I’ve had the privilege (?) of activating a couple credit card and changing my account information over the last few days, and I must say, it’s freaking me out. You get the credit card with a sticker on the front that says to call a number to activate the credit card. All well and good. So I call the number, and after a short greeting (”Thank you for calling XYZ credit…”) it asks me to enter or say my 16-digit account number. Ok, now I’m not a hacking or social engineering genius here, but John Technophoeb could come up with the idea to purchase 1-800 numbers that are just common dialing mistakes away from the credit card phone number. Then all you’d have to do is sit by the phone all day, pick up, ask people for their account numbers, then head off to the Bahamas. And it gets better. When people think they are talking to their back or credit provider, they’ll pretty much hand over any information that’s requested without.
Phone: Social Security Number?
Me: 987-65-4323
Phone: Mother’s maiden name?
Me: Boitano
Phone: Childhood pet’s sexual orientation?
Me: straight…what!?!
During the course of my various phone calls, I was asked for all of the following information: account number, last 4 digits of SSN, home phone number, zipcode, mothers maiden name. With all that info, it would be VERY easy to impersonate me, and the individual on the other end never really did anything to authenticate themselves other than silently nod when I got the answers right.
What’s really needed is some mutual authentication. For example, many financial websites are going to setups where they prove who they are before you completely prove who you are. For example, when I log into my brokerage account, they first ask me for my username. After that has been submitted they show me an image that I have selected, and if it’s what I expect, I enter my password and finish authentication. If I don’t see the right image, I know I’m not at the right site. Users should be leery whenever they enter there username as password on the same page. It’s easy to make a mistake when typing a web address.
Anyway, like I said, I’m not a security expert and I know work is being done to prevent fishing in web browsing. I just feel like I’m without any protection when I use the phone, and a lot of times I give away more personal information there than on a website.