Cell Phone Texting Now a Requirement for Online Social Security Account Access

Friday, August 05, 2016
(photo: Westend61, Getty Images)




By Ann Carrns, New York Times


People seeking to manage their federal Social Security benefits online can no longer do so unless they provide a cellphone number so they can receive an access code by text each time they log on.


The change, which took effect July 30, is part of an effort to improve online security, according to the Social Security Administration. Users with online “mySocialSecurity” accounts already could choose to use texted codes as an extra layer of security, in addition to their user name and password. But now, the extra step is mandatory. Many businesses, including banks, offer such codes, but their use is typically optional.


The agency said the move was a response to an executive order issued in October 2014 that requires federal agencies to provide “more secure authentication” for online services. Adding a texted code to the user name and password is a type of multifactor authentication intended to prevent unauthorized users from gaining access to confidential information, the agency said.


The Social Security Administration’s media office said agency officials were not available for interviews, but it provided information by email and sent links to statements on the agency’s website.


The agency said that it realized the new security layer might be an inconvenience for some people. But, it added, “Our research shows that an overwhelming majority of American adults have cellphones and use them for texting.”


The shift may create hurdles, however, especially for older Americans, who are less likely to use mobile phones. About 78 percent of people 65 and older own a cellphone, compared with 98 percent of 18- to 29-year-olds, according to 2015 data from the Pew Research Center.


Comments about the change on the Social Security Administration’s Facebook page were largely negative. “Please rethink this security change,” a woman posted, in one of the more polite responses. “So many of us can’t afford a cellphone. Texting with old joints is a joke. Please find another way for all of us to use the great service at mySocialSecurity account online.”


Other comments suggested that older Americans who do have cellphones avoid using the text function because they do not want to pay for receipt of spam messages.


Some privacy advocates question whether texted codes are the best way to safeguard a user’s information.


“It’s better than nothing,” said Paul Stephens, director of policy and advocacy at the Privacy Rights Clearinghouse, which focuses on protecting personal information and preventing identity theft.


But he said basic text messaging technology can be vulnerable to hacking. He said other options, like authentication apps that create one-time codes, might offer superior protection. But, he said, such apps generally would require use of a smartphone, rather than a basic cellphone. Smartphones are less popular among older people; only about 30 percent of people over 65 use them, according to the Pew Research Center data.


Stephens also faulted the Social Security Administration for giving users scant notice of the new requirement. Some people with online accounts received notification by email over the weekend, as the new rules were taking effect. While the change is well intended, “I just think it was very poorly executed,” he said.


Technical glitches stymied some users who tried to use their accounts soon after the new text requirement took effect Saturday. Verizon Wireless customers, for instance, could not use the system until Monday afternoon. Verizon’s systems apparently were screening the text messages as spam, said Kevin King, a company spokesman, but that problem has been fixed.


The website, however, noted on Wednesday that heavy traffic might cause problems with the receipt or entry of text codes and advised users, “Please check back in a few days.”


The mySocialSecurity website, introduced in 2012, allows people who receive Social Security benefits to obtain verification letters, order replacement Social Security or Medicare cards and set up or change direct deposit of payments. Those who do not yet receive benefits can obtain estimates of future payments and check their annual earnings statement to make sure that their benefit payments are calculated using the correct information.


The online service has become more important in recent years as the Social Security Administration, like other government agencies, has sought to reduce the amount of paperwork it generates. The agency once sent earnings statements annually to workers 25 and older, but several years ago it reduced mailings and began encouraging Americans to check online. (The agency now mails statements to workers every five years, starting at age 25).


Here are some questions and answers about the new Social Security logon system:


Q: How does the new logon system work?


A: Users enter their user name and password as usual, but they are also asked to enter an eight-digit code texted to their cellphone each time they log on to the website. A texted code is now also required for people who are establishing accounts for the first time. The codes are valid for 10 minutes and can be used just once.


Q: What if I don’t use a cellphone or don’t want to provide my number?


A: For now, users can email, call or write to the Social Security Administration, or visit a local office, to request information about their benefits or earnings statements. The administration said it eventually expected to offer alternatives, but texts were the only option now because of “technical and resource constraints.”


Q: What if I lose my cellphone or get a new one?


A: If you get a new phone but keep the same phone number, you do not have to do anything, according to the administration’s website. If you lose your cellphone, you can request a cellphone reset code online, and the agency will mail you a letter with a reset code in five to 10 business days.


Q: Where can I get more information about the new requirements?


A: The administration has a list of frequently asked questions on its website.       


Leave a comment