Forest Global Training Partners

Cyber Risks · Krebs on Security

SSA: Ixnay on txt msg reqmnt 4 e-acct, sry

Summary: The Social Security Administration reversed a policy that would have required all new and existing my Social Security account holders to supply a cell phone number for an 8-digit text code at login, after a rollout marked by technical difficulties and criticism. The agency said the text option remains available as optional extra security, and Krebs notes that because the added protections are optional, thieves can still open an account in someone else's name using a name, date of birth, Social Security number, address and phone number, plus four Equifax knowledge-based authentication questions.

What you should know: The personal data needed to open an account in a retiree's name sells for roughly $3-$4 in online cybercrime shops, and the KBA answers can often be found on Zillow and Facebook - so the optional controls do little to stop benefits being diverted to prepaid debit cards the crooks control.

Read the original at Krebs on Security ↗

Topics
Identity & Access Management
Related