People have a tendency to group stolen credit cards and stolen social security numbers into one big bucket of identity theft. But there is a significant difference between the two, and equating them is an act of FUD-hijacking that ends up hurting the position of privacy activists.

Social security numbers (SSNs) are identification numbers that are mandatory for all citizens of the United States (there are many countries around the world that also require national identification). They are used by the government to manage services fairly (or at least attempt to). They are also commonly used by many organizations as an authenticator – that is, knowing a person’s SSN has become "proof" of the validity of an individual. Of course, this is faulty, but given this common use, exposing the SSN and other less-known information about someone (mother’s maiden name, etc.) often provides a thief with enough information to impersonate somebody.

Credit card numbers are account numbers – numbers that have been VOLUNTARILY issued by a private bank to provide the convenience of purchasing items or withdrawing cash in advance from the account that is identified. Contrary to (apparently) popular belief, this credit card number is NOT owned by the individual; the credit card number is issued, managed, acted upon, and owned by a bank. That’s the point of credit – to allow retailers to do business with an unknown individual because they have the backing of a trusted third party.

SSNs are "used" perhaps a handful of times annually, maybe a little more – for customer service at banks and other entities, filing taxes, using social services, etc. It is very difficult to get a new SSN.

Credit Card numbers are often used a handful of times a day or week. This means that many individuals have direct contact with your credit cards. It is very straightforward (though some might say not quite "easy") to get a new credit card.

A stolen SSN can create quite a mess, particularly if other "personal" information is taken. It can be used for all sorts of credit, to gain access to other credentials, and a host of other things. You may even get hauled off to jail because of a stolen SSN. In the best case, you need to put a trace on your credit report that lasts 7 years and makes legitimate use of your identity (by you, of course) that much harder.

A stolen credit card number can be immediately revoked once a problem is identified. The loss here is a function of how long it was stolen before it was noticed and the opportunity cost/loss of possibly not having a credit card for a few days to a week or so until you get your new one. You must also review your statements (which you are doing anyway, right?) to evaluate the transactions, and potentially deal with vendor challenges. Note that I didn’t say anything about a monetary loss. That is because the credit card user is NOT out any money. Theoretically, the limit is $50, but practically speaking, I believe most companies keep it at $0.

It is really surprising that more folks that claim to care about this stuff don’t pay closer attention to the differences – they are significant.