Social Security Administration: Actions Needed to Help Ensure Success of Electronic Verification Service
Fast Facts
Synthetic identity fraud—combining made-up and real information to fake an identity—is a growing concern for financial institutions, like banks, especially as their systems go digital.
In response, the Social Security Administration spent $62 million on a new service to help banks verify Social Security numbers. A 2018 law required SSA to recover the cost of rolling out the service from its users. However, low participation and other challenges have made it hard for SSA to recover costs—and SSA still needs to recover about $37 million.
We recommended that SSA develop strategies to get more banks to use the service.
Highlights
What GAO Found
The Social Security Administration (SSA) launched the Electronic Consent Based Social Security Number Verification service in June 2020. The service seeks to reduce synthetic identity fraud, which combines fictitious and real information to fabricate an identity. The service allows authorized entities—generally financial institutions and their service providers—to verify an individual's name, Social Security number, and date of birth electronically. SSA spent about $62 million from fiscal year (FY) 2018 through FY 2023, based on SSA data. However, SSA did not follow agency guidance for planning IT investments when estimating costs for the service. Moreover, its guidance on cost estimation did not consistently incorporate GAO best practices, such as documenting the estimation process. By establishing appropriate controls to ensure that all significant IT investments follow agency guidance and updating guidance to incorporate additional best practices, SSA could improve cost estimation for future projects.
SSA is required to fully recover the service's costs and collected about $25 million in user fees (40 percent of $62 million total costs) as of the end of FY 2023. SSA has not met its projections for fee collections due to lower-than-expected industry participation. SSA will need to collect about $14 million annually to meet its goal to recover all costs by the end of FY 2027, based on GAO's analysis (see figure). But it is unclear if SSA can meet its goal without increasing users or fees. Subscription data through December 2023 demonstrate that the service has not significantly increased users since enrollment opened in FY 2022, and fee collections decreased after SSA increased fees in July 2023.
About $14 Million in User Fees Is Needed Annually to Meet Cost Recovery Goal for the Electronic Consent Based Social Security Number Verification Service
SSA officials told GAO they did not plan to take significant steps to increase use of the service. Industry participants GAO interviewed cited several factors limiting their use, such as difficult-to-interpret verification results. SSA also had not established performance measures and goals for the service's use and benefit. SSA could better ensure the service achieves its intended purpose of reducing synthetic identity fraud by developing strategies and assessing tradeoffs for expanding its use and establishing related performance measures and goals.
Why GAO Did This Study
Synthetic identity fraud is a growing concern among financial institutions, which reported $182 million in related suspicious activity in 2021. The Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 directed SSA to combat such fraud by developing a database to electronically verify identifying information. However, questions have been raised about the service's financial viability and use by industry participants.
GAO was asked to examine, among other objectives, the extent to which SSA has (1) followed guidance and best practices for cost estimation for its Electronic Consent Based Social Security Number Verification service, (2) designed user fees to promote cost recovery for the service, and (3) taken steps to expand use and benefit of the service.
GAO reviewed relevant laws, guidance, and agency documentation and data and interviewed SSA officials responsible for the service. GAO also interviewed 16 industry participants selected to reflect a mix of entities and uses of the service.
Recommendations
GAO is making seven recommendations to SSA, including that it implements appropriate controls over IT investments, updates cost estimation guidance, develops strategies to expand use of the service, and establishes related performance measures and goals. SSA concurred with all seven recommendations and stated that it will evaluate its policies and processes to determine how to address them.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Social Security Administration | The SSA Commissioner should ensure that the Associate Commissioner of IT Financial Management and Support updates guidance for developing cost estimates for IT investments to incorporate the best practices outlined in GAO's Cost Estimating and Assessment Guide. (Recommendation 1) |
We will update the status of this recommendation when SSA provides its 180-day letter (expected in spring 2025).
|
| Social Security Administration | The SSA Commissioner should ensure that the Associate Commissioner of IT Financial Management and Support implements appropriate controls to ensure all significant IT investments follow the Information Technology Investment Process. (Recommendation 2) |
We will update the status of this recommendation when SSA provides its 180-day letter (expected in spring 2025).
|
| Social Security Administration | The SSA Commissioner should ensure that the Associate Commissioner of Data Exchange, Policy Publications and International Negotiations publishes in SSA's annual financial reports detailed information on its reviews of eCBSV user fees and any proposed changes. (Recommendation 3) |
We will update the status of this recommendation when SSA provides its 180-day letter (expected in spring 2025).
|
| Social Security Administration | The SSA Commissioner should ensure that the Associate Commissioner of the Office of Data Exchange, Policy Publications and International Negotiations includes in relevant Federal Register or other public notices a detailed explanation of any changes to eCBSV user fees, such as by describing cost recovery methodologies and assumptions, recent and projected costs, and user-fee collections. (Recommendation 4) |
We will update the status of this recommendation when SSA provides its 180-day letter (expected in spring 2025).
|
| Social Security Administration | The SSA Commissioner should ensure that the Associate Commissioner of Data Exchange, Policy Publications and International Negotiations develops a process for soliciting input from stakeholders on changes to eCBSV user fees prior to their implementation. (Recommendation 5) |
We will update the status of this recommendation when SSA provides its 180-day letter (expected in spring 2025).
|
| Social Security Administration | The SSA Commissioner should ensure that the Associate Commissioner of Data Exchange, Policy Publications and International Negotiations develops strategies and assesses tradeoffs for expanding use of eCBSV. (Recommendation 6) |
Social Security Administration (SSA) agreed with our recommendation. On February 3, 2025, SSA updated its pricing structure for eCBSV to include additional tiers for small- and medium-sized users. SSA made this change to attract new direct users and anticipated that it would incentivize higher transactional volumes, according to the Federal Register notice announcing the change. As a result, we believe this action is consistent with our recommendation and could expand use of eCBSV.
|
| Social Security Administration | The SSA Commissioner should ensure that the Associate Commissioner of Data Exchange, Policy Publications and International Negotiations establishes performance measures and related goals for use of eCBSV. (Recommendation 7) |
We will update the status of this recommendation when SSA provides its 180-day letter (expected in spring 2025).
|