit card number and we will check for you."

I will not name the site because in my opinion it does not deserve any additional traffic. The point is that although it may seem a great idea and would seem very appealing to the mainstream media in times of heightened sensitivity of identity theft, this kind of services pose more dangers than benefits. It may be also somewhat ironic - by trying to prevent your social security number from appearing on the Internet, you go on the Internet and you voluntarily type it into a search engine, which, in turn, searches some portion of the Internet to figure out whether there is a match. This just sounds wrong.

The site owners make a statement in their defense (and in attempt to appease people like me who feel this is not right),

Your credit card number or social security number alone has little value. These numbers can only be used to commit fraud when they are attached to an address, name, date of birth, expiration date, CVV2, etc. We never know any of this information; therefore, searching for a number with StolenID Search carries little risk of harming you, even in the worst case scenario.

Although true, this statement doesn’t tell the entire story. Having somebody’s social security or credit card by itself may not be enough, but it is the most essential piece of information in attempting to steal one’s identity or money. If criminals had the social security number and IP address of a person who searched for this social security they can easily either social engineer or IP-lookup the name and address of the user at a particular IP address. In many cases this will not work, but in many cases it would. In addition, motivated hackers can penetrate the machine at the originating IP and obtain the necessary name and address needed to steal somebody’s identity.

I hope that I am wrong and that this site provides more help than damage. But as of now I don’t feel right about it.

No Responses to “Don’t Search For Your SSN”

No comments yet

Leave a Reply

Name (required)

Mail (will not be published) (required)

Website

XHTML: You can use these tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <code> <em> <i> <strike> <strong>