The Mathematics Of Proving (Or Disproving) Identity Fraud

from the brush-up-on-your-probability dept

Here's a fun one by Thomas O'Toole, looking into a lawsuit by the US gov't against a guy who committed identity fraud to apply for emergency disaster relief after Hurricane Katrina. Basically, the entire case hinged on a bit of probability. The guy had applied for aid using 15 different social security numbers on 15 different applications. Here's the thing: the law he was charged under says that it's a crime to "knowingly" make use of someone else's identity. In other words, it's only identity fraud if the guy knew he was using someone else's SSN. If he just made up the numbers, and they all turned out to be legit by luck, then he could say he did not knowingly commit fraud on the people who those SSN's actually applied to. So, here's where the probability part comes in. As O'Toole notes, if you just take a guess, you actually have about a 50% chance of getting an actual SSN (which doesn't seem like a very good system). But to get 15 correct guesses in a row? Well, simplifying things a bit, the probability of guessing right 15 times in a row is about 0.0003.

So, the government argued, there was a 99.997% chance that the guy, Gregory Parks, must have known that the SSNs he was using came from real people, and thus, he was guilty of knowingly using their SSNs, against the law. But Parks and his lawyers went a little deeper, and pointed out that the original calculation was wrong, in that it way over-simplified things:

The first three digits of a social security number are known as "area numbers." These numbers correlate to states. All of the numbers Parks used had Texas or Louisiana area numbers. Except for two: one had an Oklahoma area number and the other a Michigan area number. Area codes are published on the SSA website.

The SSA also publishes on its website information indicating the extent to which the second pair of digits in a social security number -- the "group number" -- have been assigned. In Parks' case, this information indicated that, for the 13 social security numbers he used in the Texas and Louisiana area codes, the two-digit "group number" was 99, meaning that nearly all of those numbers had been assigned. Louisiana and Texas were the areas hardest hit by Hurricane Katrina.

The group numbers for the two other area numbers used by Parks indicated that the social security numbers for those areas were not assigned to such an extent. For area number 446 (Oklahoma), the group number was 19 (out of a possible 99); for area number 372 (Michigan), the group number was 31 (again, out of 99).

All of this extra information dramatically increased Parks' odds of randomly guessing valid social security numbers. According to the court, the new math looked like this:

1 * 1 * 1 * 1 * 1 * 1 * 1 * 1 * 1 * 1 * 1 * 1 * 1 * 0.59 * 0.65 = .38

Thus, with a little knowledge about how the SSA doles out social security numbers, Parks had a 38 percent chance of "randomly" choosing 15 valid social security numbers.

According to the court's math. And that was the math that counted here. The court ruled that the high odds of making 15 educated guesses about social security numbers was sufficient to vacate Parks' conviction

While amusing, this does raise a few points. First of all, it highlights how ridiculous it is to use Social Security Numbers as identifiers, given just how easy it is to guess legit SSNs. Second, it makes you wonder why the law dealing with identity fraud cares one way or another if the fake SSN was used "knowingly" or not. The guy still was guilty of mail fraud -- so it's not like he gets off completely free. But does it make sense that the laws on identity fraud only apply if you know that the SSN you're using is someone else's, but doesn't apply if you just make it up?

Filed Under: identity fraud, odds, probability, social security numbers