Several deposit accounts receive payroll deposits from an employer where the identification number in the ACH file includes the depositor's social security number. This SSN is printing on our statements as part of the ACH description.

What risks does this present for our bank?
[The employer is not our bank's customer, so we are only the RDFI.]

We've begun masking all but the last four digits in any 9 digit numbers that show up in the Customer ID field because of this potential identity theft problem. This is where Originators mostly place these numbers. We've seen other states require this, but we decided to do it on our own. We've gone out to our own Originators asking that they don't place SSN numbers in their ACH transactions, but for those that continue to do so, as well as for those that come in from the ACH network, we wanted to mask whatever looked like an SSN before it became a larger issue.

Most core processors have this option as long as the number looks like a TIN - to mask all but the last four. But it has to meet certain criteria. There is probably another option, but most business customers would not be happy about it - and that is to prevent the individual ID field from printing. It's something you have to change in the specs of your core.

Our core processor claims not to have the capability to mask SSNs. They say they can block this field from all statements, but not specific ones. Does anyone have any other suggestions?

New core processor? Just kidding. Who's your core?

Sounds like an issue we are having here. Do you use ITI?
One of our bill payment reports lists customers by name and whole TIN. I brought the issue up in an internet banking audit and apparently the report is canned and the Bank has no control over the fields. The best they said they could do is write ITI and if they get enough requests they might eventually change the specs on the report...

Yes, it is ITI! In our last conversation with them, they said they are now in the process of "testing", and hope to be able to mask SSNs later this year. Maybe there is hope (eventually).

ITI can currently mask them. Oh my goodness. I was at an ITI bank, and I had that done. It's in the SPECS, I promise to you. It doesn't make the SSN number disappear, but here's how it works: It checks the Individual ID field and if there is a nine digit number in that field (or a letter + 9 digits), it will "mask" everything but the last four digits with the letter "x". I'm sorry I cannot remember the details, and I don't feel comfortable revealing the name of my former employer in a public forum.

Maybe they only have the abilility to mask them on certain reports???

I've talked to management multiple times on this issue and they assure me that they are unable to mask them and that they have contacted ITI and ITI has indicated that they currently are unable to (at least on this specific report).

I'd be a lot more concerned about statement with SSNs appearing that about internal bank reports. Provided, of course, that the bank has an adequate data security program that includes destruction of those reports at the appropriate time.

I am 100% sure that with ITI you can mask all but the last four digits of the SSN on customers' statements (I was never speaking of reports).

If I could be 1000% sure, I would tell you I was that, too.

It's in the SPECS in an odd place, but I know for sure it's there. I did it at my former FI, myself (obviously with help from the techy peoples).