Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was signing up for UPS my choice and they asked me some security questions.
It asked me questions that signified that it was able to figure out:

  1. Who my father is and when my father was born.
  2. My past addresses.
  3. What year I graduated high school.

I called up UPS technical support and they told me this information is pulled from public records. The information they had was: My Name, my address, and my birthdate.

These questions seem completely useless from a security standpoint. If they can obtain that information, so can another person. In order to better understand this security concern, I was hoping someone here can tell me more about these records.

share|improve this question
5  
I'm a little lost as to what the question is, here. Are you asking how you can look up this information for yourself, or what (if any) is the security benefit of a company requiring this information to validate your identity? –  Iszi Nov 7 '12 at 21:26
    
They're probably pulling it from Experian, but I'd be interested to know how they know what year you graduated in. You can always ask them what source they got the data from, since it's your right (at least in the UK, anyway, due to DPA 1988). –  Polynomial Nov 7 '12 at 21:44
    
@Iszi, the question is, where did they obtain this information? And how do I obtain this information? –  user606723 Nov 8 '12 at 21:17
    
@Polynomial I know this is an old question, but in the US at least, UPS refuses to disclose the source of the information. I was rather irate with the customer service rep when she asked which person I was not related to in a list. Seriously, UPS is a package delivery company, they have no business knowing or having access to this kind of information. –  SnakeDoc Oct 22 at 20:17

1 Answer 1

These kinds of things are a little odd from a security stand point, but they do add a slight bit of value if they are not the exclusive mechanism used. The idea is that they should be giving a limited time to respond to the question and pull from a broad enough set of information that it would be difficult for someone other than you to have the information all at hand when it is needed. It certainly can be fooled and shouldn't be relied on as the only method of verifying identity, but it's at least a little harder than simply saying "yes, I'm me."

share|improve this answer
    
the fact that UPS, a package delivery service, has access to these records is terrifying. I mean, it's not exactly easy to see that some person in my family without my same last name and lives across the country is somehow related to me, but UPS knows. –  SnakeDoc Oct 22 at 20:14
    
@SnakeDoc - it's all public records. Birth certificates and places of residence. Mail forwarding services, etc. –  AJ Henderson Oct 22 at 20:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.