0

My employer is setting up a portal on their computer for me to see my weekly checks. The portal will require me to sign in with my employer number and also four digits of my Social Security. I receive a hard copy of my check weekly and have no plans to get inside the portal. Is it legal for the employer to use my Social Security number to set up this portal for the first time? My concern is if I never get in and change the password anyone can have access just knowing My employee number and my Social Security number.

9
  • 3
    Can you access it and change the password? Dec 5, 2019 at 20:35
  • 2
    "My concern is if I never get in and change the password anyone can have access" If there is only one computer shared with all of the employees, anyone can get in and basically do anything. Personally, I would not enter any personal information into this computer ever.
    – sf02
    Dec 5, 2019 at 20:50
  • 4
    Is this portal a homebrew solution, or something purchased from a reputable payroll software company? There are so many reason your employer shouldn't try and do this themselves.
    – Seth R
    Dec 5, 2019 at 21:01
  • @JoeStrazzere, My mistake. I didn't know that the "social security number" was called something else in most other English-speaking countries. Dec 6, 2019 at 1:55
  • 1
    @JoeStrazzere, That's an excellent feature request. It could just be an automated suggestion, not a mandatory one. Has this feature request been made already? Dec 6, 2019 at 2:16

3 Answers 3

4

How many of your coworkers know your social security number? This isn't an unusual thing by any means. I've worked for companies with time-clock software that use last 4 of SSN as the login. If you're that concerned about it, then just sign in once and change the password. But realistically speaking if someone had your SSN and a vendetta against you they could do much worse to you than just looking at your pay stubs.

2

This is absolutely normal. Many insurance, HR, etc systems use this as a first time verification because it’s the one confidential bit of information that the company has collected from you. Some systems use is persistently - this is sketchier but people should not know your SSN, you should keep that like it’s a password. And if you can change to a real password, then do so.

2

My concern is if I never get in and change the password anyone can have access just knowing My employee number and my Social Security number.

Your concern is valid. SSN is an identifier, it is not a secret. It should never be used as a secret because it was not designed for that.

Your instinct is right. You should change your password as soon as possible. If you cannot - for any reason - the privacy concern is big enough to raise this with HR. If that happens, I'm sure we'd welcome another question here.


Setting the initial password the same as the 4 digits of your SSN is bad practice, but not necessarily "evil". It's common to set initial passwords to something already known to the recipient, and the person who made that decision might not have been technical.

Sidenote: The last 4 digits of your SSN are enough to infer the entire SSN, if someone knows your year and place of birth.

1
  • 3
    The last bit is only true for those born in recent decades when SSNs are assigned at birth. I only got an SSN in my early teens when I started working, and that was completely normal. If I recall the change took place when SSNs started being required for all claimed dependents for income tax, either late 70s or early 80s.
    – Jon Custer
    Dec 7, 2019 at 16:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .