NSI Barbaric security system

masonic

Section62 said:

If a bank insists on using mmn then I give them a different word... then finding myself having to explain to call centre staff why my 'mothers maiden name' isn't a female name.

Not sure I understand that. Suppose your mother was born Tracy Henry or Caroline Dennis before marrying Sam Smith and losing the maiden name for Smith, then would that be so unusual? On the other hand, if you go really random and use "Pneumatic Drill" that may raise questions.

mikb

Section62 said:

Olinda99 said:

The particular dangerous one is mother's maiden name - in my opinion you should never use the real one.

Agreed.  The FCA should tell the organisations still using mmn to stop doing so without delay..

Personally, I can't believe that the FCA allowed it in the first place (or that any banks/financial institutions thought this was a good idea to make this even an issue).

Using researchable items of data as "security" is a joke. A bad joke. I have a range of "first school", "pet's name", "favourite car brand", "mother's maiden name"  and "where you grew up" answers -- none in common between organisations, because I recognised that this was a _stupid_ security feature.

The complication comes where terms 41.7 subsection j) says "You agree that _all_ information you submit to us is truthful and accurate ..." -- well, mostly. Apart from the security things.

And the other complication -- if they are digging into your credit files and cross-referencing with open banking etc. it is possible they are picking up information from _real_ sources. So when they ask about "How many children?" you need to counter with "Actual children, or the number I told you I had?" ...

masonic

I don't think date of birth has completely fallen out of use yet...

dcs34

mikb said:

Section62 said:

Olinda99 said:

The particular dangerous one is mother's maiden name - in my opinion you should never use the real one.

Agreed.  The FCA should tell the organisations still using mmn to stop doing so without delay..

The complication comes where terms 41.7 subsection j) says "You agree that _all_ information you submit to us is truthful and accurate ..." -- well, mostly. Apart from the security things.

And the other complication -- if they are digging into your credit files and cross-referencing with open banking etc. it is possible they are picking up information from _real_ sources. So when they ask about "How many children?" you need to counter with "Actual children, or the number I told you I had?" ...

In those circumstances I tend towards giving answers that aren't strictly untrue, that would still make it clear that you were answering the question deliberately indirectly to avoid making it guessable, in the way that a machine wouldn't pick up on (e.g. avoid swear words, the word "answer" or "password") but a human member of staff would appreciate. And if course if they were to complain one should point out their questions are problematic!

What's your mother's maiden name? "Extinct" " "Written on her birth certificate" "The same as her sister Judith's"

How many children do you have? "3" (include your pets in the count)

What's the name of your first school? "Written on the badge"

What make was your first car? "Japanese"

I tend to use this approach for banks/BSs that ask security questions at log-in, given (1) it's just a machine matching the 4th, 5th and 8th characters (and doesn't know how to interpret the actual answer word) and (2) someone close to you using their knowledge to try to log in as you is probably the most likely form of security incident.

jimjames

Cathygpie said:

Appreciate your help. Why do they tell me I got basic details wrong, name of children etc. 

I suppose it is also possible that if the details were transcribed from paper to systems that this may have introduced errors into the answers or been linked to the wrong account. Did you really mean barbaric though?

400ixl

The questions are word association. They really don't care whether the answer is factual, just that you can repeat it when asked.

You don't need to be clever, just consistent and answer with what they have.

Section62

masonic said:

Section62 said:

If a bank insists on using mmn then I give them a different word... then finding myself having to explain to call centre staff why my 'mothers maiden name' isn't a female name.

Not sure I understand that. Suppose your mother was born Tracy Henry or Caroline Dennis before marrying Sam Smith and losing the maiden name for Smith, then would that be so unusual? On the other hand, if you go really random and use "Pneumatic Drill" that may raise questions.

I've gone with "Pneumatic Drill" on the basis it clearly isn't my mother's maiden name and in no way could be seen as an attempt at deception (i.e. not pretending to be someone I'm not)

(When I said 'female name' I meant the word couldn't be the name of a woman, rather than being a possible male given name like your examples).

masonic

Section62 said:

masonic said:

Section62 said:

If a bank insists on using mmn then I give them a different word... then finding myself having to explain to call centre staff why my 'mothers maiden name' isn't a female name.

Not sure I understand that. Suppose your mother was born Tracy Henry or Caroline Dennis before marrying Sam Smith and losing the maiden name for Smith, then would that be so unusual? On the other hand, if you go really random and use "Pneumatic Drill" that may raise questions.

I've gone with "Pneumatic Drill" on the basis it clearly isn't my mother's maiden name and in no way could be seen as an attempt at deception (i.e. not pretending to be someone I'm not)

(When I said 'female name' I meant the word couldn't be the name of a woman, rather than being a possible male given name like your examples).

I suppose Talula Does the Hula from Hawaii had her name changed before reaching the age she could marry, and I don't know if Dr Michael Itchianus of Have I Got News For You fame had a daughter, but I'm sure they've seen all sorts.

eskbanker

Section62 said:
I've gone with "Pneumatic Drill" on the basis it clearly isn't my mother's maiden name...

If it had been, would you have been Drill Baby Drill when born....?

newatc

A few years back I had to answer a security question over the phone and was asked "What was your first teacher's name ?" , I complained that I would never chosen that as a security question but to no avail. So I spent the next  minute thinking what was the name of my first teacher despite believing it was a waste of time.
A name occurred to me and I said it and the operator replied "Correct, how can I help you today ?"