Computer Security and Your SSN

A flurry of comments and emails resulted from my post earlier today about OptOutPrescreen.com, which lets you opt out of preapproved credit card offers through a simple web form. Some readers cried foul because the site requires you to enter your Social Security Number as part of the opt-out process. Are they right to balk?

First things first: OptOutPrescreen.com is a wholly legitimate service. In fact its creation was mandated by Congress in 2003 as part of the Fair and Accurate Credit Transactions Act. The law took effect in 2005, and the website (and an 800 number, as was noted by some) was created.

Since the site asks for an SSN, many observers have been worried since the beginning about its intentions. In fact, the site originally had a horribly ugly design that actually looked like a phishing scam, even though it wasn't. But the FTC itself notes that the site is 100% legitimate. (It also notes that, contrary to some commenters' rumors, opting out does not harm your credit score.)

But... about that SSN issue. Is typing your Social Security Number into a web form a good idea? In general, I agree with everyone that no, it isn't. But as with most rules, there are exceptions, and OptOutPrescreen is a good reason to make one.

Why? For the credit agencies (where your submission goes), the only truly reliable way they have to identify you is by your SSN. Names are duplicated widely (as I've experienced firsthand), and residence information often takes years to be reflected at the credit agencies. The credit agencies would not likely de-list every "John Smith" from the opted-in rosters just because one applied. If you don't provide your SSN to OptOutPrescreen (and it isn't required) and the service can't determine who you are, you simply won't be enrolled in the opt-out program. The agencies just need more to go on. And remember: The credit agencies already know your SSN; that's how they identify you in their records. (Check your credit report if you don't believe me.) Really, if you're worried about your SSN being stolen from Equifax, it's going to happen on their server which houses hundreds of millions of records, not from this web form.

But couldn't someone steal the info as you type it in here? It's highly unlikely. The site is verified and authenticated as secure from VeriSign, the industry standard in online encryption services. The web pages are also encrypted with AES 256-bit encryption, which is about as high as it gets on the web. In a nutshell: OptOutPrescreen is as secure a site as you'll find online.

Don't take my word for it. Other people have asked whether the site is a scam, and all have been satisfied that it's legit. I think everyone who's commented and written to me so far is right to be skeptical, but they're wrong to be so outright paranoid that they stubbornly refuse to take advantage of legitimate services like this that will do far more good for them than any potential risk they might undertake in typing a Social Security Number into an encrypted web form. All those unsolicited credit card offers sitting in your mailbox are a much bigger risk if you ask me.