Social Security Administration: Actions Needed to Help Ensure Success of Electronic Verification Service
Fast Facts
Synthetic identity fraud—combining made-up and real information to fake an identity—is a growing concern for financial institutions, like banks, especially as their systems go digital.
In response, the Social Security Administration spent $62 million on a new service to help banks verify Social Security numbers. A 2018 law required SSA to recover the cost of rolling out the service from its users. However, low participation and other challenges have made it hard for SSA to recover costs—and SSA still needs to recover about $37 million.
We recommended that SSA develop strategies to get more banks to use the service.
Highlights
What GAO Found
The Social Security Administration (SSA) launched the Electronic Consent Based Social Security Number Verification service in June 2020. The service seeks to reduce synthetic identity fraud, which combines fictitious and real information to fabricate an identity. The service allows authorized entities—generally financial institutions and their service providers—to verify an individual's name, Social Security number, and date of birth electronically. SSA spent about $62 million from fiscal year (FY) 2018 through FY 2023, based on SSA data. However, SSA did not follow agency guidance for planning IT investments when estimating costs for the service. Moreover, its guidance on cost estimation did not consistently incorporate GAO best practices, such as documenting the estimation process. By establishing appropriate controls to ensure that all significant IT investments follow agency guidance and updating guidance to incorporate additional best practices, SSA could improve cost estimation for future projects.
SSA is required to fully recover the service's costs and collected about $25 million in user fees (40 percent of $62 million total costs) as of the end of FY 2023. SSA has not met its projections for fee collections due to lower-than-expected industry participation. SSA will need to collect about $14 million annually to meet its goal to recover all costs by the end of FY 2027, based on GAO's analysis (see figure). But it is unclear if SSA can meet its goal without increasing users or fees. Subscription data through December 2023 demonstrate that the service has not significantly increased users since enrollment opened in FY 2022, and fee collections decreased after SSA increased fees in July 2023.
About $14 Million in User Fees Is Needed Annually to Meet Cost Recovery Goal for the Electronic Consent Based Social Security Number Verification Service
SSA officials told GAO they did not plan to take significant steps to increase use of the service. Industry participants GAO interviewed cited several factors limiting their use, such as difficult-to-interpret verification results. SSA also had not established performance measures and goals for the service's use and benefit. SSA could better ensure the service achieves its intended purpose of reducing synthetic identity fraud by developing strategies and assessing tradeoffs for expanding its use and establishing related performance measures and goals.
Why GAO Did This Study
Synthetic identity fraud is a growing concern among financial institutions, which reported $182 million in related suspicious activity in 2021. The Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 directed SSA to combat such fraud by developing a database to electronically verify identifying information. However, questions have been raised about the service's financial viability and use by industry participants.
GAO was asked to examine, among other objectives, the extent to which SSA has (1) followed guidance and best practices for cost estimation for its Electronic Consent Based Social Security Number Verification service, (2) designed user fees to promote cost recovery for the service, and (3) taken steps to expand use and benefit of the service.
GAO reviewed relevant laws, guidance, and agency documentation and data and interviewed SSA officials responsible for the service. GAO also interviewed 16 industry participants selected to reflect a mix of entities and uses of the service.
Recommendations
GAO is making seven recommendations to SSA, including that it implements appropriate controls over IT investments, updates cost estimation guidance, develops strategies to expand use of the service, and establishes related performance measures and goals. SSA concurred with all seven recommendations and stated that it will evaluate its policies and processes to determine how to address them.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Social Security Administration | The SSA Commissioner should ensure that the Associate Commissioner of IT Financial Management and Support updates guidance for developing cost estimates for IT investments to incorporate the best practices outlined in GAO's Cost Estimating and Assessment Guide. (Recommendation 1) |
SSA concurred with this recommendation. In April 2025, an SSA official told us the agency is reviewing its cost estimation practices for IT investments and hopes to determine additional efficiencies and process improvements over the next six months. We will update this recommendation when we have further information on the implementation of any such actions.
|
| Social Security Administration | The SSA Commissioner should ensure that the Associate Commissioner of IT Financial Management and Support implements appropriate controls to ensure all significant IT investments follow the Information Technology Investment Process. (Recommendation 2) |
SSA concurred with this recommendation. In April 2025, an SSA official told us the agency is reviewing its cost estimation practices for IT investments and hopes to determine additional efficiencies and process improvements over the next six months. We will update this recommendation when we have further information on the implementation of any such actions.
|
| Social Security Administration | The SSA Commissioner should ensure that the Associate Commissioner of Data Exchange, Policy Publications and International Negotiations publishes in SSA's annual financial reports detailed information on its reviews of eCBSV user fees and any proposed changes. (Recommendation 3) |
SSA concurred with this recommendation. For its FY 2024 Agency Financial Report, SSA significantly expanded reporting on its biennial review of user fees. The expanded section includes information on the agency's review of eCBSV user fees, including details on its review process and justification for changes in the fee structure. We are closing this recommendation as implemented because these actions align with the intent of our recommendation.
|
| Social Security Administration | The SSA Commissioner should ensure that the Associate Commissioner of the Office of Data Exchange, Policy Publications and International Negotiations includes in relevant Federal Register or other public notices a detailed explanation of any changes to eCBSV user fees, such as by describing cost recovery methodologies and assumptions, recent and projected costs, and user-fee collections. (Recommendation 4) |
SSA concurred with this recommendation. SSA published notices in the Federal Register in January and April 2025 to announce an expanded fee tier structure and fee decreases. In both notices, SSA provided detailed explanation of the fee changes, including information about actual and projected costs, fee collections, and users, as well as an update on progress towards full cost recovery by FY 2027. We are closing this recommendation as implemented because SSA's actions align with the intent of our recommendation.
|
| Social Security Administration | The SSA Commissioner should ensure that the Associate Commissioner of Data Exchange, Policy Publications and International Negotiations develops a process for soliciting input from stakeholders on changes to eCBSV user fees prior to their implementation. (Recommendation 5) | SSA concurred with this recommendation. In April 2025, an SSA official told us the agency plans to document a process for soliciting input from stakeholders prior to implementing a change in eCBSV user fees by June 30, 2025. The official also noted that SSA regularly meets with stakeholders and industry groups to obtain their feedback on the eCBSV program. According to meeting minutes provided by SSA, the agency met with and solicited input from eCBSV users on changes to the fee tier structure in September 2024 prior to their implementation in February 2025. This recommendation remains open until SSA provides documentation of its new process to solicit input from stakeholders on changes...
|
| Social Security Administration | The SSA Commissioner should ensure that the Associate Commissioner of Data Exchange, Policy Publications and International Negotiations develops strategies and assesses tradeoffs for expanding use of eCBSV. (Recommendation 6) |
Social Security Administration (SSA) agreed with our recommendation. On February 3, 2025, SSA updated its pricing structure for eCBSV to include additional tiers for small- and medium-sized users. SSA made this change to attract new direct users and anticipated that it would incentivize higher transactional volumes, according to the Federal Register notice announcing the change. As a result, we believe this action is consistent with our recommendation and could expand use of eCBSV.
|
| Social Security Administration | The SSA Commissioner should ensure that the Associate Commissioner of Data Exchange, Policy Publications and International Negotiations establishes performance measures and related goals for use of eCBSV. (Recommendation 7) |
SSA concurred with this recommendation. In April 2025, an SSA official told us the agency is developing strategies, performance measures, and goals for eCBSV and expect to have initial workgroup recommendations by September 30, 2025. This recommendation remains open until SSA provides documentation of such performance measures and related goals for the eCBSV service.
|