Heh. There was such a product provided by Debix (http://debix.com http://debix.com). It relied upon a law called the Fair Credit Reporting Act which allowed c

Heh. There was such a product provided by Debix (http://debix.com http://debix.com). It relied upon a law called the Fair Credit Reporting Act which allowed consumers to place a fraud alert on their credit file, which the creditor was supposed to call. Debix placed the fraud alert on behalf of consumers, but directed the creditor to call Debix which delivered the credit request using exactly such an authentication mechanism that you describe. This was 2003. Lifelock used the same mechanism (though without the phone authentication, IIRC). Experian sued Lifelock saying that the FCRA did not allow for companies to set fraud alerts on behalf of consumers, only consumers were allowed to set them. In May of last year, a judge agreed with Experian, and Lifelock later settled and stopped using fraud alerts. http://www.finextra.com/news/fullstory.aspx?newsitemid=20078 http://www.finextra.com/news/fullstory.aspx?newsitemid=20078 Unfortunately, this ruling also meant that Debix could no longer set fraud alerts, so they had to cancel this product. The truth is such a product creates friction in the instant credit market, which is a huge source of income for credit bureaus. So they have very little incentive to slow that process down and would rather just catch any exceptions using monitoring. The credit bureaus are an industry crying out for disruption. These guys are dinosaurs and are living it large because there is no real alternative. Unfortunately, they also seem to have plenty of political capital to prevent any real legislative reform in this area. Disclosure: I used to work for Debix and have ownership in the company.