A widely transmitted identifier that tons of organizations need to ask you for taxes is not secret. It's used to precisely identify who you claim to be. It's your username. There's not much to say about also treating it as your password except that it's asinine. It's like treating your first name/last name as a secret password.