'Shame on Nationwide – no, I won't give you my security details' blog discussion

jamesd wrote: »

I wouldn't suggest not contacting, just not divulging information to a caller who hasn't authenticated themselves. The solution is easy enough: leave a note on the customer record saying who the call should be forwarded to, then invite the customer to call back on the number published on the web site. After the customer has made contact you can then suggest that you call them back and they will recognise your voice and be willing to go through security a second time during that callback.

I wish it was that easy, that was one of my biggest bug bears. To my mind there should be one central system used for verifying people and the CA should be able to leave a note to say which dept was trying to contact them. The reality is that each department uses a different computer system, they also used automated calls to,alert the customer that NBS were trying to get hold of them but I believe the automated number should direct them to the correct dept.

If people would just realise how important it is to keep track of your money and contact the relevant people in case of difficulty things would be a lot easier. Unfortunately many people just choose to bury their heads in the sand and that isn't the answer.

LardyCake wrote: »

The issue is about bad security practice by financial institutions (not just Nationwide) that encourages people to give out their security details to unidentified callers who may well be scammers.

It is nothing to do with getting into debt, or burying heads in sand. These unsolicited calls asking for security details are not made exclusively to people in debt or financial difficulty.

I realise that and I did mention it earlier. But, the fact remains that on occasion the banks do have reason to call you but need to verify they are speaking to the correct person first. I really don't think there is an easy answer.

I've worked in banks and building societies all my life, and we receive regular training in data protection issues.

Selling and marketing is not my thing and I've always worked in admin, so I've often had to call customers to speak about matters that have arisen on their account.

Until I'm sure I've got the right person, by getting correct answers to security questions, I am very discrete about what I say. I don't want to give information to people that aren't entitled to that information

If people aren't happy to answer security questions, it's really no skin off my nose, I just tell them they can call me back if they want to, at our central contact number, so they can be sure their are speaking to the bank, and then answer the security questions. At that point, most of them decide they are happy to answer the security questions, as let's face it, it's a right pain to call any large institution these days, and as they have me on the phone they decide they'd rather find out what I want. Once I know I've got the right person, I can speak about their account and most are happy that I've called as I've been able to help them.

4.There is no alternative method of contact. I then asked: "Do you have an alternative method of contacting me, either via email or secure message through your online banking so I can see what this is about?" Her reply: "No, I can’t do that either – we only ever call, we do not have any other system." (This bit was confirmed later.)

A quick google (and I mean quick, first search and first link I clicked on) gave me this page

http://www.nationwide.co.uk/contact_us/how_to_contact_us/default.htm

Now with that information, it shouldn't be too difficult to establish the authenticity or otherwise of the call (but you may have to wait until Monday morning now)

I've had a number of calls from people who claim to be from XYZ and want me to give out security information. I never do and simply say if they cannot identify themselves to my satisfaction, then I will call them back ... on a number I will find from their website! (or otherwise already known to me) They can give me further contact details from their (e.g. an extension number to help if they like)

If I doo need to call themn back, I invariably discover the call either
a) does not even originate from the company claimed
or
b) is an unsolicited marketing call (at which point I often ask to start a formal complaint as I rarely give permission for this type of activity and and registered with the TPS/CTPS)

In the majority of cases, the person I speak to cannot actually help me any further, and I never seem to get called back, so it really couldn't have been very important in the first place.

But never, ever disclose your personal security details by telephone to someone/anyone that calls you without them being able to first confirm to you they are who they say they are. If it's genuine, I'm sure most banks (or other services) would fully understand this.
(A bit like checking a waterboard official really is from the water board when he comes knocking at your door to, for example, 'test the quality of the water' ... any genuine official would be happy to wait outside your closed door whilst you check out their authenticity by checking with their claimed employer ... e.g. by telephoning them on a number you know to be genuine, and never one they may ask you to call instead)

The truth is, by the end, I was pretty sure this was Nationwide. She made all the right noises (though I may be fooling myself that I’m savvy enough to tell the difference) and indeed, when I called through using the customer service number, the person confirmed it was a genuine call.

So was it just a marketing call, or was there something they needed to discuss urgently with you about the way your account was being operated (remember they were calling you at work!)

And what did they advise when you no doubt expressed the security issues involved in the way they operate?

Surely it can't be their policy to operate in such a risky manner?

If it is claimed to be their policy, then remember that as an account holder, you are probably a member so can attend the AGM (usually held in the middle of the year). Perhaps an ideal opportunity to ask a probing question (they usually have a good Q&A session) as to their security protocols?