From the House Ways and Means Committee:

Paul Rosenzweig, Senior Fellow at the R Street Institute, stated:

Authenticators are classically only useful… [if they] are kept confidentialToday Social Security numbers are so deeply compromised and so widely available in public, albeit often through criminal means, that they can no longer be used as an authenticator. This is because recent incidents, like the Equifax breach whose anniversary occurs this week, have effectively disclosed the vast majority of previously confidential Social Security numbers.”

[…]

Mr. Rosenzweig agreed with Rep. Rice, saying:

Using my Social Security number as an authenticator is as stupid as using the last four letters of my last name as my authenticator or the last four digits of my phone number.” 

Featured Publications