How to ‘steal’ U.S. Citizenship and get away with it

Photo by Nicole Harrington on Unsplash

Disclaimer: This article is for educational purposes only, and to point out weaknesses in the security processes at the local government offices, which could eventually affect our National Security, as evident from fairly recently conducted Government Accountability Office (GAO) investigations. I strongly suggest you not to attempt or to engage in any illegal activity or any of the mentioned techniques — you are much more likely to get caught and get yourself in trouble, than “get away”. I have therefore, for your and everyone’s safety, omitted certain key pieces and techniques which may very well help you “get away” with crime. I waive any and all responsibility in the event that you get yourself in trouble due to your actions or otherwise. Always obey the law in your jurisdiction and be a good resident. Oh, and in case anyone’s curious, I’m a legal immigrant with irrefutable proof and choose to abide by the law.

We live in a time where, unlike paper, tablets and smartphones are the new mediums of news consumption, Venmo is the new cash, social media has become a “qualified substitute” for human interaction, and spoken word to Alexa reorders that Amazon product — yet, for one reason or another, or because of cyberphobia among the people and lawmakers alike, our identity is merely a few pieces of paper.

Propose the next big “electronic” alternative to Government IDs, a decentralized blockchain ID, or an accurate DNA-based ID and just wait for the backlash from the Left and the Right alike, along with having your new innovation gracefully rejected by the lawmakers, and even mocked — on the grounds of lack of privacy, intrusiveness of the new solution, possible voter fraud, or simply because people don’t understand technology well. In the past, my years of research lead me to develop, a community-powered alternative to Government ID while knowing it probably wouldn’t go anywhere — not to say that it is any more secure or the ultimate solution.

The word ‘Identity Theft’ as popularized by so-called identity monitoring services like the famous LifeLock®, is becoming so synonymous with getting your confidential data leaked on the dark web and getting ‘hacked’ that people often forget that their identity = papers, as well. And by papers I mean, social security card, passport, driver’s license and… birth certificate.

While the focus on keeping immigration legal is great, it often lies on securing the borders alone and the processes at the Consulate level — simply denying visas and entry to suspicious immigrants and violators. What about the existing illegal immigrants who may already be present in the U.S. and are smart enough to just ‘steal’ someone’s U.S. Citizenship?

The method of identity theft discussed here is called ghosting. I’m not necessarily presenting anything novel here. A simple Google search for “identity theft book” shows you better.

All that being said, and given the exemplary workflow below, wouldn’t we be more secure with an electronic — either centralized or a blockchain-based ID, or perhaps even a DNA-encoded ID, with the obvious caveat of giving up our privacy, especially in that awful event our government was to become totalitarian? Probably not. Or at least, the tradeoff isn’t worth the assumed security benefit we may get. Who knows.

The Recipe

In order to succeed, you will need the following ingredients.


1 x Obituary Post
1 x Ghost, around your age
1 x Ghost’s Social Security Number (SSN)
1 x Ghost’s Birth Certificate
1 x Computer with the internet
Tons of Dedication
Stationery: mailing envelopes, printing supplies, postage stamps…


  1. Find your ghost. Your ‘ghost’ is the now-deceased U.S. Citizen with one or more pieces of his/her information public and who is close to your age, looks and preferably race. The best places to look for this information is public obituaries which are archived over the years by various newspaper sites and funeral homes. A lot of the times the obituary articles contain way more information that they should: the name of the person deceased, their photo, date of birth, date of death, mother’s maiden name, father’s name, place of birth/death, and of course, details regarding funeral. Here’s a guide on how to write an obituary by a funeral home, for example. How to tell if they are a U.S. Citizen? Well, frankly, isn’t it almost guaranteed if they happen to be Caucasian or African-American looking? Then again, digging into their interests on social media, or their videos on YouTube, or information present on other websites will give it away. Yes, the accent too.
  2. Verify if the SSA knows. If the Social Security Administration (SSA) is aware of the death of this person, don’t even bother proceeding any further. Their SSN has already been marked as that of a deceased person. On the other hand, if you do choose to ignore this fact and proceed — be prepared to dedicate extra time and effort required to visit an SSA office and explaining to them, why did you (or rather, your ghost) never have had an SSN before, along with some documentation to backup the fact.
    One way of verifying this information — whether SSA knows of the deceased person, is to use Social Security Death Index (SSDI). Keep in mind though, the Death Index typically has multiple copies maintained by 3rd party websites, and may not be up-to-date. Also, an omission of the ghost’s name in SSDI does not necessarily mean that it does not exist within SSA’s internal Death Index (which may not have caught up yet with the 3rd party websites). A presence, however, indicates to you to move on to the next ghost. Typically, SSDIs have an “omission” problem when someone — either the responsible party at a funeral home or a family member failed to notify the SSA of the deceased’s passing.
  3. Get that Birth Certificate. The obituary and public records usually contain enough information needed for ordering a birth certificate of an individual from the county office. Or, if you prefer convenience and don’t mind the extra exposure (riskier), there’s VitalChek. Most notably, the information required — mother’s maiden name, father’s name and place of birth, is all available. Additionally, some states (e.g. Ohio) do not require you mailing a copy of an ID when ordering birth certificates, and let anyone other than the person himself (the ghost), their family members, and legal representative(s) to order the birth certificate. For others, the ID required is merely an unverified photocopy of a supposedly-legitimate photo ID. A skilled photoshopsman can easily overcome this hurdle. Once you have received the breeder document — the irrefutable proof of U.S. Citizenship, the first step is complete.
  4. Get that SSN. This part can be tricky — a hit or miss. It is best to obtain the ghost’s original SSN using, for example, death records or some other pieces of information. Otherwise, be prepared to visit the SSA’s Office to request a “new SSN” on grounds that your parents never applied for one at your birth — with a convincing story, documentation or else, risk going to jail. Heads up, “I forgot my SSN” may not necessarily work. However, depending on your circumstances you may be able to get yourself a letter from the SSA stating, “At this time, you are not eligible for an SSN.” The letter is often accepted as an alternative to an SSN wherever it is often needed for accessing a government service or for getting an ID.
  5. Ditch social media and move away. Get rid of your real social media accounts — permanent deletion. Move far, far away to another state. To build a nice “honeypot” however for those who may be looking for you: some people have tried creating a fake Facebook profile with their real name and purposely put misleading information there, such as “Living in St. Paul, Minnesota” when they are actually present somewhere in Arizona. Maintain a low key presence in your new place and ‘steer clear’ of getting yourself in touch with the law enforcement. No speeding. In fact, no driving.
  6. Get an ID. For most states, applying for an ID or Driver’s License includes presenting your SSN card, along with some form of previous ID(s) (e.g. Employer-issued Photo ID, University Student ID along with another Photo ID and/or multiple pieces of information to corroborate your name, photo and date of birth — check your state’s requirements). Maybe you just moved from another state and your old Driver’s License has been “expired for a few months now and no good, but the Employer ID is.” As far as proof of residence is concerned — those telephone & utility bills aren’t terribly hard to forge for a photoshopsman. Of course, the new Real ID requirements may affect these processes, although their focus seems to be on “interconnecting” state ID databases and making them readily accessible to the feds, rather than increasing the underlying security.
  7. Get a Passport. At this point, you have already gotten yourself a brand new identity of a U.S. Citizen: a new name, SSN, and Driver’s License — these pieces of information along with some others are enough to get a U.S. Passport at a USPS Post Office. Thankfully, the passport comes in the mail and the actual process requires minimal human interaction with an office clerk, who typically verifies that all your documents are present with the appropriate signed application form(s). However, bear in mind at this point you are also dealing with the Federal government. Be prepared to be thoroughly investigated. It’s up to you whether you want to use an office address, your real new home’s mailing address or that of an abandoned parking lot plot, but be aware of the caveats of each one.

Bingo! You have gotten yourself an entirely new identity and U.S. Citizenship with legitimate documents to back it up. That is not to say, you will not get in trouble in future, if you didn’t already while executing one or more steps, or even if you could get away this time. ;-)

Vimeo: Lady Gaga’s “Telephone” Music Video.
Lady Gaga’s “Paparazzi” Music Video

Security Researcher | Tech Columnist |

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store