SSA database to flag synthetic identity fraud has cost issues, GAO finds

The Social Security Administration is off track on recouping the costs it took to create and maintain a database aimed at helping banks catch a form of identity fraud, a new watchdog report found.

Launched in June 2020 to comply with the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018, the SSA’s electronic Consent Based Social Security Number Verification (eCBSV) service was pitched to financial institutions as a way to combat synthetic identity fraud, a practice in which bad actors combine fake and real information to generate a fraudulent identity. 

According to the Government Accountability Office, the Social Security Administration has spent roughly $62 million on the service but has taken in just $25 million in user fees, putting it off pace to meet the law’s requirement to fully recover the service’s total cost by the end of fiscal year 2027.

To reverse course and meet that target, the SSA would need to bring in about $14 million yearly, per the GAO’s analysis, though that would likely require the agency to bump up fees or grow its user base. But “SSA officials told GAO they did not plan to take significant steps to increase use of the service,” the report noted.

The eCBSV database is available to certified financial institutions. For an annual fee to cover development and operating costs, the service will verify for banks if an individual’s Social Security number, name and date-of-birth combination is a match with SSA records, rooting out fraudsters in the process. The financial entity must obtain an individual’s written consent to use the database.

The service was developed in response to the increasing frequency and impact of synthetic identity fraud — 3,000 activity reports for suspicious, potentially synthetic identities were made in 2021 alone, amounting to about $182 million in possible fraud, per the Financial Crimes Enforcement Network. Those figures likely underestimate the problem, the GAO noted, given the fact that “many cases may go undetected and be reported as a credit loss rather than fraud.”

In launching eCBSV, SSA developed three new IT systems and contracted external customer support, totalling $30.8 million in costs — about half of the service’s total costs through FY2023, according to the GAO. Costs ran higher than initial projections due to unforeseen delays and complications, an expansion of use and expenses that were not initially accounted for by the agency.

The GAO said SSA “did not follow key aspects of IT investment guidance when estimating costs for eCBSV,” nor did the agency “develop an IT investment proposal specifically for eCBSV.”

The Social Security Administration, which has shifted its cost-recovery timeline three times, did increase user fees in July 2023, but “fee collections have not met SSA’s projections because the number of direct users has been lower than expected,” the GAO reported. And “based on SSA subscription data we reviewed through December 2023, the number of eCBSV direct users has not increased significantly since the service opened enrollment in FY 2022.”

The watchdog provided SSA with seven recommendations, pushing the agency to provide updated cost estimates based on GAO guidance, solicit feedback from stakeholders on changes to user fees, and develop performance metrics tied to use of the eCBSV, among other goals. The GAO report did not include SSA’s responses to its recommendations.