Forest Global Training Partners

Cyber Risks · Krebs on Security

E-Verify’s “SSN Lock” is Nothing of the Sort

Summary: KrebsOnSecurity found that DHS's myE-Verify site let him create a second account using the same name, address, phone number, SSN and date of birth under a different email address, and that unlocking the SSN lock required none of the challenge questions he had set up. The site's knowledge-based authentication questions were all answered correctly with "none of the above," and the site did not require him to lift the credit freeze he had in place with the major bureaus.

Why it matters: A lock meant to stop SSN misuse in E-Verify can be removed by anyone who registers a duplicate account with the same static identifiers, which Krebs notes are widely available in breaches and sold on dark web sites for roughly the price of a fancy coffee drink.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related