Forest Global Training Partners

Cyber Risks · Krebs on Security

Social Security Administration Now Requires Two-Factor Authentication

Summary: The Social Security Administration now requires all new and existing 'my Social Security' account holders to supply a cell phone number, and it texts an 8-digit code to be entered with a username and password at login. The measure, made to comply with an executive order for stronger federal authentication, does not verify identity at signup, so thieves can still open an account in someone else's name using a name, date of birth, Social Security number, address and phone number bought online for roughly $3-$4, then answer four Equifax knowledge-based questions.

What's compelling: Because only one my Social Security account can exist per Social Security number, an identity thief who registers first can divert a retiree's benefits to a prepaid debit card, and the new text-code requirement does nothing to stop that signup. The SSA's own mailing of a letter after an online signup shows it has the channel to deliver a verification code by U.S. Mail but does not use it to complete registration.

Read the original at Krebs on Security ↗

Topics
Identity & Access Management
Related