Social Security: Observations on Improving Distribution of Death
Information (08-NOV-01, GAO-02-233T).
Congress, law enforcement, and others have recently expressed
concern over the misuse of Social Security numbers (SSNs).
Accurate and timely death information, including the SSN, is
critical to the integrity of the federal benefits system and can
help protect consumers' financial assets against fraud. However,
the SSN is a key identifier used to steal identities, obtain
false identification documents, and commit fraud. Death
information collected by the Social Security Administration (SSA)
generally reaches financial institutions and other entities
within one to two months of a person's death, although delays in
processing and distributing information sometimes occur. SSA and
the National Technical Information Service could improve the
timeliness of the distribution of the Death Master File.
Improving the timeliness of death information to the financial
services industry would help to narrow the window of time that a
criminal has to open new accounts using a deceased individual's
identity. Additional education for the financial services
industry about the availability and contents of the Death Master
File would also be helpful. Providing timely death information
and making financial institutions more aware of a reliable source
of such information could deter criminals from using deceased
individuals' social security numbers to obtain false identities
for fraudulent activities.
-------------------------Indexing Terms-------------------------
REPORTNUM: GAO-02-233T
ACCNO: A02446
TITLE: Social Security: Observations on Improving Distribution
of Death Information
DATE: 11/08/2001
SUBJECT: Computer crimes
Fraud
Law enforcement
Information resources management
Terrorism
Computer security
Electronic data interchange
Social security number
Statistical data
SSA Death Master File
SSA Master Beneficiary Record
SSA Numerical Identification File
SSA Electronic Death Registration System
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Testimony. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO-02-233T
A
Test i mony Before the Subcommittee on Oversight and Investigations,
Committee on Financial Services; and Subcommittee on Social Security,
Committee on Ways and Means
For Release on Delivery Expected at
SOCIAL SECURITY 10: 00 a. m., EST
on Thursday November 8, 2001
Observations on Improving Distribution of Death Information
Statement of Barbara D. Bovbjerg, Director Education, Workforce and Income
Security Issues and
Richard J. Hillman, Director Financial Markets and Community
Investment Issues
GAO- 02- 233T
Chairwoman Kelly, Chairman Shaw, and Members of the Subcommittees: Thank you
for inviting us here today to provide you with our observations on the
gathering of death information and its distribution to financial
institutions. Over the past few years, Congress, law enforcement, and others
have expressed concern over the use and misuse of Social Security numbers
(SSNs). Accurate and timely death information (i. e., notification
of death), including the SSN, is critical to the integrity of the federal
benefits system and can help protect consumers? financial assets against
fraud. However, the SSN also is a key identifier used by unscrupulous
individuals to steal identities, obtain false identification documents, and
commit fraud. 1 In light of the recent terrorist attacks, your committees
have considered actions to prevent potential terrorists and criminals from
creating false
identities using SSNs and, in particular, to prevent the misuse of a
deceased person?s Social Security number. Accordingly, you asked us to
examine the process for gathering death information and distributing it to
financial institutions. Specifically, our remarks will focus on (1) how long
each stage of the process takes, (2) what actions the financial services
industry reported taking to prevent the misuse of a deceased person?s Social
Security number, and (3) what possible steps could be taken to improve the
timeliness of collecting and transmitting death information. Our
observations are based on prior GAO work, preliminary work at the Social
Security Administration (SSA) and the National Technical Information Service
(NTIS), and discussions with the three national credit reporting agencies,
eight of the largest credit card issuers, and two national trade
associations. We have not independently verified the timing of the process
for distributing death information, nor have we assessed the costs
associated with improving the timeliness of this process.
In summary, death information collected by SSA generally reaches financial
institutions and other entities within 1 to 2 months of a person?s death,
although delays in processing and distributing information sometimes occur.
Complete files of recent deaths are distributed quarterly and updated
monthly with information from a number of sources. SSA receives direct
reports of deaths from relatives and friends of the deceased and from
funeral homes. SSA also obtains further data by cross- checking its own
1 Identity Fraud: Information on Prevalence, Cost, and Internet Impact Is
Limited (GAO/ GGD- 98- 100BR, May 1998).
files with information from other federal and state agencies. The financial
services industry relies on Social Security numbers as one of the primary
identifiers to establish the identity of customers, to assess the
creditworthiness of customers, and to protect against fraud. Financial
institutions check personal information provided by those seeking new
credit, and many subscribe to fraud prevention products. The financial
services representatives we spoke with expressed interest in receiving more
timely death information. SSA is exploring ways to accelerate the process of
receiving and processing death information, including producing updates
weekly rather than monthly, and transmitting death
information to NTIS electronically. In a long- term initiative, SSA is
participating with state and local officials to develop an Electronic Death
Registration System that could reduce the time to report death information
to SSA. However, cost and legal issues remain to be resolved before the
electronic system can be fully implemented.
Background Each year, about 2.5 million people die in the United States. SSA
is responsible for keeping track of death information on beneficiaries of
the Social Security system, but it gathers such information on
nonbeneficiaries as well. SSA collects reports on deceased persons from a
number of sources, including funeral homes, relatives, other federal
agencies, and state vital record offices. SSA places information from the
reports, such as the date of death, in its Numerical Identification File
(NUMIDENT)-- the master file of Social Security number holders. It contains
information collected when an individual applies for a Social
Security card, when a change of name or other correction is recorded, and
when a death is reported. SSA periodically extracts death information from
this file to generate the Death Master File (DMF). SSA may make death
information available to the public under the Freedom of Information Act.
SSA makes the DMF file available to the public, including financial
institutions, through NTIS. NTIS offers this file as a single issue or a
subscription. Purchasers who wish to keep their DMF current are required to
purchase a subscription, which includes the full file and monthly updates.
NTIS makes this information available to its 107 subscribers on magnetic
tape or CD- ROM. NTIS subscribers include churches, computer companies,
federal and state agencies, insurance companies, non- profit organizations,
universities, the national credit reporting agencies, and
other financial services organizations.
Death Information Is Death information is collected and transmitted through
several steps. Distributed to Relatives, friends, or funeral homes are
generally the first to report deaths
to SSA, and the reports typically reach SSA field offices and processing
Financial Institutions centers within a week of the death. 2 According to
SSA, these sources Within 1 to 2 Months
account for about 90 percent of the death information it receives. The
remaining reports come from other federal or state agencies.
Processing information from relatives, friends, or funeral homes generally
takes another week after SSA receives the notification. After a death report
arrives at a field office or processing center, SSA checks the Master
Beneficiary Record or the Supplemental Security Record to determine whether
the deceased was a Social Security program beneficiary. 3 Death information
is recorded directly on NUMIDENT within a few days of the report's receipt.
If the deceased was a beneficiary, benefits are also terminated on the
Master Beneficiary Record.
In some cases, death reports are delayed or SSA requires more than a week to
complete the processing of a report. About 5 percent of the deaths reported
to SSA, for example, are identified from SSA computer matches
with records of deceased individuals provided by other federal agencies,
such as Veterans Affairs and the Centers for Medicare and Medicaid Services,
or state agencies, such as state vital statistics bureaus. SSA field offices
must verify any death report that was based solely on information from these
matches before terminating any benefits or recording the death information
on NUMIDENT. Because death data provided by states to SSA is restricted, 4
some deaths may not be recorded on the DMF distributed to financial
institutions. 5 Over time, the number of death records that are 2 For
example, funeral home directors, who are generally responsible for
submitting death
certificates to the state vital statistics bureaus, report deaths to SSA by
submitting a form to local SSA field offices.
3 The Master Beneficiary Record and Supplemental Security Record are the
principal SSA payment files for the Old Age, Survivors, and Disability
Insurance and the Supplemental Security Income programs, respectively.
4 According to the National Association for Public Health Statistics and
Information Systems (NAPHSIS), states restrict the disclosure of their death
information to secure compensation for its use and to maintain
confidentiality. NAPHSIS is a not- for- profit organization
representing most of the state registrars and directors of vital statistics.
5 42 U. S. C. 405( r) permits SSA to restrict state- supplied death
information to federal benefitpaying agencies.
affected by this restriction is unclear. Once SSA field offices verify the
state- supplied death information with another source and take the necessary
action to terminate benefits and update its benefit records, disclosure of
the death information is no longer restricted. However, the time period from
the date of death until these deaths are recorded on
NUMIDENT may be quite long, because death reports from states may be 90 to
120 days old when they arrive at SSA.
The remaining 5 percent are based on files from the Department of the
Treasury of payments returned by postal authorities or financial
institutions. A Department of the Treasury official told us that it was
likely that these reports require more than a week from the date of death to
reach
SSA. However, we did not verify this information and could not determine how
much more than a week might elapse. At the beginning of each month, SSA
extracts death information from the NUMIDENT for the DMF and sends the file
to NTIS. According to NTIS officials, the files generally arrive within the
first week of the month. NTIS generally needs another 2 to 4 days to produce
and send the magnetic tapes and CD- ROMs to its subscribers. In total, about
1 to 2 months elapse between a person?s death and the time when the death
information is available to financial institutions and other NTIS
subscribers, depending on
when the death notice is first received by SSA. Actions Taken By The
financial services industry relies heavily on SSNs as a key identifier for
Financial Institutions
a number of purposes, such as the reporting of information to the Internal
Revenue Service or the accurate processing and recording of customer to
Prevent Misuse of financial transactions. The timely receipt of death
information and prompt Deceased Individuals?
updating of financial data are key factors in the industry?s ability to
prevent Social Security
fraud and identity theft involving the SSNs of deceased individuals. Numbers
In our discussions with representatives from the financial services
industry, they reported taking a number of steps to verify information on
customers applying for new credit. For example, financial institutions check
the creditworthiness of customers by obtaining the credit history of an
applicant from credit reporting agencies, using the SSN as one of the key
identifiers. However, for existing accounts, most financial institutions we
spoke with did not use a formal process or central data source to identify
deceased customers. Instead, they relied primarily on family members and on
executors or trustees of the estate to provide this information. For
existing customers receiving Social Security benefits via direct deposit,
Social Security stated that it generally notifies the financial institution
of a beneficiary?s death within 24 hours of receiving notice. However, as we
discussed above, there could be delays in SSA receiving such notices.
Some of the institutions we spoke with were aware of the Death Master File
but were (1) unsure about the information it contained or (2) not aware that
they could subscribe to the file from NTIS. Others were not aware that the
Death Master File existed. According to the NTIS subscriber list, very few
banks subscribe through NTIS for the Death
Master File. Only one of the financial institutions we spoke with reported
tracking losses or the frequency of fraud associated with deceased
customers. However, the financial institutions we spoke with reported that
their losses or the frequency of occurrence were not material. Most
financial institutions told us that they subscribed to fraud prevention
products or services offered by the credit reporting agencies that included
alerts for deceased persons? Social Security numbers.
All three national credit- reporting agencies reported subscribing to and
receiving the monthly updates to the DMF. However, one credit reporting
agency relied solely on the quarterly Death Master File and not on the
monthly updates for its normal credit reporting and fraud services. We also
found that the credit reporting agencies made the data from the DMF
available only for subscribers to their proprietary fraud prevention
products. In contrast, death information reported directly to the credit
reporting agencies by credit issuers and family members was made
available to all their users, along with other credit information on a
customer?s credit history. This information was generally provided within
one to two billing cycles.
Financial institutions also subscribe to other sources for death
information. One information service we contacted primarily used the Death
Master File and supplemented it with information from other sources, such as
funeral homes and local governments. It provided screening and matching
services to its clients, to identify deceased customers. The representative
we spoke with indicated that his service?s clients often lacked the
necessary technology infrastructure to process and
maintain the Death Master File. This representative also noted that the
timeliness of data contained in the DMF had greatly improved since the move
to the monthly updates (from quarterly updates). However, the representative
said that more frequent updates- weekly or daily- were needed.
Two credit card associations that we contacted have also taken some steps to
help prevent the misuse of Social Security numbers of deceased individuals.
For example, they cosponsored a verification system for
bankcard applications. This system was designed to verify such things as an
applicant's address, telephone number, and Social Security number, and
whether he or she has provided any questionable data on the application.
This system, which was designed to help members reduce losses attributed to
fraud, had several fraud alert codes, one specifically designated to flag
the use of the Social Security number of a deceased individual.
In our discussions with representatives from the financial services
industry, most expressed an interest in receiving more timely death
information to narrow the window of opportunity in which criminals can
perpetrate fraud. The credit reporting agencies expressed an interest in
receiving more frequent DMF updates, but their responses varied regarding
how frequently SSA needed to provide those updates. Some could handle the
updated information daily; some could process the updates only biweekly.
Some recommended that SSA provide a Web- based ?look- up? service to verify
death information.
Possible Steps for SSA is exploring ways to speed up the collection and
processing of death Improving the
reports and the transmission of death data to financial institutions. In the
near term, SSA and NTIS are discussing ways to speed up the transmission
Collection and of death information to users, such as financial
institutions. SSA officials Transmission of Death
have stated that it would be relatively easy to produce updates on a weekly
Information
rather than monthly basis. Additionally, SSA and NTIS officials stated that
it should be possible for SSA to transmit updates electronically to NTIS,
and that NTIS could also provide its updates to financial institutions
electronically. SSA officials have indicated that it would be more difficult
and costly to provide updates more frequently than weekly, or to bypass NTIS
and provide electronic updates directly to financial institutions.
As we have previously reported, delays in SSA receiving some state death
reports have hindered the prompt processing and distribution of such
information. In a long- term initiative, SSA is participating in several
pilot
projects with state and local officials to develop an Electronic Death
Registration System that, among other things, would enable the states to
report deaths to SSA electronically. This system could improve the speed
with which deaths are reported to SSA. For example, in a July 2001 SSA
request for contract proposals of the new system, SSA required project plans
to demonstrate the capability to send a ?fact of death? report to SSA
within 5 days of a death, and within 1 day of receipt in the state bureau of
vital records. However, state agreements with SSA preclude the agency from
terminating benefits solely on the basis of state- provided death reports.
Therefore, SSA also required project plans to demonstrate the capability to
confirm death information electronically with entities originating the death
report, such as funeral directors.
SSA and the National Association for Public Health Statistics and
Information Systems officials also indicated that there are unresolved
issues with the Electronic Death Registration System. These include the
willingness of the states to adopt this system and SSA?s ability to release
state- provided death information to financial institutions. For example,
SSA officials stated that it remains unclear whether states will be willing
or able to pay the cost of installing automated terminals in the funeral
homes, hospitals, medical examiner offices, and other locations involved in
the death registration process. Additionally, SSA has not yet resolved legal
issues that might preclude the release of state- provided death report
information to financial institutions.
We inquired about the feasibility of SSA providing death information
directly to financial institutions and others from an on- line, Web- based
look- up service. SSA officials said that implementing such a system would
require significant changes to various SSA systems and might raise privacy
considerations.
SSA, NTIS, and the credit reporting agencies told us that additional
resources would be required to process death information more frequently.
However, NTIS officials expressed some concern that there should be a
demonstrated demand for the improved service before making these
investments. Conclusions In conclusion, it appears that SSA and NTIS could
improve the timeliness of the distribution of the Death Master File.
Improving the timeliness of death information to the financial services
industry would help to narrow
the window of time that a criminal has to open new accounts using a deceased
individual?s identity. Additional education to the financial services
industry about the availability and contents of the Death Master File would
also be helpful. Providing more timely death information and
making financial institutions more aware of a reliable source of such
information are tangible steps that could be taken to deter criminals from
using deceased individuals? Social Security numbers to obtain false
identities for use in fraudulent activities. However, improving the
timeliness of death information would not by itself eliminate identity theft
and is not a panacea for addressing the larger issue of the criminal misuse
and theft of Social Security numbers. Chairwoman Kelly and Chairman Shaw,
this concludes my statement. We would be pleased to respond to any questions
that you or other members of the Subcommittees may have.
Contacts and For further information regarding this testimony, please
contact Barbara D. Acknowledgments
Bovbjerg, Director, or George A. Scott, Assistant Director, Education,
Workforce, and Income Security (202) 512- 7215, and Richard J. Hillman,
Director, or Harry Medina, Assistant Director, Financial Markets and
Community Investment (202) 512- 8678. Individuals making key contributions
to this testimony include Daniel F. Alspaugh, Emily R. Chalmers, Heather T.
Dignan, Debra R. Johnson, Kay Kuhlman, and John M. Schaefer.
GAO United States General Accounting Office
a
Page 1 GAO- 02- 233T
Page 2 GAO- 02- 233T
Page 3 GAO- 02- 233T
Page 4 GAO- 02- 233T
Page 5 GAO- 02- 233T
Page 6 GAO- 02- 233T
Page 7 GAO- 02- 233T
Page 8 GAO- 02- 233T
*** End of document. ***