Having just browsed this hilarious thread on Discover iT Security!, I was reminded of the silliless of security policies dealing with customer service trying to verify your identity on the phone.
To be sure, identity misrepresentation is a serious matter, but putting multiple locks on your door doesn’t make your home any safer. The credit card companies can install all the hoops they like, it doesn’t matter.
No phone or online interaction offers a perfect verification of who you are. You can tell your friend to be on the phone and quietly feed her all the information; customer service doesn't know the difference.
Sometimes they ask you so many questions that you have to wonder whether the company had a system crash and half of their information on you is gone. Can you verify your address? Sure, tell me what it is and I’ll let you know if it’s the same. Not what they were going for probably.
Or maybe the company has a voice mechanism installed that detects the likelihood of you lying as you move along on the phone. I don’t know if such an approach is legal, but I suppose some attempted use of psychology may come into play.
I once walked into a pharmacy, said pickup and stated the name. They didn’t ask whether I was that person or anything, turned out they were afraid of offending customers by asking for your name, not mention an id card. Then one day, I said I was the husband, and that was the end of it all.
American Express is big on the use of a so-called account manager account to administer someone else’s account. I like the idea given the separate password and everything, but I don’t think it’s much used in real life. Maybe they is mostly covering themselves by instating such a policy.
