Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Several times I get a phone call from a company- my bank, utility companies etc. Many times they are just cold calling me, but once or twice they were calling for legitimate reasons (ie, something to do with my account).

The problem is, all these companies ask you to confirm your personal details, like date of birth. Now I have no way of knowing if the person calling me is the real company, or some phisher (because even if the call isn't from a blocked number, it's just a number and I have no way of knowing who owns it).

Usually, when they ask me to ask for personal details to prove my identity, I tell them since they called, they should prove their identity.

At this point they usually get irate and warn me they cannot go ahead for security reasons. Now I don't want to miss out on important calls, but neither do I want to give out my personal info to anyone who manages to find my phone number.

Is there a proper way to deal with such calls?

share|improve this question
4  
I usually don't take their calls. I will just call them back on their official contact number and mention that an individual was trying to reach me. They will usually have notes on why they were calling you. –  Rowell Feb 5 '13 at 20:24
1  
Rowell is entirely correct. I have done this multiple times for contacts from my credit card company, and I have had people do this same thing to me when I have cold-called them. It should be standard practice for customers, and companies should have procedures to handle it. –  Jonathan Garber Feb 5 '13 at 21:40
1  
I have NEVER been asked to confirm my identity when my bank and other business contacts call me. They are calling you on the number they have file, its safe to assume, you are the account holder. Besides they shouldn't be giving out ANY personal information over the phone thats what a physical letter is for. If they are giving out identify information over the phone then I stop doing business with them. Besides most of the time I let them leave a voice message. If its urgent there is paper statements, email, and text messages. –  Ramhound Feb 6 '13 at 12:21

5 Answers 5

up vote 33 down vote accepted
+50

I react exactly the same as you- I first ask them to authenticate themselves to me, after all, they called me. If they can't or won't I tell them that I will call my bank manager/utility rep/whatever and that if this is an official message I should be able to receive it after authenticating the usual way.

Don't give in to them- they need motivation to start doing this right.

share|improve this answer

Just don't give them any information. Tell them that as you know they want to get in touch you will call the bank or go in and see them in person rather than deal with them on the phone. If they get irate just hang up you have every right to protect your privacy.

You could call your branch and get your branch to verify the number they have called on .. but then why not deal with it while you are on the phone to your branch.

Something to keep in mind is there is currently a SCAM going around where they will call you and ask you for your verification details etc. When you ask for their verification they will give you a branch number to call or tell you to call the lost number on the back of your card.

You then hang up and pick up the phone again to call the number. As they called you they can hold the phone line open (on landlines anyway) so when you pick the phone up to call the branch number you are still connected to the original caller (as they did not hang up). They hear you dialing the numbers and simply answer pretending to be the bank and of course will say everything is fine and to proceed.

So remember to check for a Dial Tone (hope they are not playing a dial-tone down the like to you). Better still ring a friend or the talking clock before you call your branch.

Any way the conclusion is just don't give out any info if its serious they will just ask you to call into your local branch or send you a letter.

share|improve this answer

i usually ask them to contact me via mail or email they already have on file.

share|improve this answer
2  
Though if they already have your phone number, it might not be a great stretch of the imagination that they could also have your e-mail address and could send a bogus e-mail as well. Same goes for most addresses if they are dedicated enough to pay postage. –  AJ Henderson Feb 5 '13 at 20:59
2  
@AJHenderson - Of course in most case these scam phone calls are cold calls. Just look at all the calls Microsoft Technical Support make to people. ( That company actually does exist btw but has no connection to Microsoft ). Microsoft WILL NOT call you about your infected Windows computer. –  Ramhound Feb 6 '13 at 12:28
1  
@Ramhound - there are two kinds of calls, one is cold calling where the scam is the point of the call. The other is phishing where it is more targeted and they are trying to get information to go after someone's account. In the latter case, they would have some information already that they are trying to fill out. But yes, it might help some cases. Also +1 for mentioning the "Microsoft" guys, I get calls for that scam fairly regularly. Since I'm a software developer, I enjoy getting hours of entertainment wasting their time asking non-sensical questions and see how they try to respond. :) –  AJ Henderson Feb 6 '13 at 14:03

Firstly, you are the customer. Getting irate at customers is bad business practice, so real banks train their operators not to act that way (the only companies who can afford to shout at customers are companies who are in the fear management business, i.e. the Mafia, non-democratic governments, and televangelists).

Secondly, banks train their customers to never, ever give personal details to unsolicited phone callers (or, for that matter, by email). Genuine bank operators, and good impersonators, know that -- the latter will thus have a handy story to cover that, and that story may be entertaining. This is the only point which justifies keeping on with the conversation; otherwise, it is just a waste of time and the only sane response is to just hang up.

If you are anxious about missing an "important phone call" from a bank or utility company, then tell them that you will call back in five minutes -- and five minutes later, you call them back, with the real phone number, not any number they gave you. If it is important, they'll still be there. And in that case, you will know that they have very sloppy security procedures and you will be entitled to shout and scream and threaten -- remember, you are the customer. That's your job.

share|improve this answer

I generally ask that they give me a call back number so that I can validate their identity. If they give you the number, tell them you will call them back momentarily at that number and validate that it is a number for the company they claim to be. If they get irate, ask to speak to a supervisor, if they still won't play ball, hang up on them and call the company they claim to be and ask about the call. If the call was legit, they should be able to let you know what it was about, if it was not, then it is good for the company being imitated to know so that they can warn their customers.

Never give out information that could be used to validate your identity without first validating the caller and generally the only way to safely do that (for both of you) is to initiate the call to them.

share|improve this answer
3  
There's no reason to trust the number they give you before they authenticate themselves. Ask them for a way to navigate the phone tree from a known public number for the company, instead. –  TREE Feb 4 '13 at 20:58
1  
@TREE - right, if I wasn't clear, you should validate the phone number before calling it back. If you can't find a way to validate it, then call the main number and try to validate the number with the company that way. –  AJ Henderson Feb 4 '13 at 21:00
2  
@DavidMarshall - Interesting, I was not aware that there were any phone systems currently in use that didn't process a line termination. If this is a risk in your area, then just call a known number that isn't them and see if you get the expected answer. –  AJ Henderson Feb 4 '13 at 21:36
3  
@AJHenderson In the UK landline calls are only terminated when the originator hangs up. There have been frauds reported recently where the caller claims to be a police officer from the Fraud Squad dealing with misuse of the callee's credit card. He invites the victim to ring the emergency number 999 to verify his identity. Subsequently the victim is persuaded to enter their card number and PIN on the phone keypad. In some cases a courier is even sent to collect the card. –  David Marshall Feb 4 '13 at 21:45
1  
@DavidMarshall - you Europeans get all the fun scams first. All they come up with over here are e-mails for male enlargement and "Canadian" pharmaceuticals. –  AJ Henderson Feb 4 '13 at 21:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.