Assuming a password is not stored in plain-text, how is it possible that a support guy is able to identify during a phone call a customer by asking him random characters of his password?
For example, if the password is "password", the support guy asks for the first and fourth characters, the customer says 'p' and 's'. At this point, the support guy considers he's speaking with the legitimate customer.
The only solution that comes to my mind is that they are using plain-text passwords, but I hope that's no the case and that there is another solution, because it's a bank...
PS: It's a real scenario, no a phishing attempt.
EDIT: as Matthew said, without having access to their system is impossible to know what is going on. The goal of my question was to known if there are any known "public" methods to achieve this, not a custom made algorithm.