Why it's surprisingly hard to get a new Social Security number if yours gets stolen by hackers

Reuters/Ho New

Last year, a leading expert on data breaches told NPR that he estimated 60 to 80% of Social Security numbers had been stolen in cyberattacks.

The Social Security Administration, meanwhile, assigned only 274 new numbers in 2015.

Indeed, those concerned that their SSN may have been leaked in a data breach or inadvertently handed out in a phishing scam may be surprised to learn that the loss or suspected theft of a Social Security number alone is not enough to merit the assignment of a replacement number.

The US Social Security Administration (SSA) lays out a limited set of circumstances under which someone can be assigned a new number.

We can assign a different number only if:

• Sequential numbers assigned to members of the same family are causing problems;
• More than one person is assigned or using the same number;
• A victim of identity theft continues to be disadvantaged by using the original number;
• There is a situation of harassment, abuse or life endangerment; or
• An individual has religious or cultural objections to certain numbers or digits in the original number.

(Interestingly, the religious justification is most commonly cited by those objecting to the number “666” inside their number, but very few new numbers are assigned for this reason.)

In other words, though millions of individuals are theoretically “at-risk” of fraud after having their SSNs exposed in recent breaches, the SSA won't assign them new numbers as a preventative measure.

“It is against our policy, the public’s interest, and the integrity of our enumeration processes to assign new SSNs simply upon request or out of a concern there may potentially be a future problem,” an SSA spokesperson told Business Insider.

Applicants for a new number must provide “current, credible, third-party evidence documenting the reasons for needing a new number," and the agency stresses that a new card by no means guarantees a fresh start.

Reuters/Ho New

Other institutions may maintain records set up under the old number, and even the SSA links the old number to the new one in its records.

That's at least one reason why many who decide to go through with the process of changing their number often go back to using their old one. 

Chris Hadnagy, CEO and founder of Social-Engineer, Inc., generally suggests less drastic steps if you're worried about identity theft (especially since your SSN can be used by identity thieves to apply for loans or credit cards, file for fraudulent tax refunds, and even get insurance).

In an interview with Business Insider, Hadnagy noted that all three credit bureaus (Equifax, Transunion, and Experian) offer the ability to place a temporary freeze on one’s credit in order to stop fraudsters from accessing a credit report for fraudulent purposes.

Similarly, victims of identity theft may place a fraud alert on their account with a credit bureau to require identity verification before a credit report can be accessed.

NOW WATCH: IAN BREMMER: This is why the world isn’t concerned at all about a President Trump