Thousands of nonprofits are putting the identity of scholarship recipients, board members, employees and even donors at risk by including their social-security numbers in the annual Form 990 tax return they file with the Internal Revenue Service, a new study says.
The study, by Identity Finder, a data-loss-prevention company, searched 2.89 million Form 990s filed with the IRS for the years 2001 through 2006 belonging to 728,847 organizations.
For that six-year period, the study found that 132,362 nonprofits published a total of 472,866 social-security numbers on their tax returns, which are public documents.
Of those social-security numbers, 171,005 were unique, with the larger number reflecting the fact that some numbers were posted on multiple returns.
At least 59,890 of the unique social-security numbers, representing 35 percent of all individuals affected, belonged to tax preparers.
The percentage of nonprofits that published at least one social-security number on their Form 990 fell to 6.8 percent in 2006 from 16.6 percent in 2001.
Most nonprofits that published social-security numbers include only one or two, and less than 1 percent published lists that contained three or more.
Some nonprofits reported no identifying information at all, some published the names of scholarship recipients, and some published names, full addresses, social-security numbers, and detailed transaction information.
“The practice of including social-security numbers in public tax documents is decreasing, but advocacy organizations, alumni associations, community and scholarship foundations, and private trusts have all published lists of names and social-security numbers, unknowingly placing personal information permanently in the public domain,” the study says.
“Scholarship recipients, tax professionals, employees and donors,” it says, “now face the prospect of living the rest of their lives at increased risk of identify fraud.”
The study makes a series of recommendations to protect against disclosure of personal information.
Donors should not share their social-security number with charities, for example, and scholarship applicants should review the most recent Form 990 of any foundation before submitting an application to make sure their personal information will not be published.
Charities should avoid placing personal information on public documents, and those that have published social-security numbers should warn those affected that they may be at increased risk of identify fraud, the study says.
Everyone should require any organization to justify a request for his or her social-security number and should not be afraid to refuse to provide it, the study says.
And the IRS should and other stewards of past 990 filings should provide only redacted copies of the forms, or forms with sensitive information removed, it says.