SAN FRANCISCO (KPIX 5) — Two and a half years ago after a KPIX 5 investigation revealed the state was putting millions at risk for identity theft, officials promised changes.
ConsumerWatch reporter Julie Watts recently learned just how little has changed. California lawmakers on both sides of the aisle are furious.
“Don’t put your outgoing mail in a mailbox ever. If they see a flag up, it’s gone,” warned convicted identity thief Cheryl Thrasher.
She told ConsumerWatch all she needed to empty bank accounts, open credit cards and commit crimes in a victims’ name was one piece of mail with a social security number.
“It’s easy. It’s fast and it’s a fast come-up,” explained Thrasher.
That is the reason most government agencies, banks and even universities stopped using social security numbers as identifiers years ago.
In fact, in 2010 California, passed a law that prohibits printing the number “on any materials that are mailed.”
But as KPIX 5 first reported in 2015, viewers like Maxine Hines were horrified to discover the state was still printing full social security numbers on documents mailed out to millions of Californians collecting benefits for unemployment, disability and maternity leave.
“I couldn’t imagine why the state of California wouldn’t protect the people who live here!” exclaimed Hines.
When she called the Employment Development Department to complain about the massive security risk, she was not pleased with the response the agency gave her.
“She kinda laughed a bit and said, ‘Yeah, a lot of people complain,’ said Hines.
The Employment Development Department administers benefits for to over a million people a year.
The Federal Trade Commission’s David Newman says envelopes containing such sensitive information are a known target for crooks.
“Anything that’s coming from a state agency is likely to be a signal to an ID thief that there might be something useful inside,” said Newman.
The EDD was unapologetic when KPIX 5 first questioned the agency why it was mailing full social security numbers
The EDD said, “It is not administratively feasible to print only the last four digits.” officials argued they’re exempt from state law — which prohibits mailing the numbers — because federal law requires they “use social security numbers.”
The feds in response confirmed there is no law that requires the state print the numbers on mailed documents.
Then the EDD pointed to a different state law that says it can disclose “personal information…to the individual to whom the information pertains.”
Though they appeared to be violating that law too when several viewers who saw our stories said they had received other people’s EDD documents with full social security numbers in the mail.
“How in the world did this piece of paper get into an envelope addressed to me? asked Jody Howard, who told KPIX 5 she received someone else’s EDD paperwork.
The agency said it has no idea how often that happens.
After seeing our ConsumerWatch reports in 2015, members of the Assembly Privacy and Consumer Protection Committee demanded the agency stop printing the numbers.
“I think everybody who saw your story would agree it’s common sense; don’t put a social security number on a piece of correspondence you send through the mail,” said Democratic State Assemblyman Mike Gatto.
“My immediate reaction, beyond shock, was we gotta fix it,” said 2015 CA Assemblywoman Catharine Baker.
The EDD promised it would pending approval for additional funding, admitting it wasn’t actually required to print them and that it was administratively feasible to make changes.
But now — more than two years later — the agency got the funding they asked for to make the fix.
However, KPIX 5 has learned the agency has no immediate plans to stop printing social security numbers.
Legislators were outraged.
“Well, I think it’s really appalling,” said Assemblywoman Jacquie Irwin. “There’s just no excuse to wait that long to remove social security numbers from mailed documents.”
Assemblywoman Irwin was shocked to learn that instead of fixing the security risk now, the EDD wants to wait for a complete overhaul of its system.
That project is not slated to begin until sometime after 2020.
In the meantime, the agency has been urging people to enroll in online services to avoid getting sensitive information in the mail, but ConsumerWatch reporter Watts is enrolled in online only and is still getting documents sent with her social security number on a regular basis.
It hard not to laugh when the EDD says it can’t stop mailing documents.
While on her recent maternity leave, despite being enrolled in the EDDs online services and direct deposit to get notification of payments with a redacted social security number, the EDD still said it can’t stop mailing duplicate paper statements with my full social security number exposed and clearly labeled in two spots every two weeks.
Assemblywoman Catherine Baker was among the members who demanded a fix over two years ago. Today, she is understandably exasperated.
“We went to the moon over 40 years ago. We’ve got Silicon Valley right in our backyard in the Bay Area,” said Baker. “Trying to redact social security numbers in mail that goes to your mailbox is not rocket science. They need to be able to get it done.”
So now she is suggesting withholding funding from the agency until it can figure out a temporary fix.
“Clearly this is an agency that is having a hard time complying with the most basic elements of technology,” said Baker. “That’s where we have got to step in. You give them a chance to do it. They can’t get it done.”
Both Baker and Irwin now have meetings scheduled with officials from the EDD.
Meanwhile, the postal inspector confirms more mail fraud complaints come from California than any other state. And mail theft is on the rise.
KPIX 5 asked the EDD for an update on the issue more than three weeks ago and the agency has not yet provided a response.
KPIX 5 also spoke with State Senator Jerry Hill in Sacramento and asked, if the EDD can’t come up with a high-tech fix to stop printing the numbers, why not a low-tech fix like paper stock with a hole where the machine prints the social security numbers?
Hill said he would suggest the idea to the EDD director.