Had an interesting experience today.
My primary credit card has been flaky of late in being passed for purchases, and a few days ago I got a call from the company’s anti-fraud division asking me to call them back. I did so today (calling the customer service number on the reverse of the card, not the number that was left on the answering machine).
I was a bit dismayed that the introductory security to the call was verification of my identity through (a) the last four digits of my Social Security Number, and (b) my mother’s maiden name. Both of these are sorely overused and, thus, insecure methods of validating identity. (You’ll recall a comment I made about maiden names a few weeks ago.)
The person at the other end of the line saw the security flag on the account, and questioned three particular purchases — relatively sizable ones at an electronics store, at an online vendor, and at a liquor store. All three are just the sorts of places that a credit card thief or fraud would be likely to hit, and, in this case, they were all legitimate purchases.
Before the person would clear my account, though, he asked me two further verification questions, which was the “interesting” part of the experience. He explained that these would be multiple choice questions, and that they would seem odd, but that they were based on public records that they had (presumably) associated with me.
The first question was about a street address, a former residence. After giving the address, he asked me which of three cities it was in, or if it was an address that I was unfamiliar with.
After that, he asked me about the age (range) of a family member, including the option of disavowing any knowledge of the person he asked about.
I answered both questions accurately, and he cleared the flag from the account and All’s Right with the World.
The odd thing is, while I can imagine their having a record of a former residence (through a credit report, presumably, since I didn’t have this particular card at that time), I have no idea how they knew about the age of the family member in question — unless they had, again through credit records, cross-referenced it through common last name and previous (different) address.
I felt somewhat better for knowing that they were not relying simply on SSN and Mother’s Maiden Name, but it was still a bit … disconcerting.