It amuses me that banks talk about security but rarely apply it in a consistent enough way to save people like you and me from getting scammed. Take what just happened to me this morning:
My bank rings me up (the number is a private number so doesn’t show up on my screen, but that doesn’t seem to be unusual anymore; nearly half of the people who call me seem to withhold their number these days. In any case, it’s not hard to fake a callerID.)
The woman on the phone tells me there’s been a problem with my last phonebanking transaction. Before she can tell me more, she asks me to key in my six-digit phonebanking ID, she says. I’m just about to do so, eager to sort out the problem, when I realize that I’ve not confirmed that she is who she says she is. So I ask her:
“Sorry, but I need to confirm who you are first.”
“Yes, I am Sheila and I work for the phonebanking division.”
“Yes, but how do I know you’re Sheila from the phonebanking division, and not Sheila from Phishers ‘R’ Us?”
Clearly Sheila hasn’t faced this kind of situation before.
“Er, well, if you key in your phonebanking ID, I can tell you details about your account, and that will confirm it.”
“Well, it may do, or else it would tell me you’d already succeeding in hacking into my account and were now just toying with me.”
A pause.
“Yes, but the PIN number goes straight into the computer,” says Sheila, a bit nonplussed now.
I try to explain that a) I’m not personally accusing her of being a scammer, only that I have no way of confirming whether she is a bank employee or a clever social engineering fraudster because she called me first and b) that technology makes it eminently possible that someone could capture my six digit PIN if I key into my phone. (A simple decoder attached to the phone will grab the DTMF signals (the beeps when you press a key) and figure out what digits they represent. I didn’t tell this to Sheila because she was already beginning to sense I was a ‘difficult customer.’)
In the end I tell Sheila I’m going to call her back, to which she politely agrees. When I later explain to her that the bank should think about plugging the hole in their security fence, she listens politely, thanks me for my feedback, and says:
“One last thing, Mr. Wagstaff. I don’t know if you’ve been told but we’re running a promotion at the moment that for every customer you’re able to bring in you get a $200 gift voucher for redemption at Takashimaya Department Store.”
A bank with its priorities right, it seems.
What amazes me about this is that banks don’t seem to have learned from past mistakes. A few months back I wrote about a scam in Hong Kong which uses exactly this tactic. Fraudsters stole wallets and handbags at a sporting event, removing only the ATM and business cards. The victims then got phone calls the next day pretending they’re from the bank informing them they’ve lost their card, and asking them to approve cancellation of the card by keying in their PIN number. Voila. If Sheila was Sheila the Scammer, someone would be at least half way into my account by now.
I wish banks would be smarter about this. I wish in particular the banks I use would be smarter about this. Scammers are clever, particular about social engineering — the art of lulling people into a sense of false security. We ordinary people want to please, and we want to help solve a problem, especially if it’s connected to us, so we’re easy prey for someone at the end of the phone offering both.
The lesson is the same as the one I’m always trying to pass on: Don’t give anything to anyone just because they ask you to. Find out first whether they are who they say they are. A realtor asking for a deposit? Show me the documents that prove you are authorized by the landlord. Here to check the meter? Where’s your badge? Valet? How do I know you’re not just a guy in a red jacket and jaunty hat about to steal my car?
Authenticate, authenticate, authenticate. And if it’s someone like a banker, a real estate agent or an official, be hard on them if they seem impatient with your efforts. It’s your money, not theirs.
a few years ago, i mentioned to a group of banks security executives that they spent far too much time thinking on how to authenticate the users (two-factor, tokens, sms etc) and not enough for their consumers to authenticate the banks. they gave me a blank look then 🙂
I’ve been in a similar situation when I received a call from my telephone company regarding my account. The person calling launched straight into the script by asking me for my name, phone number, date of birth.
I was very alarmed and asked for her number so I could call back to confirm it wasn’t a scam (it was a legitimate call thankfully).
Isn’t it interesting that business have stringent requirements that consumers are required to provide detailed identifying details (amount of last bank transaction, account details, passwords, last bill number, etc), yet this is not reciprocated when it is the consumer receives the call?