On June 25, 2011, the Social Security Administration began randomizing the first three digits of newly issued SSNs. Before that change, those digits — the area number — reflected an applicant's mailing address ZIP code, which made an SSN's origin, and often its plausibility, easy to infer at a glance.
SSN structure
Every Social Security Number is nine digits, split into three parts:
- Area number (first 3 digits): previously tied to the applicant's mailing address ZIP code; now randomized.
- Group number (middle 2 digits): no geographic significance — it exists for internal SSA organizational purposes.
- Serial number (last 4 digits): a sequential number from 0001–9999 within each group.
Why randomization happened
The SSA introduced randomization to, in its own words, "protect the integrity of the SSN and extend the longevity of the nine-digit SSN nationwide." Area numbers had been climbing toward exhaustion in some states, and a predictable, address-linked structure made SSNs easier to guess or validate against public data — useful to a fraudster, not to the person it was meant to protect.
“Protect the integrity of the SSN and extend the longevity of the nine-digit SSN nationwide.” — Social Security Administration
What changed, concretely
After June 2011: the High Group List is frozen and only applies to pre-2011 SSNs. Numbers issued after the change can't be validated against it, so any fraud check that still leans on high-group logic alone is checking against a dataset that stopped growing over a decade ago.
Numbers that are never valid
Regardless of when an SSN was issued, certain patterns are permanently invalid and are a reliable, low-cost fraud signal on their own:
- Any grouping of all zeros in the area, group, or serial position (000-xx-xxxx, xx-00-xxxx, xxx-xx-0000)
- Any number beginning with 666
- Any number in the 900–999 area range, reserved for non-SSN use (e.g. ITINs)
A quick structural check against these rules won't catch a stolen-but-valid SSN, but it remains one of the cheapest first-pass filters available before a number is ever run against a bureau or verification service.