The Fair Credit Reporting Act allows any company or organization access to a consumer's credit report as long as it can demonstrate a permissible purpose for pulling credit records. One example of a permissible purpose as defined by the FCRA is a creditor's right to periodically review its clients' credit files. Once an individual's debt is remanded to a collection agency, the agency becomes a creditor and can legally access the debtor's credit report--which contains personal information such as his address, date of birth and Social Security number.
A collection agency's purpose is to collect consumer debts. Whether it works in conjunction with the original creditor, or purchases the account and collects independently, the original creditor provides information about the debtor to the collection agency to facilitate the debt collection process. If the original creditor possesses the debtor's Social Security number, it may turn that information over to the collection agency--along with any other information it has about the debtor--when the debt is sold or transferred.
Some consumers believe that a collection agency already has Social Security numbers when, in fact, it does not. The Fair Debt Collection Practices Act prohibits debt collectors from making false representations about the collection agency itself or its intentions, but this doesn't stop the practice from occurring. Thus, a debt collector may claim to already know the debtor's Social Security number in an effort to coerce the debtor into voluntarily giving up the information. Some collection agencies even send out form letters asking debtors to "verify" their information in order to obtain missing Social Security numbers.
A 2006 report by the United States Government Accountability Office states that public records about an individual, such as bankruptcy petitions and property records, often contain the individual's Social Security number. Public records, and the personal information they contain, may be accessed by anyone. As long as a collection agency knows an individual's address, it may investigate any public records that exist about the debtor in that county in an effort to obtain his Social Security number.
Collection agencies occasionally have the Social Security numbers of consumers who do not legitimately owe a debt due to identity theft. When identity theft occurs, the thief steals a consumer's personal information to apply for new credit in the innocent victim's name. The thief often uses the victim's Social Security number when applying for fraudulent accounts. The unpaid debts are then sent to collection agencies--along with the Social Security number of the victim.