Government contradicts itself over ID theft advice

WASHINGTON -- The government doesn't have to look far to see who's ignoring its advice on preventing identity theft.

It's the government itself.

The nation's Medicare agency and the Pentagon want at least 52 million Americans to carry their Social Security numbers in their wallets, contrary to warnings by the Federal Trade Commission that people should avoid doing so.

At least 44 million Medicare insurance cards include the beneficiary's full Social Security number. The number also appears on 8 million Defense Department identity cards used by active duty and reserve forces and their dependents, and on identification cards issued to military retirees. The Pentagon, however, plans to remove the numbers but won't complete the effort until 2014.

And the Internal Revenue Service still tells taxpayers to write their Social Security number on checks used to make payments, a potential problem for those using the mail rather than filing electronically. The IRS has no plans to change the system.

Changing the identity numbers would cost Medicare less than two days spending for the war in Iraq.

All this contradicts advice from the Federal Trade Commission, the lead federal agency for deterring identity theft.

"Protect your Social Security number. Don't carry your Social Security card in your wallet or write your Social Security number on a check," the FTC warned in a pamphlet sent months ago to every mailing address in the United States. The Social Security Administration offers similar advice.

Sens. Sherrod Brown, D-Ohio, and Tom Coburn, R-Okla., have introduced legislation that would require Medicare to remove the Social Security number from the insurance cards.

Carrying a Medicare card with the full Social Security number is more of a problem than the Social Security card. People usually need the insurance card to visit a medical provider but can memorize their number and always leave their Social Security card at home.

The Centers for Medicare and Medicaid said it would be too expensive for the agency, and for medical providers linked to Medicare, to change their systems with new numbers. Medicare officials also said they know of no cases in which identity theft was traced directly to a lost or stolen Medicare card.

Charlene Frizzera, chief operating officer of the nation's Medicare agency, said it would cost half a billion dollars to make the change for Medicare alone. Medicare's budget is $466.1 billion for the current financial year.

The Congressional Research Service, in an analysis of Pentagon figures, said daily spending in Iraq is about $320 million. The figure for Iraq, Afghanistan and related security measures is about $400 million a day.

Frizzera's advice also contradicted the directions on the card itself.

"Our advice is, don't carry it with you unless you know you're going to need it," Frizzera said.

But the back of the card says: "Carry your card with you when you are away from home."

Brown, referring to Medicare's estimated cost to fix the problem, said in an interview, "I don't believe their numbers. They're trying to find reasons they don't want to do it."

The president's Identity Theft Task Force recommended last year that U.S. agencies reduce the unnecessary use of Social Security numbers, which it called "the most valuable commodity for an identity thief."

Arnold Werner, 84, a retired chemical engineer from Scott Depot, W.Va., was so upset over his Medicare card that he blacked out the two middle numbers of his Social Security number. His physician's office said he needed to write the number back so it could copy it for billing purposes.

Werner gave up his attempt to change the system. By the time he needed the card for a hospital visit, he had obtained a new card with his full Social Security number printed on it.

"The government doesn't know what it's doing," he said. "I don't think they do anything right these days."

Military forces, their dependents and retirees must carry their ID cards for a range of services and benefits. Army officials at Fort Bragg, N.C., mistakenly issued to an identity thief a military ID card in July 2001 in the name of retired Army Capt. John Harrison with Harrison's Social Security number.

The thief, Jerry Wayne Phillips, was later convicted and sentenced to 41 months in prison after running up more than $260,000 in charges, including two trucks and a $25,000 Harley Davidson motorcycle. Harrison has testified to Congress about the need for tougher identity theft laws.

Combined with other personal information -- such as a victim's full name, birth date and home address -- a Social Security number can be used to open fraudulent credit accounts using a victim's identity. With just a Social Security number, a clever thief can fraudulently obtain a victim's credit report for as little as $50, an important step toward ultimately impersonating a victim.

"The underground is using different pieces of information to put together a picture of you, and a key piece of the puzzle is your Social Security number," said Dan Clements, president of CardCops, which sells services that monitor consumer accounts for identity theft.

Medicare has no plans to change or revise its insurance cards.

The Pentagon will begin eliminating the Social Security number in stages starting at the end of this year.

The IRS said in a statement it would not return a check that was missing the Social Security number, but it has no plans to change its instructions.

"At the surface level, they're working at cross-purposes. There's a reason for that," said Joel Winston, the Federal Trade Commission's director of the division of privacy and identity protection. "They've historically used this as an identifier because it works very well. But there's a widespread recognition that it's not a good idea anymore."

The Defense Department said it doesn't have the money, people, equipment and work stations to replace the cards all at once.

By 2014, the number will not be printed on any of the Defense Department cards except those for retirees who fail to request new IDs. There is no expiration for retiree ID cards -- used for access to base facilities and services such as the library, gym, bowling alley and golf course.

The Veterans Affairs Department, state governments, private companies and educational institutions already have acted to eliminate visible Social Security numbers:

• Private insurers covering roughly 200 million people issued new cards in recent years that replaced Social Security numbers with different identifiers. "I don't know of private insurers who use a Social Security number on the card," said Susan Pisano, spokeswoman for America's Health Insurance Plans. "Industry practice is, where Social Security numbers are used at all, they are used internally." Byron Hollis, national anti-fraud director for the BlueCross BlueShield Association, said the 39 independent companies in the trade group spent about four years replacing insurance cards for more than 90 million customers by the start of 2006.
• The VA spent roughly $6 million to replace about 4 million benefit cards to remove the Social Security number and birth date and placed all sensitive information on a bar code and magnetic strip. The only visible information on the new VA health cards is a color photo and identification of a special status, such as a Purple Heart recipient or former prisoner of war.
• Most universities have eliminated use of Social Security numbers.
• Forty-seven states have enacted laws to prevent identity theft, although their scope varies widely. In many instances, the laws ban use of the number for driver's licenses and other official state documents, student ID cards and cards issued by private health insurers.

"States have really forged out ahead," said Richard Hamp, an assistant attorney general in Utah. "I'm disappointed that the federal government isn't more on top of it."