Slightly Off KIlter

We have three accounts with the same bank – a mortgage, an equity line, and a checking account. Last week, we received a telephone message.

Please call Mrs. Snow at TheBank, 800-555-0123

So Rich called the number… Voice maze. Was it TheBank? Was it a clever forgery?

Next, he asked me for a bank statement… I gave him one of each. None of the 800 numbers matched of course.

Rich picked an 800 number (largely at random) from one of the statements and dialed. When he finally reached a human, that human couldn’t find the original number (from the message) in any data base. That’s not to say it wasn’t a legitimate bank number, of course, but… how can you tell?

Can you see where this is going?

Rich finally managed to track someone down who a) Rich believed worked for TheBank and b) could figure out why we might have received a telephone call. After a lot of to-ing and fro-ing and mother’s-maiden-naming, Rich finally managed to get the actual problem solved (for today).

He then spent the next half hour explaining to the bank representative why we can’t just take their word for it that a telephone message really is from the bank, especially when the caller leaves no useful information in the message. I’m not sure that this does any long-term good but… Rich seems to enjoy the challenge.

We live in an age of phishing expeditions, computer-aided fraud, and identity theft. It should come as no surprise that neither Rich nor I are willing to simply trust that a telephone message, purporting to be from TheBank, is really from the bank! What does come as a surprise to both of us, however, is how much effort it takes to convince the bank employees why we can’t trust those messages. After all, they’ve told us they are calling from TheBank (and they are Very Sincere and Honest).

(By the way, in a similar discussion years ago with a different bank, I was informed that the appalling lack of actual content in the telephone message is a government requirement to “protect” my privacy. Unfortunately, that only gives the phishers more room to maneuver.)

Problem solved, security lecture delivered, you’d think that would be the end of the story… However, the Universe has a wry sense of humor.

Today we received a telephone message (amazingly, with even less content than the previous effort!)

Please call TheBank, 800-555-9876

Gee. Not only a different number, but not even a name to go on this time. On the other hand, this time when Rich called (again, choosing a number printed on one of our bank statements) the human he finally reached was able to find the 800 number from the message in a list of actual bank telephone numbers.

After solving the problem that had prompted this message (in this case a problem caused by TheBank when they were “fixing” the previous snafu), Rich spent another half hour explaining general security precautions, identity theft, and phishing attacks to another bank representative.

This time, he’d had a week to think on the problem, and presented a suggestion the bank rep thought was worth passing up the chain. I thought so too.

What if all companies like TheBank came up with a single customer service number and printed this on all of their statements (checking, credit cards, etc). They could do a marketing campaign:

The Only Number You’ll Ever Need!

If the bank needed to contact a customer, they could call and say, “Please call TheBank at This Special Number (which you can find on your statements). When you call, please provide the following Reference Number and we will direct your call appropriately.”

I would be able to trust that the message was from TheBank because the telephone number is trusted – it’s printed on all of my statements. When I returned the call, the reference number I was given in the message would identify me to the bank (in so far as I’m the person who received the message 🙂 and pass me through to the proper department. At that point, we could take the next steps in the identification dance (is my mother’s maiden name really that secure a password?)

Not only would we have a secret handshake, but that reference number might be enough for the bank to be able to tell me why they called in the first place… even when we have multiple accounts.