Protect your SSN!

Quietly-explosive news last week for anyone who cares about consumer privacy in digital banking and access to credit. Your help is needed -- read on!

In the US, financial service providers are required to properly ID their customers, which is a good thing. Financial Crimes Enforcement Network (part of US Treasury responsible for fighting financial crimes, such as money laundering and terrorist financing) issued a request for comments last week on how this customer-identifying info is best collected.

More specifically, FinCEN wants information and comments on how Social Security Numbers are collected to satisfy the Customer Identification Program (CIP) requirements, which is just fancy for "gotta ID your customers by knowing their Social Security Number."

The actual industry practice for banks, credit card companies, and fintechs (including Affirm) is to collect identifying info (name, address, etc) and only the last 4 digits of SSN, then use a third-party service (eg a credit bureau) to match all this up to the full 9-digit SSN.

The reason for this practice is because it's freakin' scary to put in your full 9-digit Social into an online form. You might have a keystroke grabber on your PC or malware on your phone. Someone could be looking over your shoulder!

This approach has served us well for 20+ years, and has allowed financial service providers to have excellent records of customer identity management while preserving folks' privacy. The matching tools we have now are also very sophisticated and accurate.

Another national banking regulator, OCC, consulted with FinCEN as recently as 2020, and issued a formal letter (IL#1175) enshrining this practice as an acceptable way to process payments online for national banks using this last-4 and match SSN verification process.

The OCC determined that collecting last-4 of SSN “does not present any additional risk for money laundering activity or terrorist financing” and is “consistent with safe and sound banking practices.”  http://bit.ly/4aBdMRi

But!! FinCEN is now asking (everyone): Do you feel safe with this last-4 and match SSN process, or should we mandate that everyone types in their full 9-digit SSN when paying online? Obviously, many people think this is a truly terrible idea. 

If the "you must type in full 9-digit SSN" becomes the official interpretation of the CIP rule, consumer privacy risks will go up exponentially. The consumer champion Rep. Maxine Waters wrote as much in a recent letter to banking regulators -- http://bit.ly/4cGIXga -- we already have a good way to ensure customer identification and preserve privacy!

Please join me in making your voice heard by May 28th by commenting here: https://www.regulations.gov/document/FINCEN-2024-0009-0001 .

Because last-4 + match works really well and we don't want our SSN needlessly exposed!!

Thank you for reading and acting!

--Max