3 ms·

> I forgot what they were but the real name is Smith!" will be enough to pass. How would the call center know if your mother's maiden name is actually Smith if

> I forgot what they were but the real name is Smith!" will be enough to pass. How would the call center know if your mother's maiden name is actually Smith if you never answered the question honestly? I could see the "It's a lot of random letters and numbers" response working by itself though.

hawaiianbrah 7y ago
They wouldn’t, of course, but it’s painting the caller in a human light that call center employees may empathize with.
- dvtrn 7y ago
  This statement confuses me, what are you proposing the call center employee empathize with me over? The reason I'm even calling, or the authentication and account verification answers and random bits of string that I enter into my account when signing up?
  - defen 7y ago
    "You" in this case are a hacker / social engineer trying to break into someone's account. If your target puts gibberish as the answer to that question, here's how the conversation will go: Operator: What is your mother's maiden name? Hacker: Smith (let's say this is the real name, gleaned from public records) Operator: That's not what I have here Hacker: Oh, you know what, I think I just put gibberish when I signed up. I thought that would add some extra security, but I forgot what I wrote, ha ha, joke's on me. The real name is Smith though. Operator: Story checks out, I'm giving you access to the account now.
    - edm0nd 7y ago
      or Operator: Story checks out, I'm going to reset it to "Smith" for you.
thombat 7y ago
A few years back I cashed in the residue of a UK ISA (remaining balance just £1.50 but local tax laws forced it to be closed). No longer being in Blighty it transpired this would be a serious posterial pain involving sending of certified passport copies to validate signatures, etc, but their helpful man on the phone explained I could skip all that simply by registering for their internet banking access, then login and transfer the investment funds to wherever I liked. So off I toddled and being in a hurry and not overly concerned about the risk that some miscreant steal my half-a-cup-of-coffee's worth I pasted "sasquatch" into all the security question prompts. Clickety-click, done, now to close the account... "Please phone our banking service team for this request" "Hello Mr Thombat, I can see your account number but first I just have to ask you some security questions...what was your grandfather's occupation?" "Sasquatch" "That's fine ... now what was the name of your first school?" "(nervous giggle) Sasquatch" "Ahhh...and was your first pet's name?" "Sasquatch, too. I mean too as in also, not two as in the number...I really didn't expect I'd be telling these to a person, it was just a nice word to say..." He kindly overlooked my embarrassed tittering, didn't go all jobsworth about this horrific breach of security best practice, nor yet accuse me of lying to one of Her Majesty's civil servants for pecuniary advantage. And (in my defense) no amount of dumpster diving or Facebook scraping would have revealed my family's secret shame that grandpa used to roam the American woods in a monkey suit.

hawaiianbrah 7y ago

They wouldn’t, of course, but it’s painting the caller in a human light that call center employees may empathize with.

dvtrn 7y ago
This statement confuses me, what are you proposing the call center employee empathize with me over? The reason I'm even calling, or the authentication and account verification answers and random bits of string that I enter into my account when signing up?
- defen 7y ago
  "You" in this case are a hacker / social engineer trying to break into someone's account. If your target puts gibberish as the answer to that question, here's how the conversation will go: Operator: What is your mother's maiden name? Hacker: Smith (let's say this is the real name, gleaned from public records) Operator: That's not what I have here Hacker: Oh, you know what, I think I just put gibberish when I signed up. I thought that would add some extra security, but I forgot what I wrote, ha ha, joke's on me. The real name is Smith though. Operator: Story checks out, I'm giving you access to the account now.
  - edm0nd 7y ago
    or Operator: Story checks out, I'm going to reset it to "Smith" for you.

thombat 7y ago

A few years back I cashed in the residue of a UK ISA (remaining balance just £1.50 but local tax laws forced it to be closed). No longer being in Blighty it transpired this would be a serious posterial pain involving sending of certified passport copies to validate signatures, etc, but their helpful man on the phone explained I could skip all that simply by registering for their internet banking access, then login and transfer the investment funds to wherever I liked. So off I toddled and being in a hurry and not overly concerned about the risk that some miscreant steal my half-a-cup-of-coffee's worth I pasted "sasquatch" into all the security question prompts. Clickety-click, done, now to close the account... "Please phone our banking service team for this request" "Hello Mr Thombat, I can see your account number but first I just have to ask you some security questions...what was your grandfather's occupation?" "Sasquatch" "That's fine ... now what was the name of your first school?" "(nervous giggle) Sasquatch" "Ahhh...and was your first pet's name?" "Sasquatch, too. I mean too as in also, not two as in the number...I really didn't expect I'd be telling these to a person, it was just a nice word to say..." He kindly overlooked my embarrassed tittering, didn't go all jobsworth about this horrific breach of security best practice, nor yet accuse me of lying to one of Her Majesty's civil servants for pecuniary advantage. And (in my defense) no amount of dumpster diving or Facebook scraping would have revealed my family's secret shame that grandpa used to roam the American woods in a monkey suit.