About Us | Contact Us
View Cart

Authenticating Callers

By Vigilize | Monday, February 25, 2013 - Leave a Comment

The art of “out-of-wallet” questions!

When somebody calls wanting information that is sensitive (such as social security numbers, account numbers, account balances, the names of applications on our network, names of personnel, etc.), we must “authenticate” them prior to giving out information.  “Pretext calling” is a rising attack vector used in both orchestrated attacks by professionals as well as in amateur scams by our customers, nosy neighbors, or ex-spouses!

To avoid an embarrassing incident, we must ask “out of wallet questions” in order to confirm the identity of a pretext caller.  This “authentication process” can take three easy steps:

1) Start  your request with three little words, “For your protection.”  You will be amazed at how valuable these words can be.  You need to be sure your customer knows, in advance of your request, that the procedures are for the his or her own protection.

2) Explain that you need to ask some questions to verify identity.

3) Ask “out of wallet questions,” as defined below.

Defining of “Out of Wallet”

Out-of-wallet questions seek information that is not easily discovered in “the public presence” or in somebody’s wallet or purse.  We add “public presence” to this definition because some questions, such as “mother’s maiden name” or “birth date,” used to be considered legitimate questions but are no longer safe because it is so easy to find this information on various social media sites (such as Facebook or Twitter.)  Meanwhile, account numbers are on checks which are in purses.  Birth dates are on licenses (and Facebook.)  And the last four of somebody’s social security number is so often used we don’t like to trust it as well!

Thus, you can no longer count on the following information as identifiers in the authentication process:

Not Out-of-Wallet

    • Last four of social security number.
    • Birth date.
    • Account number.

Another way to define “out of wallet” would be to say “ask questions whose answers can be found in the computer transactions log.”  Such questions would include:

a) Amount of last deposit.

b) Make and model of auto for an active loan.

c) The year that a loan was taken out or a refinance was made.

d) Origination of a recurring deposit, or recipient of a recurring check.

Or, another approach we find invaluable is to ask multiple choice questions where none of the answers are correct.  Throughout the process, be sure to explain that “for your protection” you must follow procedures.  If the caller can not answer out-of-wallet questions, you can not give out the information.

Your Responsibility

Sometimes customers can grow impatient with the process.  In this busy age, we can’t blame them.  But we still must protect them.  Thus, ultimately, if you are taking the call, you will be responsible if the caller is not supposed to have access to the information.  Thus, if for any reason, you are not 100% comfortable with the identity of the caller, it is okay to explain that you need to involve the assistance of another person (usually your supervisor.)

Be sure to ask your supervisor about this procedure if you are not entirely sure you understand.


Original article by Vigilize.

Latest News
    Reasons why we should be considered! infotex provides a number of services that can be checked out if you click over to offerings.infotex.com! We even made a movie with all the reasons why infotex should be your next MSOC!  
    infotex and GoTo To all infotex managed security service Clients: As recently reported by major news outlets there was a data breach affecting GoTo (formerly LogMeIn) wherein attackers stole encrypted backups containing customer information in November 2022.  Based on the advisory from GoTo the products they offer that are affected include LogMeIn Pro, LogMeIn Central, […]
    An option for increasing security for ALL organizations. . . The threat landscape is evolving daily, and it is becoming increasingly difficult for even large organizations providing cyber defense services to keep up. As Brandao (2021) notes, it is important for organizations to adapt holistic technologies that can correlate all attack events. Therefore, developing XDR […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Check out posters.infotex.com for the whole collection! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape) You are welcome to print out and distribute this around your […]
    A relic of the internet’s less secure past, many small firms struggle to secure their email systems… An article review. With a great deal of cybersecurity related news focused on new threats and similarly new techniques aimed at combating them, it can be easy to forget some of the older threats that have never gone […]
    Seven Trends . . . …that small bank Information Security Officers face in 2023 Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . Welcome to the Magnificent Seven, my annual predictive article about the seven trends in technology that will impact the Information Security Officers of […]
    System Security and Cybersecurity are not the same thing. . . Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . Regarding “information security,” the last thirty years have seen an evolution of frameworks, laws, and assessment approaches which intimidate the management team with their complexity.  […]
    The cryptographic algorithm is vulnerable to attack and is no longer considered secure… An article review. NIST has announced that it plans to retire the SHA-1 cryptographic algorithm by the end of 2030, citing multiple vulnerabilities in the standard, effectively ending its use after nearly 30 years.  Introduced in 1995, SHA-1 used a 160-bit hash […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Check out posters.infotex.com for the whole collection! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape) You are welcome to print out and distribute this around your […]
    Trending: Awareness Posters Meet Infographics Here are the top seven posters as of the last twelve months! As always, our Awareness Posters were a hit in 2022! So we decided to run some reports to see what our most popular posters were since November 2021. As everybody loves top ten lists and contests, we thought […]