Personal information and bank security

RG2015

Personal banking online or in an app requires the following components.

1. Username or number
2. Password
3. And in some cases, PIN, SMS code or app generated code or confirmation.

However, when phoning banks, the following pieces of personal information can be requested.

1. Account number
2. Name
3. Address
4. Personal question, often 2 or 3 specific characters from mother's maiden name

If someone had these four pieces of information could they be verified by the banking call handler?

I realise that this is varies from bank to bank, but am I missing out one critical component that would be impossible for a potential fraudster to know?

For example, do telephone agents always ask for specific characters from a password or PIN?

tacpot12

I've stopped answering security questions with answers that anyone else might know. e.g. If I am asked for my mother's maiden name when enrolling for a site, I might answer "Hamstervolvo". Only I know how I have answered the question, so only I can provide the right answer. I use a Password Manager to record my login ids, passwords and security questions & answers, so it's easy for me to do this. 

RG2015

My issue is that I already have banks that invariably ask for specific characters from my mother’s maiden name. I do not believe that I can easily change my questions and / or answers.

PRAISETHESUN

It depends on the organisation, but in my experience you're right to be concerned. Calling over the phone is really just single factor authentication (something you know) and I know people who have had fraud occur this way. Usually someone obtains their personal info (probably from social media phishing) and then calls the bank pretending to be them, authorising fraudulent transactions.

Some banks are starting to roll our voice ID, or the ability to verify yourself through their app before calling, which turns this into some sort of 2FA but these still have issues. With voice ID for example if you've got a cold or something that affects your voice it can throw the systems off and they default back to the easily obtainable info.

I've started doing what tacpot does for anything new going forward, but I agree that it's not always easy to change info for existing accounts. I guess you just need to be a bit more vigilant for those accounts and be very protective of your personal info.

RG2015

PRAISETHESUN said:

I've started doing what tacpot does for anything new going forward, but I agree that it's not always easy to change info for existing accounts. I guess you just need to be a bit more vigilant for those accounts and be very protective of your personal info.

Thanks for your thoughts.

Can I follow up on these points please.

My name, address, bank account number and mother's maiden name are readily available. I am not sure how I could be protective about this information.

Equally, whilst understanding your point, I would be interested in knowing what you would consider being more vigilant would entail. 

Olinda99

your mother's maiden name is not readily available if you give the wrong one when signing up.

as for existing accounts, have you tried calling the bank and asking to change your (presumably real) mother's maiden name to something not real ?

born_again

RG2015 said:

PRAISETHESUN said:

I've started doing what tacpot does for anything new going forward, but I agree that it's not always easy to change info for existing accounts. I guess you just need to be a bit more vigilant for those accounts and be very protective of your personal info.

Thanks for your thoughts.

Can I follow up on these points please.

My name, address, bank account number and mother's maiden name are readily available. I am not sure how I could be protective about this information.

Equally, whilst understanding your point, I would be interested in knowing what you would consider being more vigilant would entail. 

No one will get into your bank account with just these details. (You forgot DOB as well 👍)

One thing to avoid is all these quizzes you see on social media.
You know the type. Favourite colour, animal, band etc. 
As many of these answers may form some of your security questions.

While I get exactly what @tacpot12 is getting at with not using mother maiden name, You have to be careful with factual ones. If bank asks for ID & you provide your birth cert. It is going to raise eyebrows & prompt a lot of questions.

Olinda99

just tell the bank you have been doing family tree research and discovered you were adopted and your mother's maiden name isn't smith as on the birth cert but hopkinson123#

Uxb1

I've actually been on the receiving end of being asked back one of these questions.
The bank call handler on the phone asked for the maiden name question... and after a moment hesitation said errrr it's all in code isn't it.
yup I reply and proceed to spell out letter by letter the gobblygook that I declared to be my mother's name explaining as per the above replies that I never supply my actual mothers maiden name when asked for it.

There was another funny one a while back which asked about your birth city as part of the account setup. If u put in Leeds the reply came back - sorry error must be 6 characters or more!

RG2015

dob

doh 

Still readily available though.

I like the idea of a security code you choose yourself that they need to ask you for.

k_man

For the few occasions I have used telephone banking, they have asked other account related questions, e.g

Overdraft limit

Most recent transaction

Number of payees on account

The benefit/disadvantage of telephone banking, is that there is a human involved.