You Need My Social Security Number But You Won’t Give Me Your Employee ID?

By now, most people know that their Social Security number is the key to their identity, so they need to be very judicious about who they share it with. Most security experts agree you should even decline to give it to your doctor or your child’s school unless it is absolutely necessary.

So imagine my surprise when I discovered that the credit bureaus required me to give my number to an unidentified foreign call center rep (without an employee ID). On its surface, this may not seem like a significant security risk. However, as a news reporter who has extensively covered ID theft, the conversation detailed below raised some serious red flags.

See: “How I Forced the Credit Bureaus to Freeze My Child’s Credit” for the back story.

When I called TransUnion to inquire about placing a security freeze on my child’s Social Security number, my call went directly to an Indian call center. I repeatedly requested that the representative transfer me to the U.S. consumer relations department that handles security freezes. She insisted that she first needed my child’s Social Security number. I explained that my child did not yet have a credit file, but she insisted she needed the number before she could transfer me.

The conversation went something like this:

Her supervisor confirmed that they were not allowed to give out any identifying information over the phone (real employee names, ID numbers or call center location numbers). However, she said that I was required to give them my Social Security number in order to be transferred to the U.S.

This, of course, raised a series of questions in my mind as I began to go into #NewsMom panic mode. According to Forbes, a typical Indian call center employee makes about US$300 per month—a great wage in India—but what’s to stop “Jane Smith” from selling my kid’s Social Security number on the black market for the going rate of $5-10,000 a pop?

So, in true #NewsMom form, I contacted the TransUnion media reps to ask.

Here is the TransUnion response:

Question: How is it possible that a credit bureau has no identification process in place to follow up on unprofessional, rude or hostile employees who have access to sensitive information?
Response: TransUnion does have a process in place to identify each call center representative–it is the person’s name. Even if the name is changed to simplify spelling and pronunciation, it is unique to that individual and our call center operations. We maintain a current list of all individuals and names that have direct contact with our consumers. In addition, TransUnion records every call as well as includes notation in each consumer file that is reference on a call. Recordings are maintained for a period of six months.

Question: What types of background checks are performed on TransUnion call center reps overseas?
Response: The vetting and background process for checking call center representatives dedicated to TransUnion is quite extensive. To maintain the integrity of the system and to help ensure there are no compromises to the system, I am sure you can appreciate us not going into any specific details on the vetting process. In addition, call center representatives for TransUnion are not allowed any personal belongings at their station–no pens, paper, cell phones, etc. … The equipment a call center representative has access to is only a keyboard, monitor, phone and headset. Certain functions on the monitor/keyboard/computer have also been disabled, e.g. screen capture, external drives.

Question: Why do they require sensitive information for a simple phone transfer?
Response: A SSN, for example, is the quickest and easiest way to pull up someone’s credit report. We can also use address or other identifying information as well. The reason we like to access the credit file, prior to a transfer, is because it might contain information or notations from a previous call that could help the call center representative transfer the consumer to correct department for the individual to receive the help they need in the most expeditious fashion.

Question: Why are they reluctant to transfer you to the U.S.? Do they have call center performance numbers they have to hit by keeping you on the phone?
Response: I apologize if you felt reluctance by the call center representative to be transferred to the U.S. We have no call center performance numbers except to assist the consumer in the most expeditious manner the first time they call. Our primary goal is to resolve the consumer’s issue on the first call.

I had a very similar experience with Equifax.
Here is the Equifax response to a similar set of questions:

Now, the Federal Trade Commission’s David Newman points out that whether or not they have writing utensils, “simply memorizing one Social Security number a day could be very lucrative for a dishonest call center representative.” He is very critical of the practice of automatically asking for a Social Security number to verify identity.

Other consumer advocates—like Consumer Watchdog—point out that recorded calls like these are often stored on foreign servers that may be vulnerable to hacking. In addition, this is information that an ID thief would already have, so it’s not the best way to verify your identity anyway.

In response to the concerns I raised, both TransUnion and Equifax say they have reminded call center reps that they can use an address or other identifying information instead of a Social Security number. I have called back several times to verify that they will now agree to transfer you to the U.S. without first requiring your Social Security number.

For more information on how to detect, repair and prevent child ID theft, see #NewsMom Research & Resources – Child ID Theft

Julie Watts
Julie is the consumer-investigative reporter for CBS in San Francisco. Her reports air nationally on CBS stations across the coun ...Read More