How would the call center know if your mother's maiden name is actually Smith if you never answered the question honestly?
I could see the "It's a lot of random letters and numbers" response working by itself though.
How would the call center know if your mother's maiden name is actually Smith if you never answered the question honestly?
I could see the "It's a lot of random letters and numbers" response working by itself though.
"Hello Mr Thombat, I can see your account number but first I just have to ask you some security questions...what was your grandfather's occupation?"
"Sasquatch"
"That's fine ... now what was the name of your first school?"
"(nervous giggle) Sasquatch"
"Ahhh...and was your first pet's name?"
"Sasquatch, too. I mean too as in also, not two as in the number...I really didn't expect I'd be telling these to a person, it was just a nice word to say..."
He kindly overlooked my embarrassed tittering, didn't go all jobsworth about this horrific breach of security best practice, nor yet accuse me of lying to one of Her Majesty's civil servants for pecuniary advantage. And (in my defense) no amount of dumpster diving or Facebook scraping would have revealed my family's secret shame that grandpa used to roam the American woods in a monkey suit.
Operator: What is your mother's maiden name?
Hacker: Smith (let's say this is the real name, gleaned from public records)
Operator: That's not what I have here
Hacker: Oh, you know what, I think I just put gibberish when I signed up. I thought that would add some extra security, but I forgot what I wrote, ha ha, joke's on me. The real name is Smith though.
Operator: Story checks out, I'm giving you access to the account now.
Operator: Story checks out, I'm going to reset it to "Smith" for you.