Asking for your identification over the phone

So providing an incorrect DOB will not bring up the account. The agent will know something is wrong.

More precisely their system knows…same outcome although possibly not quite as crisp, systems dependent.

7 Likes

Yes, as intended.
I can see my reply was open to interpretation. Note added.

As an aside:
I gather some systems are more open a than others. IE display customer lists based on simple keys such as first name, post code, phone number etc. Mosaic Brands loyalty membership system has no problem locating my partner without her card. No date of birth required, but often a further question or two required as to which ‘Jane’ (not her real name), of several visible on the list. It displays emails or street address. First name and postcode or mobile number are the most common requests.

The same might be said for retail stores that maintain your customer record of purchases to assist with warranty, EG Godfreys or The Goodguys or Myer.

It’s a broad topic not knowing who has access to what?

2 Likes

It occurs some details may be more hidden than others, company dependent. Yesterday I had reason to ring my bank and the agent asked my mothers maiden name. It is an unusual name but I do not recollect being asked to spell it in yonks, if ever, so my expectation is they can see some details and in this case hear the name and see if it is reasonable against the spelt name they see…

As mentioned, best practice is that the agents are not allowed to have anything to write on and all notes they make are mental or in a screen window. Not all companies or systems work to best practice in whole or part, probably because as with real security it inhibits work getting done - not an excuse just an observation.

4 Likes

I did that once (or perhaps more) - the person was ringing back about a matter I’d raised and could tell me what that was. I was satisfied with that. :grin:

3 Likes

2 posts were merged into an existing topic: Data Breaches 2022 onward (including Optus)

CBA do this all the time. They call from an unlisted number and then say this call is being recorded for quality control purposes (without asking if this is ok) then ask you to identify yourself.
It annoys me and This should be stopped because it mimics what a scammer would do and sends the wrong message to customers.
They have the technology to allow confirmation via their app so why don’t they. ?
I reckon it needs a government directive - no inbound caller can request information that could be used for id theft without providing safeguards. But if there’s no requirement then why would they bother.

3 Likes

How do you know it is CBA? Do you make them identify themselves before you answer?

3 Likes

They say they’re from the cba first up.

It is bone fide - I’m using this example to demonstrate how the cba operate- I always call them back because they refuse to identify themselves or give further info without me giving them my details. It just annoys me because it takes the call wait time to get back onto them. Like I said - they have the brain power & sophistication in technology but why would they operate any differently if they didn’t have to? It wasn’t that long ago that they used to ask for your banking pin over the phone when you rang them - now they use a client number to do that via ph keypad.

They must have been told not to discuss even the most basic of information - like when I ask what it is about - with customers without id verification.

2 Likes

So why are they calling you, it seems, frequently?

If you are having ongoing discussions about matters, then you may have indicated that your preferred form of contact in their customer relationship management system is by phone.

I never do that. It is via email for me and if possible indicate that I do not want to be contacted by phone.

5 Likes

That is when I would hang up. Either you are not describing the situation very well or something is seriously wrong.

2 Likes

What sort of ID verification they ask you for @Melmot? Your own details or the bank account details, or…?

I got a text and then a call from my bank some time ago, but I wasn’t asked for any ID, just if I had made a particular transaction overseas, and when I said I hadn’t, they said they would block the card and mail a new one by post, but I asked for the card to be picked up at my nearest branch. I guess they are on the look out for me because of an attempted misuse of my credit card number a few years ago (In the thousands of dollars, luckily it was stopped in time!)

2 Likes

This is in accordance with the law. Informing you is required (unless it’s the government, or in certain other specific situations). Your consent is not required.

The problem with this is that actual criminals will not bother to comply with such a law - and indeed may be located overseas so that the law would be unlikely to be enforced. If a criminal is intent on e.g. fraud or other identity theft, he or she is hardly going to be concerned with complying with rules around unsolicited outbound calling.

So it would only be effective to the extent that

  • people are familiar with what the law says, and
  • people use that to distinguish between legitimate calls and scam calls.

Since the telephone (including SMS) is inherently insecure, companies should probably just get out of the habit of making unsolicited outbound calls in situations like the one being discussed here.

1 Like

Geez - really hitting a raw nerve with this one. To clarify this is my experience on numerous occasions:

1/. I am talking about a bone fide (real, true and confirmed) bank call from the CBA - they disclose it’s a call from CBA - and then they ask me to ID myself - full name, dob and address - before they will continue with any details about the call. When I decline to identify myself using information that could be used for identity fraud - they suggest I call back and they end the call.

2/. I am not seeking comment or advice on my communication preferences or the reasons or frequency for my interactions with my bank

3/. The thread of the conversation relates to asking for ID over the phone. I can confirm that even bone fide calls from AU domiciled businesses, such as the commonwealth bank of australia - ask for the same ID information. If a bone fide banking call asks the same questions as a scam call does ie information that can be used for ID fraud, then there’s an issue - eg unsophisticated peeps could easily be convinced to give out personal info to anyone calling them.

4/. for reasons of brevity - some information which I regard as irrelevant about my experience may have been omitted. The salient bits, as far as I’m concerned, have not. Unless I inhabit some parallel universe I am surprised that the same has not happened to others and/or that my experience seems to be incredulous. Or the other reason is that it’s happened to others and they are happy to provide information over the phone. The important bit is that some calls from unlisted numbers asking people for ID over the phone are not scams. I have personally decided that even for calls which in all probability are not likely to be scams - that I will not be providing identifying information to them unless they can adequately identify themselves to me prior. At the moment I believe that their training prevents them from providing anything about the nature of the call without verifying the caller. Australian consumers should not be placed into this situation by banks or anyone else. It should not be an individual choice. It should be regulated this way.

5/. The same has happened with me and electrical retailer Tango.

6/. I understand that recording calls is a requirement. All I am saying is that it should be informed consent not just a statement because it gives the impression that there’s no choice.

7/. If it’s clear cut then I agree with your last para. That’s what I am saying. Make it clear cut so it’s easy for the average person to grasp.

The problem with this is that actual criminals will not bother to comply with such a law - and indeed may be located overseas so that the law would be unlikely to be enforced. If a criminal is intent on e.g. fraud or other identity theft, he or she is hardly going to be concerned with complying with rules around unsolicited outbound calling.

So it would only be effective to the extent that

  • people are familiar with what the law says, and
  • people use that to distinguish between legitimate calls and scam calls.

Since the telephone (including SMS) is inherently insecure, companies should probably just get out of the habit of making unsolicited outbound calls in situations like the one being discussed here.

2 Likes

Perhaps you need to think about the call from a bank’s perpective.

They have to abide by privacy laws.

If their call is about your account, or credit card, or loan, etc, the bank needs to verify to some extent that they are talking to correct person, and not just someone who happened to answer the phone.

If you choose to decline some basic verification, then the bank is doing exactly what they should do, and direct you to call them on their published support number. Where you no doubt have to provide verification anyway.

2 Likes

You seem to be asking that we neither ask for clarification nor volunteer additional information that may, in some cases, be useful to the questioner. If that rule was adopted many questions would not be answered. Given the difference between this last post and what you provided before I can see why there were several questions or comments that may have gone in the wrong direction.

1 Like

i’m ok with that - just a little peeved when someone gives me unsolicited advice on issues that are unrelated to my comment ie on comm preferences & how often I contact my bank as if i’m an idiot.
And there’s seems to be a pedant tone about some comments.
People need to be respectable of others and not dismissive and incredulous. It could come across as rude and disrespectful.

1 Like

calls to their support number allows use of phone keypad technology and is easily verifiable by the customer. Incoming calls from unlisted numbers are not easily verifiable by customers. So what I am saying - is the practice should not occur without something to assist the customer in verifying the incoming unlisted callers identity. Banks have resources to do this eg use of their phone app technology.

2 Likes

I assure you @Melmot, that from my part I’m not doubting anything you are saying about your experience :slightly_smiling_face:
It could be that the ways of communicating are getting more stringent lately.
I think you’re wise not to disclose those private details when you’re not sure of the caller’s identity. I also think it’s for our protection that the Bank won’t discuss anything on the phone unless they can make sure of our ID. Your solution to call them yourself is a good one.
I understand your concern that the way the bank is calling customers is too similar to the way scammers operate and I agree they should change methods, maybe text us to call them back on one of their listed numbers? :thinking:

1 Like

You raise a good point, but the phone system is what it is. It is open to nasty people impersonating real businesses and spoofing incoming caller numbers. Unless you recognise the voice of the person on the other end, and they recognise you, it’s down to asking verifying questions.

1 Like

maybe text us to call them back on one of their listed numbers?

Yes and go straight to start of queue

1 Like