Rep: "Tell me the answer to this question."
Me: "Ok, let me see what I set it to..."
Answer: F^O9dA66@wUPpK5$lTXBbrQ#yLP1EGl$
Me: "Oh... Oh no."
Lately, I've been making up a seemingly correct, but random response (and different each time). My favorite vegetable? Sea cucumber! I store that in my password manager.
I can confirm that this is the case. I provided a gibberish answer to a security question for Blizzard. I didn't bother to write it down, relying on not forgetting my password.
I never forgot my password, but Blizzard shut down my account anyway because I was making payments with a card that was not listed as the account's "primary payment method". (The card I was using was listed on the account, but another card was the "primary payment method".) When I had to call support and answer my security question, the answer I'd filled in just meant that I wasn't required to provide the correct answer.
This way "it's a bunch of gibberish" doesn't get past their security.
Never had to use these for real yet, but it should be a bit harder to be seen as a “a bunch of gibberish”.
Remember, an attacker can call support hundreds of times, getting a different rep every time. There's a good chance it'll work eventually.
Random but outwardly appearing valid ones are fine (but you'd want to avoid using the same answer on different sites). One site's "first car" could be Porsche 911, another's Aston Martin. Both aren't true, but the support rep doesn't know that.
Rep: "Tell me the answer to this question."
Me: "Ok, let's see.....ah. So, it looks like a random string of gibberish, right?"
Rep: "Um, well...(unsure if he's allowed to say Yes or No)"
Me: "Yeah, I use a password manager for all my stuff, so all my passwords are randomly generated. I didn't think I'd ever have to read it over the phone. Sorry about that! I can read it out for you, but it might take awhile. If I read you the first three characters and the last three characters, is that sufficient to demonstrate for you that I know the Answer?
Rep: "Yes, I think that would be fine."
Me: "Alright, then! First three, 'F', 'caret', 'capital O'. Last three, 'capital G', 'lowercase l', 'dollar sign'.
---
As I said, I've never had anyone challenge me to read the full thing out. When I explain why it is that way and give them the bookends, they are usually convinced that I'm me.
What garbage string is there doesn't matter. Just as long as it is recognizably garbage and you know it.
Some of those reps may have been fine with you saying "oh no. I didn't think I'd ever need that and just mashed the keyboard".
Better to use something that's still made up, but is plausibly true.
In my most recent experience with them, the company allowed to be set both the question AND the answer. So, they had to read a random string to me, and I had to read one back. It went quite well, actually.