SSA.GOV To Require Stronger Authentication
Summary: The Social Security Administration said that beginning June 10, 2017, all my Social Security account holders, new and returning, must enter a username and password plus a one-time code sent by text message or email. The change comes almost a year after SSA enacted and then rescinded, within less than two weeks, a requirement that users provide a mobile phone number.
What's compelling: Krebs notes that resetting a password through the same email account that receives the one-time code undercuts the requirement, and that thieves can still open an account in an unregistered American's name using name, date of birth, Social Security number, address and phone number bought online for roughly $3 to $4, then answer four Equifax knowledge-based questions that can often be guessed or researched on Zillow and Facebook.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026