October is a spooky month for cybersecurity awareness

The irony is not lost on me — nor should it be on you — that National Cyber Security Awareness Month falls at the same time we celebrate Halloween.

When it comes to money, one of the scariest things happening right now is the insecurity of our financial information. The fast food chain Sonic just became the latest company to reveal that hackers gained access to customers’ data. This time it was debit and credit card information.

Meanwhile, Equifax has revealed that 145.5 million consumer accounts were compromised by a data breach. And Yahoo announced last week that every single account it had was compromised in a data breach that occurred in 2013.

The Department of Homeland Security and the National Cyber Security Alliance launched the annual cyber security awareness campaign in 2004. And there’s a lot of focus right now on what consumers can do to protect themselves. Here’s one thing I’ve suggested: Create a “my Social Security” account. This is an important portal to your Social Security benefits.

“The most secure action a person can take is to create their own ‘my Social Security’ account,” said Mark Hinkle, acting press officer for the Social Security Administration.

With the information stolen in so many of these breaches, identity thieves could beat you to the site and apply for retirement, disability or Medicare benefits in your name.

“I tried to set up a Social Security account but couldn’t,” one reader wrote following my recommendation. “Is this because I have placed a security freeze on my credit files?”

Ready for another scary story?

This person couldn’t set up an account because Social Security uses information in your credit file to verify your identity. If the file is frozen because of a security freeze, the agency can’t find what it needs to ask questions to confirm that you are who you say you are.

The agency uses what it calls an “identity services provider.” Want to guess who that is? Equifax currently has the $4.3 million contract for one year to verify people’s identity.

Since information was stolen from Equifax, I asked Hinkle if the agency would continue to use the credit bureau.

“We are currently evaluating this as we obtain more information from Equifax,” he said.

Supposedly, neither you nor an identity thief can create a

Social Security account if you have a freeze in place. But are you willing to take that frightening chance?

“If people visit a Social Security office to create an account, there is no need to remove the security freeze,” Hinkle said.

On the home page for www.ssa.gov, click the link for “Contact Us” to find a nearby office using your ZIP code. To set up an online account, click the link for “my Social Security.”

I’m still getting lots of questions from readers concerned about the various breaches, and I’m trying to answer as many as I can.

Lots of people are trying to place a credit freeze on their files. Some who encounter problems doing so online are being asked to mail various documents to prove their identity.

One reader wrote: “I am hesitant to do this by mail because of all the information that will be sent. Is this something I should worry about?”

David Blumberg, senior director of public relations for TransUnion answered: “Mail received by TransUnion is processed through our contact center in a secure facility that is accessible only to employees specially trained to handle inbound consumer mail. This mail is digitally imaged, and the hard copies are destroyed within 10 days via secure, onsite shredding and document destruction. After a freeze is processed, we send the consumer written correspondence via the USPS to confirm the freeze and provide a PIN the individual can use to temporarily lift or permanently remove the file in the future.”

An Equifax spokesperson didn’t clarify what protections the company takes when people mail in their documents.

Michael Troncale, senior manager for public relations for Experian said: “When we are unable to sufficiently match identification online or by telephone, we request additional documentation in order to verify the individual’s identity. We do so as an additional precaution in an effort to protect the consumer.”

As scary as it may be to send your information in the mail given the severity of recent breaches, you may have no other choice if you want a freeze.

You can take extra precautions by sending your documentation via certified mail or by FedEx, Troncale said.

Some people have asked me: Does one freeze work for all the bureaus? Unfortunately, the answer is no. To get full protection, you need to put on a freeze at all three credit bureaus, including a fourth smaller one, Innovis.

These are some spooky times. For additional tips and resources, go to staysafeonline.org.

Readers can write to Michelle Singletary c/o The Washington Post, 1301 K St., N.W., Washington, D.C. 20071. Her email address is michelle.singletary@washpost.com. Follow her on Twitter (@SingletaryM) or Facebook (www.facebook.com/MichelleSingletary). Comments and questions are welcome, but due to the volume of mail, personal responses may not be possible. Please also note comments or questions may be used in a future column, with the writer’s name, unless a specific request to do otherwise is indicated.