Social Security: Observations on Improving Distribution of Death 
Information (08-NOV-01, GAO-02-233T).				 
								 
Congress, law enforcement, and others have recently expressed	 
concern over the misuse of Social Security numbers (SSNs).	 
Accurate and timely death information, including the SSN, is	 
critical to the integrity of the federal benefits system and can 
help protect consumers' financial assets against fraud. However, 
the SSN is a key identifier used to steal identities, obtain	 
false identification documents, and commit fraud. Death 	 
information collected by the Social Security Administration (SSA)
generally reaches financial institutions and other entities	 
within one to two months of a person's death, although delays in 
processing and distributing information sometimes occur. SSA and 
the National Technical Information Service could improve the	 
timeliness of the distribution of the Death Master File.	 
Improving the timeliness of death information to the financial	 
services industry would help to narrow the window of time that a 
criminal has to open new accounts using a deceased individual's  
identity. Additional education for the financial services	 
industry about the availability and contents of the Death Master 
File would also be helpful. Providing timely death information	 
and making financial institutions more aware of a reliable source
of such information could deter criminals from using deceased	 
individuals' social security numbers to obtain false identities  
for fraudulent activities.					 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-02-233T					        
    ACCNO:   A02446						        
  TITLE:     Social Security: Observations on Improving Distribution  
of Death Information						 
     DATE:   11/08/2001 
  SUBJECT:   Computer crimes					 
	     Fraud						 
	     Law enforcement					 
	     Information resources management			 
	     Terrorism						 
	     Computer security					 
	     Electronic data interchange			 
	     Social security number				 
	     Statistical data					 
	     SSA Death Master File				 
	     SSA Master Beneficiary Record			 
	     SSA Numerical Identification File			 
	     SSA Electronic Death Registration System		 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Testimony.                                               **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-02-233T
     
A

Test i mony Before the Subcommittee on Oversight and Investigations,
Committee on Financial Services; and Subcommittee on Social Security,
Committee on Ways and Means

For Release on Delivery Expected at

SOCIAL SECURITY 10: 00 a. m., EST

on Thursday November 8, 2001

Observations on Improving Distribution of Death Information

Statement of Barbara D. Bovbjerg, Director Education, Workforce and Income
Security Issues and

Richard J. Hillman, Director Financial Markets and Community

Investment Issues

GAO- 02- 233T

Chairwoman Kelly, Chairman Shaw, and Members of the Subcommittees: Thank you
for inviting us here today to provide you with our observations on the
gathering of death information and its distribution to financial
institutions. Over the past few years, Congress, law enforcement, and others
have expressed concern over the use and misuse of Social Security numbers
(SSNs). Accurate and timely death information (i. e., notification

of death), including the SSN, is critical to the integrity of the federal
benefits system and can help protect consumers? financial assets against
fraud. However, the SSN also is a key identifier used by unscrupulous
individuals to steal identities, obtain false identification documents, and
commit fraud. 1 In light of the recent terrorist attacks, your committees
have considered actions to prevent potential terrorists and criminals from
creating false

identities using SSNs and, in particular, to prevent the misuse of a
deceased person?s Social Security number. Accordingly, you asked us to
examine the process for gathering death information and distributing it to
financial institutions. Specifically, our remarks will focus on (1) how long
each stage of the process takes, (2) what actions the financial services
industry reported taking to prevent the misuse of a deceased person?s Social
Security number, and (3) what possible steps could be taken to improve the
timeliness of collecting and transmitting death information. Our

observations are based on prior GAO work, preliminary work at the Social
Security Administration (SSA) and the National Technical Information Service
(NTIS), and discussions with the three national credit reporting agencies,
eight of the largest credit card issuers, and two national trade
associations. We have not independently verified the timing of the process
for distributing death information, nor have we assessed the costs
associated with improving the timeliness of this process.

In summary, death information collected by SSA generally reaches financial
institutions and other entities within 1 to 2 months of a person?s death,
although delays in processing and distributing information sometimes occur.
Complete files of recent deaths are distributed quarterly and updated
monthly with information from a number of sources. SSA receives direct
reports of deaths from relatives and friends of the deceased and from
funeral homes. SSA also obtains further data by cross- checking its own

1 Identity Fraud: Information on Prevalence, Cost, and Internet Impact Is
Limited (GAO/ GGD- 98- 100BR, May 1998).

files with information from other federal and state agencies. The financial
services industry relies on Social Security numbers as one of the primary
identifiers to establish the identity of customers, to assess the
creditworthiness of customers, and to protect against fraud. Financial

institutions check personal information provided by those seeking new
credit, and many subscribe to fraud prevention products. The financial
services representatives we spoke with expressed interest in receiving more
timely death information. SSA is exploring ways to accelerate the process of
receiving and processing death information, including producing updates
weekly rather than monthly, and transmitting death

information to NTIS electronically. In a long- term initiative, SSA is
participating with state and local officials to develop an Electronic Death
Registration System that could reduce the time to report death information
to SSA. However, cost and legal issues remain to be resolved before the
electronic system can be fully implemented.

Background Each year, about 2.5 million people die in the United States. SSA
is responsible for keeping track of death information on beneficiaries of
the Social Security system, but it gathers such information on
nonbeneficiaries as well. SSA collects reports on deceased persons from a
number of sources, including funeral homes, relatives, other federal
agencies, and state vital record offices. SSA places information from the
reports, such as the date of death, in its Numerical Identification File
(NUMIDENT)-- the master file of Social Security number holders. It contains
information collected when an individual applies for a Social

Security card, when a change of name or other correction is recorded, and
when a death is reported. SSA periodically extracts death information from
this file to generate the Death Master File (DMF). SSA may make death
information available to the public under the Freedom of Information Act.

SSA makes the DMF file available to the public, including financial
institutions, through NTIS. NTIS offers this file as a single issue or a
subscription. Purchasers who wish to keep their DMF current are required to
purchase a subscription, which includes the full file and monthly updates.
NTIS makes this information available to its 107 subscribers on magnetic
tape or CD- ROM. NTIS subscribers include churches, computer companies,
federal and state agencies, insurance companies, non- profit organizations,
universities, the national credit reporting agencies, and

other financial services organizations.

Death Information Is Death information is collected and transmitted through
several steps. Distributed to Relatives, friends, or funeral homes are
generally the first to report deaths

to SSA, and the reports typically reach SSA field offices and processing
Financial Institutions centers within a week of the death. 2 According to
SSA, these sources Within 1 to 2 Months

account for about 90 percent of the death information it receives. The
remaining reports come from other federal or state agencies.

Processing information from relatives, friends, or funeral homes generally
takes another week after SSA receives the notification. After a death report
arrives at a field office or processing center, SSA checks the Master
Beneficiary Record or the Supplemental Security Record to determine whether
the deceased was a Social Security program beneficiary. 3 Death information
is recorded directly on NUMIDENT within a few days of the report's receipt.
If the deceased was a beneficiary, benefits are also terminated on the
Master Beneficiary Record.

In some cases, death reports are delayed or SSA requires more than a week to
complete the processing of a report. About 5 percent of the deaths reported
to SSA, for example, are identified from SSA computer matches

with records of deceased individuals provided by other federal agencies,
such as Veterans Affairs and the Centers for Medicare and Medicaid Services,
or state agencies, such as state vital statistics bureaus. SSA field offices
must verify any death report that was based solely on information from these
matches before terminating any benefits or recording the death information
on NUMIDENT. Because death data provided by states to SSA is restricted, 4
some deaths may not be recorded on the DMF distributed to financial
institutions. 5 Over time, the number of death records that are 2 For
example, funeral home directors, who are generally responsible for
submitting death

certificates to the state vital statistics bureaus, report deaths to SSA by
submitting a form to local SSA field offices.

3 The Master Beneficiary Record and Supplemental Security Record are the
principal SSA payment files for the Old Age, Survivors, and Disability
Insurance and the Supplemental Security Income programs, respectively.

4 According to the National Association for Public Health Statistics and
Information Systems (NAPHSIS), states restrict the disclosure of their death
information to secure compensation for its use and to maintain
confidentiality. NAPHSIS is a not- for- profit organization

representing most of the state registrars and directors of vital statistics.
5 42 U. S. C. 405( r) permits SSA to restrict state- supplied death
information to federal benefitpaying agencies.

affected by this restriction is unclear. Once SSA field offices verify the
state- supplied death information with another source and take the necessary
action to terminate benefits and update its benefit records, disclosure of
the death information is no longer restricted. However, the time period from
the date of death until these deaths are recorded on

NUMIDENT may be quite long, because death reports from states may be 90 to
120 days old when they arrive at SSA.

The remaining 5 percent are based on files from the Department of the
Treasury of payments returned by postal authorities or financial
institutions. A Department of the Treasury official told us that it was
likely that these reports require more than a week from the date of death to
reach

SSA. However, we did not verify this information and could not determine how
much more than a week might elapse. At the beginning of each month, SSA
extracts death information from the NUMIDENT for the DMF and sends the file
to NTIS. According to NTIS officials, the files generally arrive within the
first week of the month. NTIS generally needs another 2 to 4 days to produce
and send the magnetic tapes and CD- ROMs to its subscribers. In total, about
1 to 2 months elapse between a person?s death and the time when the death
information is available to financial institutions and other NTIS
subscribers, depending on

when the death notice is first received by SSA. Actions Taken By The
financial services industry relies heavily on SSNs as a key identifier for
Financial Institutions

a number of purposes, such as the reporting of information to the Internal
Revenue Service or the accurate processing and recording of customer to
Prevent Misuse of financial transactions. The timely receipt of death
information and prompt Deceased Individuals?

updating of financial data are key factors in the industry?s ability to
prevent Social Security

fraud and identity theft involving the SSNs of deceased individuals. Numbers

In our discussions with representatives from the financial services
industry, they reported taking a number of steps to verify information on
customers applying for new credit. For example, financial institutions check
the creditworthiness of customers by obtaining the credit history of an
applicant from credit reporting agencies, using the SSN as one of the key
identifiers. However, for existing accounts, most financial institutions we
spoke with did not use a formal process or central data source to identify

deceased customers. Instead, they relied primarily on family members and on
executors or trustees of the estate to provide this information. For
existing customers receiving Social Security benefits via direct deposit,

Social Security stated that it generally notifies the financial institution
of a beneficiary?s death within 24 hours of receiving notice. However, as we
discussed above, there could be delays in SSA receiving such notices.

Some of the institutions we spoke with were aware of the Death Master File
but were (1) unsure about the information it contained or (2) not aware that
they could subscribe to the file from NTIS. Others were not aware that the
Death Master File existed. According to the NTIS subscriber list, very few
banks subscribe through NTIS for the Death

Master File. Only one of the financial institutions we spoke with reported
tracking losses or the frequency of fraud associated with deceased
customers. However, the financial institutions we spoke with reported that
their losses or the frequency of occurrence were not material. Most
financial institutions told us that they subscribed to fraud prevention

products or services offered by the credit reporting agencies that included
alerts for deceased persons? Social Security numbers.

All three national credit- reporting agencies reported subscribing to and
receiving the monthly updates to the DMF. However, one credit reporting
agency relied solely on the quarterly Death Master File and not on the
monthly updates for its normal credit reporting and fraud services. We also
found that the credit reporting agencies made the data from the DMF
available only for subscribers to their proprietary fraud prevention
products. In contrast, death information reported directly to the credit
reporting agencies by credit issuers and family members was made

available to all their users, along with other credit information on a
customer?s credit history. This information was generally provided within
one to two billing cycles.

Financial institutions also subscribe to other sources for death
information. One information service we contacted primarily used the Death
Master File and supplemented it with information from other sources, such as
funeral homes and local governments. It provided screening and matching
services to its clients, to identify deceased customers. The representative
we spoke with indicated that his service?s clients often lacked the
necessary technology infrastructure to process and

maintain the Death Master File. This representative also noted that the
timeliness of data contained in the DMF had greatly improved since the move
to the monthly updates (from quarterly updates). However, the representative
said that more frequent updates- weekly or daily- were needed.

Two credit card associations that we contacted have also taken some steps to
help prevent the misuse of Social Security numbers of deceased individuals.
For example, they cosponsored a verification system for

bankcard applications. This system was designed to verify such things as an
applicant's address, telephone number, and Social Security number, and
whether he or she has provided any questionable data on the application.
This system, which was designed to help members reduce losses attributed to
fraud, had several fraud alert codes, one specifically designated to flag
the use of the Social Security number of a deceased individual.

In our discussions with representatives from the financial services
industry, most expressed an interest in receiving more timely death
information to narrow the window of opportunity in which criminals can
perpetrate fraud. The credit reporting agencies expressed an interest in
receiving more frequent DMF updates, but their responses varied regarding
how frequently SSA needed to provide those updates. Some could handle the
updated information daily; some could process the updates only biweekly.
Some recommended that SSA provide a Web- based ?look- up? service to verify
death information.

Possible Steps for SSA is exploring ways to speed up the collection and
processing of death Improving the

reports and the transmission of death data to financial institutions. In the
near term, SSA and NTIS are discussing ways to speed up the transmission
Collection and of death information to users, such as financial
institutions. SSA officials Transmission of Death

have stated that it would be relatively easy to produce updates on a weekly
Information

rather than monthly basis. Additionally, SSA and NTIS officials stated that
it should be possible for SSA to transmit updates electronically to NTIS,
and that NTIS could also provide its updates to financial institutions
electronically. SSA officials have indicated that it would be more difficult
and costly to provide updates more frequently than weekly, or to bypass NTIS
and provide electronic updates directly to financial institutions.

As we have previously reported, delays in SSA receiving some state death
reports have hindered the prompt processing and distribution of such
information. In a long- term initiative, SSA is participating in several
pilot

projects with state and local officials to develop an Electronic Death
Registration System that, among other things, would enable the states to
report deaths to SSA electronically. This system could improve the speed

with which deaths are reported to SSA. For example, in a July 2001 SSA
request for contract proposals of the new system, SSA required project plans
to demonstrate the capability to send a ?fact of death? report to SSA

within 5 days of a death, and within 1 day of receipt in the state bureau of
vital records. However, state agreements with SSA preclude the agency from
terminating benefits solely on the basis of state- provided death reports.
Therefore, SSA also required project plans to demonstrate the capability to
confirm death information electronically with entities originating the death
report, such as funeral directors.

SSA and the National Association for Public Health Statistics and
Information Systems officials also indicated that there are unresolved
issues with the Electronic Death Registration System. These include the

willingness of the states to adopt this system and SSA?s ability to release
state- provided death information to financial institutions. For example,
SSA officials stated that it remains unclear whether states will be willing
or able to pay the cost of installing automated terminals in the funeral
homes, hospitals, medical examiner offices, and other locations involved in
the death registration process. Additionally, SSA has not yet resolved legal
issues that might preclude the release of state- provided death report
information to financial institutions.

We inquired about the feasibility of SSA providing death information
directly to financial institutions and others from an on- line, Web- based
look- up service. SSA officials said that implementing such a system would
require significant changes to various SSA systems and might raise privacy
considerations.

SSA, NTIS, and the credit reporting agencies told us that additional
resources would be required to process death information more frequently.
However, NTIS officials expressed some concern that there should be a
demonstrated demand for the improved service before making these

investments. Conclusions In conclusion, it appears that SSA and NTIS could
improve the timeliness of the distribution of the Death Master File.
Improving the timeliness of death information to the financial services
industry would help to narrow

the window of time that a criminal has to open new accounts using a deceased
individual?s identity. Additional education to the financial services
industry about the availability and contents of the Death Master File would
also be helpful. Providing more timely death information and

making financial institutions more aware of a reliable source of such
information are tangible steps that could be taken to deter criminals from
using deceased individuals? Social Security numbers to obtain false

identities for use in fraudulent activities. However, improving the
timeliness of death information would not by itself eliminate identity theft
and is not a panacea for addressing the larger issue of the criminal misuse
and theft of Social Security numbers. Chairwoman Kelly and Chairman Shaw,
this concludes my statement. We would be pleased to respond to any questions
that you or other members of the Subcommittees may have.

Contacts and For further information regarding this testimony, please
contact Barbara D. Acknowledgments

Bovbjerg, Director, or George A. Scott, Assistant Director, Education,
Workforce, and Income Security (202) 512- 7215, and Richard J. Hillman,
Director, or Harry Medina, Assistant Director, Financial Markets and
Community Investment (202) 512- 8678. Individuals making key contributions
to this testimony include Daniel F. Alspaugh, Emily R. Chalmers, Heather T.
Dignan, Debra R. Johnson, Kay Kuhlman, and John M. Schaefer.

GAO United States General Accounting Office

a

Page 1 GAO- 02- 233T

Page 2 GAO- 02- 233T

Page 3 GAO- 02- 233T

Page 4 GAO- 02- 233T

Page 5 GAO- 02- 233T

Page 6 GAO- 02- 233T

Page 7 GAO- 02- 233T

Page 8 GAO- 02- 233T
*** End of document. ***