Parents have a lot to consider when sending kids back to school, and chances are guarding your child’s identity may not be the first thing that comes to mind. Making sure your kids are stocked up with notebooks, backpacks and the latest fall fashions tend to be the priority. But if you want to cover all the bases when getting your kids ready for a successful school year, you should ask about your school's policies when it comes to protecting your child's personal information.
According to an audit of Social Security Number (SSN) collection and use at K-12 schools by the Social Security Administration (SSA) Inspector General, children are often a target of identity thieves because they have clean credit histories and it could take years for fraudulent use to be discovered. Despite the increasing threat of child identity theft, the study found use of SSNs as the primary student identifier was widespread, even when another identification number could be used.
At the time of the study, over half of all states collect students' SSNs at registration, even though there is no State or Federal law requiring they do so. In fact, only seven states have laws in place requiring a child’s SSN at registration. In addition, over 80% of states don't have proper data retention policies and may hold student information indefinitely.
Which States collect SSN?
- 7 states require SSN for enrollment: Alabama, Arkansas, Florida, Georgia, Kentucky, Virginia and West Virginia.
- 26 states collect SSN with enrollment: Connecticut, Delaware, Hawaii, Illinois, Iowa, Kansas, Louisiana, Maine, Maryland, Massachusetts, Michigan, Mississippi, Missouri, Nebraska, Nevada, New Hampshire, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Texas, Utah, Wisconsin, and Wyoming.
It can't happen to my child right?
With 5 months still remaining in 2012, the number of K-12 schools that have experienced a reported data breach has almost matched the number of similar reported breaches in all of 2011, according to the California nonprofit Privacy Rights Clearinghouse. If current trends continue there will be a 60% increase in reported data breaches at K-12 institutions over last year.
Here's a few horrifying examples of breaches discovered by the SSA study.
- 8 individuals were indicted and arrested for breaking into about 50 public schools in Puerto Rico and stealing personal identification documents (including SSN cards) from as many as 12,000 students, teachers, and school administrators. The documents were stolen for sale to illegal immigrants interested in using the identities of U.S. citizens.
- A North Carolina school system accidentally sent out about 5,000 postcards with students' SSNs printed on the front.
- 15 boxes containing hundreds of students' confidential records (including birth certificates and SSN cards) were dumped on the sidewalk in front of their former New York high school.
- More than 400 identification cards were recalled from a Maryland high school when officials realized that student SSNs had been printed on some of them, even though the school system assigned students distinct identification numbers. The school system also appears to use SSNs in student lunch codes.
- Documents from a Texas school district's lunch program for 2003 to 2006 were left at a television news station with a note attached claiming the documents were found at a recycling center. Students' SSNs were visible on the documents.
Tips for parents to keep in mind as kids head back to school.
If your school is attempting to collect your child's SSN, ask if it is required. If you are in one of the 7 states that require SSNs for enrollment, or if school officials are insisting on getting the information anyway, don’t be shy, ask why.
- How it is going to be used, and what protections are in place to guard it. Often, it may not be essential for the school to use SSNs to document your child.
- Has the school has ever experienced a data breach before?
- What is the policy for notifying parents if a breach is discovered?
- Make sure your child’s SSN is locked away and always monitor for red flags of child ID theft such as receiving preapproved credit offers in the mail or phone calls from debt collectors in your child's name.
- Pulling a credit report for your child is often not enough to determine if your child has become a victim. This is because thieves may attach your child's SSN to an alias or even their own name which is known as synthetic identity theft. Credit reports will only detect activity if both your child's name and SSN has been used. A service such as Identity Guard® kID Sure® monitors your child's personal data, looking for more than just a credit report in their name. It can help detect signs of synthetic identity theft and will notify parents to certain suspicious activities.