52

One of my employer's customers wants everyone's DOB, last 4 digits of my Social Security number, state of residence and full name. I am not comfortable with this.

They explained it is to keep track of their former employees, I am not doubting their reason, but I think too much can be developed with this information in the wrong hands...

  • 49
    Not just no, but hell no. And why does a customer need to keep track of former employees of your employer? – Chris E Nov 10 '14 at 19:48
  • 19
    Hey, that's the kind of security question that my bank asks me when they want to verify that I am the person whom I claim to be! I wouldn't comply with this request. Period. Usually, this kind of request comes in writing and with a written statement guaranteeing that the privacy and confidentiality will be protected, and describing to what use the information will be put to. – Vietnhi Phuvan Nov 10 '14 at 19:52
  • 9
    they probably want to confirm that none of their former employees are being sent as contractors. Assuming your manager cares what you think, it sounds safer for them to send the list of former employees and your management to confirm none of you are on the list. That keeps your information private. – Kate Gregory Nov 10 '14 at 19:58
  • 2
    What's the relationship between your employer and the customer? Do you perform work for these customers as a contractor (customer signs a contract with the people who sign your paycheck, you go to their site and perform work for them)? Are the two companies partners? Does your company sell a product/service to these customers? – alroc Nov 10 '14 at 22:06
  • 11
    I'm not 100% sure, but I'm 94.6% sure that it's illegal for them to hand over some of this information without your consent. – corsiKa Nov 10 '14 at 23:24
97

I was asked the exact same thing many years ago and here is how I handled it. Actually, I was asked for the full social. They asked for the information for me and my small staff. The request came through my company's lawyer. So I was dealing with my company's lawyer and the lawyer was dealing with the client. This was just as SSN was becoming a very sensitive number.

  1. Me: "What do they need it for and how they would protect it?"

  2. Lawyer: "What do you think they will use it for?".

  3. M: "I don't know, but before I give my information I need to know that".

  4. L: "I think they want to do a background check on you".

  5. M: "Oh, then I will also need a copy of what they find."

  6. L: "They don't want to do it right away".

  7. M: "Okay, well I will just give it to them when they need to do the background check".

Some time passes...

  1. L: "They just need a number to uniquely identify you in their system."

  2. M: "I reply back with 7 digit phone numbers of each of my staff (prefixed with 99 so there will be no collision with real SSN)."

  3. L is a bit irritated with me at this point; unbeknownst to me, bad mouths me to VPs.

  4. M: I calmly restate that I will be happy to give this information if they can tell me what they need it for and how they will protect it.

  5. L takes some time to find the security person in the client's office.

  6. Security person tells L that she agrees with us that we should not give out this information and takes the phone numbers as alternative.

  7. I got apology email from lawyer and an in-person apology from VP.

  8. Security Person changed policy and communicated to Administrative staff to stop requesting SSN.

It is important that I remained very professional with not a hint of sarcasm during this whole exchange. I also made the point that I was willing to give them this information if there was good reason. I believe a financial institution can and should do background checks on the people working on their systems. If the client would have responded that they need it for a background check I would have responded that I would be happy to give it to the entity that does the check directly rather than passing it through the client's hands.

Once we were on their systems I noticed that the userids were 3 initials and 4 numbers. I am guessing the 4 numbers were the last four digits of the persons SSN. Our userids did not follow the same pattern and used sequential numbers.

By not taking an outwardly hard stand that I would not give my SSN it gave time for everyone to work through the process learning that they should not use SSN. Had I taken a hard stand they might have focused on my being obstinate rather than looking at the policy as the problem.

  • 10
    That was really badass.. – Wesley Brian Lachenal Nov 12 '14 at 8:16
  • they must have wanted you badly. Badly enough to put up with it rather than just go to another guy who did as he was told without question... – jwenting Nov 12 '14 at 10:09
  • 2
    @jwenting typically this boils down to where, why, and how you take stands. You must always remain professional, even when those around you do not, you must also have valid reasons for your actions, and provide the requester an opportunity to provide their own. (sometimes they have better reasons than you will) You also must take stands only where appropriate. I often am at odds with my boss on some issue or another, primarily because he wants it now, I want it right, ultimately our goals are aligned just our plan of action is at odds. You just have to find a way to make both parties happy. – RualStorge Nov 12 '14 at 19:25
  • @jwenting And that's why you have to decide where to take a stand, and how hard to push. Once you say no, there's a possibility you'll lose the contract. How likely do you think that is to happen? Is it worth it? If a customer demands personal information -- or makes any sort of demand, for that matter -- and you ask "why do you need this?" and their reply is "well if you won't do it forget it, don't call us back", you might regret losing the sale, but in the long run that customer would likely be difficult to work with in a 1000 ways. – Jay Jun 2 '16 at 14:25
70

This sounds like a Social Engineering exploitation. Not only should you not answer this request, you should report this guy to your supervisor.

  • 3
    Emphatically yes. Tell your supervisor, and let the two companies argue about it. They have no legitimate need for this info. – keshlam Nov 10 '14 at 23:05
  • 2
    Unless of course they need it for security clearance is this customer what I (in the UK) would call a List X company not sure what the equivalent term is for the USA - though id bet a case of Moet that its a company with delusions of grandeur – Pepone Nov 10 '14 at 23:44
  • 11
    @Pepone In the U.S., if your job needed a security clearance, you'd know. And it would require a whole lot more information than what is described here. That information would also be submitted directly to the federal government's Office of Personnel Management (OPM) on a standard government form, not to some client. – reirab Nov 11 '14 at 4:34
  • Regarding this answer, my impression was that the request came via the OP's supervisor. I agree completely that, if this was not the case, the OP should definitely report it to her supervisor. – reirab Nov 11 '14 at 4:37
  • @reirab yes I know that was being "ironic" – Pepone Nov 12 '14 at 1:03
11

There is absolutely no reason to comply with this.

If they want to ensure that your company doesn't send over former workers, the only thing they need is the name of the worker. They can check that against their database. If a match is found then your company and theirs can take a closer look at that specific individual.

If they want to ensure that the people your company sends over passes a background check, your company can either provide the results of the background checks or provide the necessary information to a known third party whose job it is to conduct such checks and have them do the research.

If they insist on this type of information, then you should counter that you need assurance that the data is properly secured. This "assurance" should include a list of everyone, including their SSN's, DOB, and address, who will have access to the data. You should also demand that they acknowledge legal liability plus a potential of huge financial damages via written contract in case it is found that this information was lost or stolen from their possession. This negotiation should be handled by the CEOs of both companies so that the seriousness of it is completely understood.

The point is, this isn't a normal request and there are likely many ways to accomplish whatever it is they think they need to.

  • And if they still insist... It is possible, and sometimes appropriate, to fire a customer. "The customer is not always right. The customer has the money. Sometimes being right is more important than being paid." – keshlam Nov 12 '14 at 7:32
  • @keshlam that's nice if you're a big company with a lot of customers. If you're a small company and they're a big customer, losing that customer may mean the end of your company. Seen it happen (though that was with a customer on their own deciding to reduce the fees he would pay us retroactively by 30%. We had no recourse but to suck up to it as without even that reduced amount we'd be bankrupt in weeks. We did start looking seriously for other customers of course). – jwenting Nov 12 '14 at 10:12
  • 1
    Sometimes you can't. Usually you don't want to. But it's worth remembering that sometimes you can. It's a good fantasy for blowing off stress with, anyway. :-P – keshlam Nov 12 '14 at 11:52
  • 1
    @keshlam I agree completely, I'd rather have to figure out how to pay the bills without someone than do something I ethically or morally was against. That said, I've never fired a customer for this, but I've fired a post employer for it. (which for the record feels REALLY good in your head) In person it's a mixed bag of concern what your next move is and pride that you did the right thing. I imagine this is exactly how it feels to fire a big customer. – RualStorge Nov 12 '14 at 19:36
1

The only valid reason for this is if the customer wants to perform a background check. I actually complied with a similar request in the past. The customer was a financial institution, and they wanted to establish trust that I would not divulge any trade secrets or other protected information I may have come across. None of my information went to the customer except for my name (not too sensitive, since I was emailing them and talking on conference calls using my full, real name). The company that performed the background check did receive my info and the paperwork was very clear about the use of my information.

In your case it sounds like this is not the reason, so I would respond with "no." There are other ways to establish that you are not a former employee, such as sharing your full name. In the event that there is a false positive, maybe have you sign a document stating that under penalty of perjury you are not a former employee. That gives the customer the CYA they need in case they get nailed with a lawsuit about trying to skirt taxes and benefits by moving employees to contractors without going through the proper process.

  • a known independent third party is always key when handing over any sensitive data like this... they want background checks, sure data will be provided to the known vendor providing this service at such time it's to be acted on. – RualStorge Nov 12 '14 at 19:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.