The Journey of a Child’s Social Security Number

A child's Social Security number is issued within days of birth and from that moment it begins to travel. What was created to track retirement earnings now follows a person for the rest of their life.

Nearly every Social Security number in this country is requested at the hospital, on the same form that produces the birth certificate. The application goes to the state and they send it to the Social Security Administration. The number arrives in the mail a few weeks later. That is the first transfer. 

Typically, that number then travels to the IRS the following April, when the child is claimed as a dependent. It then goes to the health plan at enrollment, moves to the pediatric practice, passes through that practice's billing vendor, travels to the insurance claims clearinghouse, and returns to the insurer. Four organizations from one doctor's office visit.

By the first day of kindergarten it has been written on countless forms, typed into many portals, and copied into systems where the family has no oversight.

Most parents picture the card in a drawer at home. The card is the least important place the number lives.

The Path of an SSN inside K-12 schools

Schools collect Social Security numbers on enrollment forms, in special-education files, and on healthcare and immunization forms. The data is stored in student information systems, where it passes to multiple vendors such as benefits administrators, insurance and health providers, testing platforms, and the software companies that run the school day-to-day operations.

Why this makes schools a target

Add it all up and a single school district becomes one of the richest collections of clean personal data anywhere. A district with 20,000 students is a database of 20,000 dormant Social Security numbers, each attached to a name and a date of birth belonging to a child who will not check their credit for years. Criminals understand this precisely and are drawn to schools because they hold enormous volumes of untouched identity data. 

According to the U.S. Department of Education, school districts experience an average of five cyberattacks per week. The two most common attacks are direct attacks on district networks and third-party or vendor breaches.

Beyond the Classroom

The same thing happens everywhere a child's life extends beyond the classroom. Summer camps, dance studios, youth sports leagues, and tutoring centers ask for a date of birth, and sometimes a Social Security number, on a registration or medical form. Those forms go into a filing cabinet, a shared inbox, or a cloud folder that never expires.

This ever growing exposure is not a failure of parenting. It is a structural feature of raising a child in nationwide systems that all need the same identification number. 

A child's Social Security number is theirs for life, and once it’s exposed, it will always be vulnerable to fraud.  The number is treated as an identifier by the people who collect it, and treated as a financial asset by the people who steal it.