About Us | Contact Us
View Cart

Authenticating Callers

By Vigilize | Monday, February 25, 2013 - Leave a Comment

The art of “out-of-wallet” questions!

When somebody calls wanting information that is sensitive (such as social security numbers, account numbers, account balances, the names of applications on our network, names of personnel, etc.), we must “authenticate” them prior to giving out information.  “Pretext calling” is a rising attack vector used in both orchestrated attacks by professionals as well as in amateur scams by our customers, nosy neighbors, or ex-spouses!

To avoid an embarrassing incident, we must ask “out of wallet questions” in order to confirm the identity of a pretext caller.  This “authentication process” can take three easy steps:

1) Start  your request with three little words, “For your protection.”  You will be amazed at how valuable these words can be.  You need to be sure your customer knows, in advance of your request, that the procedures are for the his or her own protection.

2) Explain that you need to ask some questions to verify identity.

3) Ask “out of wallet questions,” as defined below.

Defining of “Out of Wallet”

Out-of-wallet questions seek information that is not easily discovered in “the public presence” or in somebody’s wallet or purse.  We add “public presence” to this definition because some questions, such as “mother’s maiden name” or “birth date,” used to be considered legitimate questions but are no longer safe because it is so easy to find this information on various social media sites (such as Facebook or Twitter.)  Meanwhile, account numbers are on checks which are in purses.  Birth dates are on licenses (and Facebook.)  And the last four of somebody’s social security number is so often used we don’t like to trust it as well!

Thus, you can no longer count on the following information as identifiers in the authentication process:

Not Out-of-Wallet

    • Last four of social security number.
    • Birth date.
    • Account number.

Another way to define “out of wallet” would be to say “ask questions whose answers can be found in the computer transactions log.”  Such questions would include:

a) Amount of last deposit.

b) Make and model of auto for an active loan.

c) The year that a loan was taken out or a refinance was made.

d) Origination of a recurring deposit, or recipient of a recurring check.

Or, another approach we find invaluable is to ask multiple choice questions where none of the answers are correct.  Throughout the process, be sure to explain that “for your protection” you must follow procedures.  If the caller can not answer out-of-wallet questions, you can not give out the information.

Your Responsibility

Sometimes customers can grow impatient with the process.  In this busy age, we can’t blame them.  But we still must protect them.  Thus, ultimately, if you are taking the call, you will be responsible if the caller is not supposed to have access to the information.  Thus, if for any reason, you are not 100% comfortable with the identity of the caller, it is okay to explain that you need to involve the assistance of another person (usually your supervisor.)

Be sure to ask your supervisor about this procedure if you are not entirely sure you understand.


Original article by Vigilize.

Latest News
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape)   You are welcome to print out and distribute this around your office. Interested in one of ours […]
    President Biden recently signed a bill tasking the agency with evaluating the unique risks that schools face… An article review. Taking note of the unique challenges educational institutions face in securing their networks, President Biden has signed a bill into law directing the Cybersecurity and Infrastructure Security Agency (CISA) to look into ways that they can […]
    Thanks for being interested in our Technology Planning Webinars! This year‘s annual update to our annual Technology Planning webinar will include a panel discussion, a review of the previous years’ movies that are already available, and a discussion about alternative tactics that have arisen from recent conferences as well as the impact of the AIO […]
    Welcome Cybersecurity Conference Attendees! Thanks for joining us for the Cybersecurity Conference today! We have created this page for you to have access to the deliverables from Dan’s talk.  
    What you need to know for compliance coast-to-coast. Back in 2020 we posted an article containing links to data breach laws from each state, and it has proven to be one of our more popular posts.  Because laws surrounding the use (and abuse) of technology are always evolving, we thought it was worth taking another […]
    Why It Rhymes With SEEM (And its Not the I Before E Rule) Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . It’s the Gestalt. The idea that the whole is greater than the sum of it’s parts. That’s not something that is often brought […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape)   You are welcome to print out and distribute this around your office. Interested in one of ours […]
    Questions about China’s new disclosure laws only highlight the uncertainty about disclosure in general… An article review. China recently made waves in the security world by announcing a new set of data security laws, one of which has added new fuel to a long running debate: how and when should security vulnerabilities be disclosed…and to […]
    Four Conditions … …For Why a Network Can be Anything But a Network! Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . I have to admit that infotex is being called into engineering meetings with larger organizations these days that are NOT community based banks.  We […]