The Public Eye with Eric Chabrow

Kindness Repaid by Exposing Your SSN

Not for Profits' IRS Returns Reveal Social Security Numbers

Make a donation to a charity, and the thanks you get could be exposure of your personally identifiable information.

See Also: Live Webinar | Breaking Down Security Challenges so Your Day Doesn’t Start at 3pm

IRS Form 990, submitted annually by tax-exempt organizations, is a public document, unlike Form 1040 individual taxpayers file. Form 990 isn't supposed to contain personally identifiable information, but some organizations include such data, nonetheless.

Everyone should refuse requests from not for profits to provide Social Security numbers. 

Todd Feinman, chief executive officer of data-loss-prevention tool provider Identity Finder, says a search his firm conducted of nearly 3 million IRS Form 990 tax returns filed for 2001 through 2006 found that 132,362 charitable organizations published 472,866 Social Security numbers, of which 171,005 were unique.

In addition, he said, more than 18 percent of all not-for-profit organizations or their tax preparers published at least one Social Security number on their public tax return. In all, 287,238 Form 990 returns contained at least one Social Security number.

Among the Identity Finders' findings:

  • Nearly 60,000 unique Social Security numbers - 35 percent of all individuals affected - belonged to tax preparers.
  • Almost 17 percent of organizations published at least one Social Security number on Form 990 in 2001; that percentage dropped to just under 7 percent in 2006. Since then, the situation has gotten better. Feinman estimates that the exposure rate has dropped to about 2 percent over the last couple of years.
  • Organizations that published Social Security numbers had listed only one or two of them. Fewer than 1 percent of published lists contained three or more Social Security numbers.
  • Victims of the Social Security number exposure included tax preparers, scholarship recipients, directors, trustees and donors.
  • Some not-for-profit organizations reported no identifying information at all, some published scholarship recipient names and some published names, addresses, Social Security numbers and detailed transaction information.

On its website, Identity Finders provides a tool that will let organizations look up to see whether they had exposed Social Security numbers in their Form 990 filings by using their employer identification number.

Feinman cautions tax preparers to avoid including personally identifiable information in Form 990, and says they should use their Preparer Tax Identification Number rather than their Social Security number. He also recommends that everyone refuse requests from not for profits to provide Social Security numbers.

After all, why does any organization except those required by law need our Social Security numbers?

About the Author

Eric Chabrow

Eric Chabrow

Retired Executive Editor, GovInfoSecurity

Chabrow, who retired at the end of 2017, hosted and produced the semi-weekly podcast ISMG Security Report and oversaw ISMG's GovInfoSecurity and InfoRiskToday. He's a veteran multimedia journalist who has covered information technology, government and business.

Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing, you agree to our use of cookies.