About Us | Contact Us
View Cart

Authenticating Callers

By Vigilize | Monday, February 25, 2013 - Leave a Comment

The art of “out-of-wallet” questions!

When somebody calls wanting information that is sensitive (such as social security numbers, account numbers, account balances, the names of applications on our network, names of personnel, etc.), we must “authenticate” them prior to giving out information.  “Pretext calling” is a rising attack vector used in both orchestrated attacks by professionals as well as in amateur scams by our customers, nosy neighbors, or ex-spouses!

To avoid an embarrassing incident, we must ask “out of wallet questions” in order to confirm the identity of a pretext caller.  This “authentication process” can take three easy steps:

1) Start  your request with three little words, “For your protection.”  You will be amazed at how valuable these words can be.  You need to be sure your customer knows, in advance of your request, that the procedures are for the his or her own protection.

2) Explain that you need to ask some questions to verify identity.

3) Ask “out of wallet questions,” as defined below.

Defining of “Out of Wallet”

Out-of-wallet questions seek information that is not easily discovered in “the public presence” or in somebody’s wallet or purse.  We add “public presence” to this definition because some questions, such as “mother’s maiden name” or “birth date,” used to be considered legitimate questions but are no longer safe because it is so easy to find this information on various social media sites (such as Facebook or Twitter.)  Meanwhile, account numbers are on checks which are in purses.  Birth dates are on licenses (and Facebook.)  And the last four of somebody’s social security number is so often used we don’t like to trust it as well!

Thus, you can no longer count on the following information as identifiers in the authentication process:

Not Out-of-Wallet

    • Last four of social security number.
    • Birth date.
    • Account number.

Another way to define “out of wallet” would be to say “ask questions whose answers can be found in the computer transactions log.”  Such questions would include:

a) Amount of last deposit.

b) Make and model of auto for an active loan.

c) The year that a loan was taken out or a refinance was made.

d) Origination of a recurring deposit, or recipient of a recurring check.

Or, another approach we find invaluable is to ask multiple choice questions where none of the answers are correct.  Throughout the process, be sure to explain that “for your protection” you must follow procedures.  If the caller can not answer out-of-wallet questions, you can not give out the information.

Your Responsibility

Sometimes customers can grow impatient with the process.  In this busy age, we can’t blame them.  But we still must protect them.  Thus, ultimately, if you are taking the call, you will be responsible if the caller is not supposed to have access to the information.  Thus, if for any reason, you are not 100% comfortable with the identity of the caller, it is okay to explain that you need to involve the assistance of another person (usually your supervisor.)

Be sure to ask your supervisor about this procedure if you are not entirely sure you understand.


Original article by Vigilize.

Latest News
    PRESS RELEASE – FOR IMMEDIATE RELEASE BUSINESS NEWS NEW EMPLOYEE FOR INFOTEX infotex has just hired Sara Fultz, to be a new Creative Assistant to assist with creative engagement for both clients and employees. “I’m ecstatic to have Sara join the infotex team!  I feel she is an excellent addition to help with the creative […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape)   You are welcome to print out and distribute this around your office.  
    Intelligence agencies from five nations contributed to the new advisory… An article review. For the first time, the cybersecurity divisions of the nations in the “Five Eyes” alliance (The United States, United Kingdom, Canada, Australia and New Zealand) have released a joint advisory concerning incident response. The report, available here, does not provide a complete […]
    PRESS RELEASE – FOR IMMEDIATE RELEASE BUSINESS NEWS NEW EMPLOYEE FOR INFOTEX infotex has just hired Nathan Harrell, to be a new Engagement Coordinator to assist with all communications between both current and prospective Clients. “We’re really excited to have Nate joining the team to help us keep the channels of communication open!” says Bryan […]
    A Webinar-Movie Short Back by popular demand! Our Board Awareness Training program continues with this movie, entitled Vulnerability Management for Directors, that can be presented directly to your board of directors.