Just when I have everyone in my bank convinced I know what I am talking about, someone comes along and proves me wrong. Some months ago the FDIC sent out a filing that said banks could not rely solely on social security numbers for verification purposes. Everything was fine until someone with power in my bank obtained a loan from another LARGE bank. He was able to sign up for online banking information for his loan my knowing only the loan number and the last four digits of his social security number. Once he signed up, he was able to obtain information about his loan from the bank’s online banking program. How can they do that and not violate customer information security guidelines?

Just because a big bank does it, doesn't mean they are right. That is NOT a preferred practice. It may be that they are still refining their processes or "to big to fail" because to them this is a small part of what they do and they could easily absorb any problems.

There have been discussions in the past about banks not using SSANs for anything other than tax reporting. Avoiding use of these numbers now will make that potential problem so much easier.

In addition to Andy's comments, after 12/31/03 in California, or for any of your customers in California, you can not use the SSN for any identification card or other that tax collection and reporting purposes. It is playing havoc in healthcare and insurance since they have relied on the SSN as their patient identifier for years.