Verifying people who don't have a Social Security number

Most identity verification scripts written in the United States have a Social Security number somewhere in them. It shows up as the last four digits on a help desk checklist, and as the question an agent falls back to when the caller cannot answer anything else.

The agency that issues the number describes it more narrowly.

“Some organizations use your SSN to identify you in their records. Most, however, will identify you by some other means if you request it.” (Social Security Administration, Social Security Numbers for Noncitizens)

That line is written for the public rather than for security teams, and it treats the SSN as a convention organizations adopt and can drop. It is also a fair description of where the number now sits as a verification signal, for two reasons that have nothing to do with each other. A sizeable share of the people your help desk serves do not have one. And asking for it puts your organization in the business of storing a field attackers particularly want.

The second problem is the one security teams tend to see. The first is the one that generates the ticket.

Who does not have one

The SSN is a United States artifact, and eligibility for it is narrower than most enrollment flows assume. The SSA states the rule plainly:

“Generally, only noncitizens authorized to work in the United States by the Department of Homeland Security (DHS) can get an SSN.” (Social Security Administration, Social Security Numbers for Noncitizens)

That single sentence covers a lot of ground in a large organization.

Anyone outside the United States. If your company employs people in Manchester or Bangalore, or serves customers there, the SSN field is not a fallback for them — there is nothing to fall back to. A verification design that treats the SSN as the last resort has quietly scoped itself to one country.

Work-authorized arrivals who have not received one yet. The gap is procedural and the SSA documents it. Its guidance recommends waiting ten days after arriving in the United States before applying, and gives applicants 45 days to complete the process in person once started. A new hire can be lawfully present, work-authorized, on payroll, holding a corporate account, and hold no SSN during that window.

People who hold an ITIN instead. The IRS issues these to people with a federal tax obligation who are not eligible for an SSN, and it is explicit that the number is not a substitute identifier:

“An ITIN is a 9-digit number the IRS issues if you need a U.S. taxpayer identification number for federal tax purposes, but you aren’t eligible for a Social Security number (SSN).” (Internal Revenue Service, ITIN guidance)

The same IRS page lists what an ITIN does not do, and one entry on that list is “serve as identification outside the federal tax system.” An agent who accepts an ITIN in place of an SSN is using a number for a purpose its issuer disclaims.

Dependents and family members on a shared account. Health portals, loyalty programs and utility accounts routinely carry authorized users who never had a reason to supply one.

Alumni, retirees and former patients whose record predates the point where your institution stopped using the SSN as a primary key, and whose file has now outlived two generations of the credential system that created it.

Every one of these people can be entirely legitimate and still fail a script that ends at the SSN question. The agent is then choosing between refusing a real person and improvising, and handle-time targets tend to settle that.

The half of the problem that is about your organization

There is a second argument for dropping the SSN from a verification flow, and it holds even where every user has one.

A stored SSN is a liability that earns nothing. It sits in your systems as a permanent record, useful to an attacker for years after it leaks, and the person it belongs to has no practical way to change it. So your organization ends up guarding something an attacker wants badly and the owner cannot replace, in exchange for a signal that stopped proving much a long time ago.

Trusona has written up why knowledge-based checks stopped working in Moving Beyond Knowledge-Based Authentication, so this piece will not re-run that case. The relevant part here is narrower: an SSN you never collect is an SSN that cannot be exposed in your next incident.

Ask the document, then ask the state that issued it

If the SSN is out, the question becomes what an agent can check instead that a first-time caller will actually have.

The answer sits in the same SSA publication, in a sentence written to reassure people rather than to make a security point:

“Although many companies, such as banks and credit companies, may ask for your SSN, you generally aren’t required to provide one if you don’t have one. You can get many services without an SSN, including getting a driver’s license.” (Social Security Administration, Social Security Numbers for Noncitizens)

In many states, the document your verification flow most wants to see is available to people who hold none of the identifier your flow is asking for. The government-issued ID survives the gap that the SSN opens.

Scanning that document and looking at it does not accomplish much on its own. Generative models produce convincing images of identity documents cheaply, and a careful visual inspection is a test they now pass. What changes the result is putting the question to the authority that issued the document. In the United States that means the state DMV, reached over the AAMVA network, and the agent is no longer asking whether the license looks right. They are asking whether the issuing state has a record that matches it. Forgery quality has nothing to contribute to that answer.

Two things follow from that design, and both matter specifically for the populations above.

It works outside the United States. ATO Protect reads more than 2,500 identity document types worldwide. A Portuguese national ID card is checked the same way a Texas license is, which is the property that makes the approach usable for a workforce that is not exclusively American.

It works on a first interaction. Nothing in the flow asks what the person set up beforehand, so a day-one hire and a graduate from 2009 take the same path. That property has its own piece — how to verify users without pre-registration — and it is a different question from this one. Someone can be fully enrolled in every system you run and still have no SSN.

The same request carries two more signals. Mobile network operators can report when a number moved to a new SIM recently, which tells an agent more about a reset request than the directory will. And man-in-the-middle and replay detection establish that the scan is live on the device in front of the user, instead of a recording pushed through from somewhere else. Trusona’s implementation is patented (US Pat. 10,601,859).

Where this runs out

This approach has an obvious hole in it, and it is a version of the one the SSN has. It assumes a document.

Someone holding no government-issued identity document at all cannot be verified this way. That group is smaller than the group without an SSN, it is not empty, and it needs an answer this piece does not have. Ask a vendor what their flow does for that person, and treat a confident reply as a reason to keep asking.

The check is also an answer about one request at one moment. It tells an agent who is on the line. It has nothing to say about what that person should be allowed to do once they are through, which remains the job of access control and the monitoring behind it.

What changes is the basis for the decision. The agent stops weighing whether an accent fits the name on the account and starts reading a result.

Six checks before you buy

Run these against any product that claims to handle users without an SSN.

1. What is the comparison actually made against? If the answer is a credit header file, a data broker record, or anything else keyed on the SSN, the product has moved the dependency rather than removed it. 2. Which countries does it cover, and how many document types? “International support” is a claim that dissolves on contact. Ask for the number and the list. 3. Is the issuing authority queried, or is the document merely inspected? These are different products at similar prices. 4. What is retained after the session? A verification that stores a face template or a document image has created a new permanent record about a person who came to you specifically because they had no such record. 5. Does the flow degrade to an SSN question when something fails? Fallback paths are where the original dependency usually survives. 6. Can it verify someone with no record in your systems at all, today, on the first attempt? If the vendor qualifies that answer, the qualification is where your uncovered population lives.

The first and the sixth carry the most weight. The rest are ways of checking that the answers to those two were honest.

Trusona’s ATO Protect puts the caller’s government-issued ID to the authority that issued it, in real time. No SSN is requested at any stage, and there is no app to install and no selfie to take. It runs no liveness check, because generative AI defeats those. All user PII from the verification session is deleted, so a check run today does not turn into a record you have to protect tomorrow. Verification reaches NIST IAL2, on SOC 2 infrastructure. Agents can work from a web portal immediately, or the ATOP API can put the same check inside a workflow you already run. See ATO Protect use cases or the IT help desk deployment.

The University of Connecticut uses it for NetID password recovery, verifying students, staff and alumni against a government-issued ID in under a minute. A research university carries about as internationally mixed a population as any employer in the country, and the same flow handles all of it.

Frequently asked questions

Can you verify someone’s identity without a Social Security number? Yes. A government-issued identity document can be checked against the authority that issued it — in the United States, the state DMV over the AAMVA network — which confirms a matching record exists. That check does not involve the SSN at any point, and it works for people who have never been issued one.

Who is likely to have no SSN? People outside the United States, noncitizens who are not authorized to work in the US, work-authorized arrivals who have not yet completed the application process, and people who hold an ITIN instead. The Social Security Administration states that generally only noncitizens authorized to work by DHS can get an SSN.

Can an ITIN be used instead? The IRS says no. Its guidance lists “serve as identification outside the federal tax system” among the things an ITIN does not do. It is a tax processing number issued to people ineligible for an SSN, and treating it as an identity credential uses it for a purpose its issuer disclaims.

Can someone get a driver’s license without an SSN? The Social Security Administration’s own publication says you can get many services without an SSN, including a driver’s license. Requirements vary by state. The practical consequence is that the document a verification flow wants to see is often available to people who have no SSN to offer.

Is dropping the SSN question less secure? The opposite, on both counts. Knowledge of an SSN has been a weak signal for years because the answers circulate in breach data, and storing SSNs creates an asset an attacker wants and the owner cannot rotate. Checking a document against its issuing authority replaces a shared secret with a record held by a third party.

Does this work for people outside the United States? Yes. ATO Protect reads more than 2,500 identity document types worldwide.

What happens to the ID after verification? All user PII from the verification session is deleted. Trusona runs on SOC 2 infrastructure, and its trust portal is at trust.trusona.com.

A verification flow that ends at the SSN question works for the users who were already easy to verify, and stops at the ones who call.