What is the best protocol for an organisation to make phone calls to clients, where the client is required to verify their identity?

Question

I've experienced a couple of times, an organisation has called me, but they require me verify who I am with security questions.

Most recently, this was my credit card company who left a voice message with a number to call re: possible fraud on my account.

The obvious security risk here, is that it could be a scammer, who is then going to use those details gain access to my account.

In these scenarios, having a modicum of security conscientiousness, what I do is acknowledge the call, request a ticket number if there is one, and look their phone number up on the website, and call back that way.

In my credit card example - the number they'd given me wasn't listed, so I called their general helpline and requested to be transferred.

I think from a end user/consumer's point of view, this is the right protocol.

The question is - what should the organisations themselves be doing to encourage good security? It seems like a very bad habit to teach their customers - to reveal identifying information to people who call them.

Answer 1

The best way is to make it trivially easy for a customer to get to the right place through the number on their card, on their statement, on your website; more, to make it impossible for a bank department to have a number not listed on the bank website.

You can do this via a reference number, a code word, (eg, "please call us back on the number on your card, and say "fraud" as soon as our messages start.") You need to ensure that when the customer calls in this way, they get to the right place.

You also need to train customer service reps to respect the customer's choice to call back. Far too often, CSRs will denigrate or undercut the desire to return a call. They might suggest that caller ID is trustworthy or even tricky to spoof. It is not.

When I was at Microsoft, we studied this pattern, which is where an organization acts the same way a fraudster does, and results in people being unable to form a model of secure behavior. We called this pattern "scammicry" for the mimicry of a scam.

There are additional tools you can use, including biometric voice authentication, asking questions which don't expose the answerer to identity theft, such as knowledge of recent transactions, so that calls from the bank are not so worrisome. (Note that if there are a small number of recent transactions, then a scammer who calls can get those, and then authenticate to the bank.)

Answer 2

Some ways for callers to authenticate themselves:

• Route all outgoing calls through a single official phone number
• Introduce themselves by disclosing a shared secret (sort of like QubesOS' anti-evil maid)
• Distribute a dedicated smartphone app that validates their numbers
• Liaise with apps like TrueCaller to validate registered trademarks with the equivalent of Extended Validation Certificates

This list will be updated as more ideas come to mind.

Answer 3

You've pretty much got everything you need to answer your own question. Unfortunately this isn't a new problem either. Here's an article from the BBC in 2012 that describes your exact problem, questions, and concerns:

http://www.bbc.com/news/uk-19677434

This article mirrors a lot of your same thoughts and has the same conclusion hiding between the lines: someone who calls you and asks you to verify your identity is doing things completely backwards. It absolutely trains people to have have habits (my bank says they called - let me give away my information) that make them more vulnerable to scammers in the future, and it's a poor way of doing business. Again, in the BBC article you get a clear impression of why the banks do it: it is a quicker and more cost-effective way of getting a hold of customers and stopping potential fraud early. On the face of it, that sounds like a good thing. However, as you point out, it will absolutely train people to have the wrong habits in the long-run, potentially increasing fraud.

It all boils down to a single unfortunate fact: just because banks handle our money doesn't mean that they are actually good at security or understand the broader ramifications of what they do. That fact is very obvious from the severe bungling that many banks still have in regards to passwords, as can be seen from any number of news stories (these are from 2016):

1. https://threatpost.com/weak-bank-password-policies-leave-350-million-vulnerable-say-researchers/116574/
2. Bad password policy at my bank
3. https://www.securitymagazine.com/articles/86965-research-finds-bank-password-policies-often-weak

As I think you already understand, you can't just assume that these guys actually know what they are doing. So what should they be doing? In the end complicated problems like this will only be solved with a multi-faceted approach.

1. Use an official app and to notify the customer through that. This actually has the best bet for quick responses. Unfortunately, there are probably a large number of customers that won't ever install the bank app which means that this can't be the only answer. Of course, you also have to make sure your app ecosystem is very secure: otherwise you just create a new avenue of attack for hackers. Moreover, you have to be extra vigilant against the potential dangers of stolen phones being a source of fraud.
2. Calling people with an automated message and asking them to call you back on the number on the back of the card is probably the most effective all around option. It will reach the most people, and it will get them in the habit of the most secure method of contacting you. I would have the automated message say something like "please never give out personal information to unexpected callers who call you: always call the number on the back of your card if you have any problems". As you say, this gets people properly trained. However, there are some people who may ignore the message (I sometimes ignore phone numbers I don't recognize and I also don't have voicemail turned on).
3. Text alerts are another good method of letting customers know there is a problem. Same thing: "We found suspicious activity, call the number on the back of your card ending in 1234".
4. All of the above options still leave holes where the customers may not get back to the bank quickly. This is the banks biggest concern and why some banks (such as the ones in the BBC article) feel the need to send out automated calls in an insecure manner (i.e. asking you to verify yourself after they call you). Fraud that does not get resolved quickly costs the banks more money: there is a finite period of time when they can cancel the transaction before money is even sent, and if a card has been stolen the quicker they cancel it, the less fraud they have to deal with. Therefore, the bank needs to take action, and the sooner the better. As a result the best bet for a bank is a final step of freezing a card if fraud is suspected and a quick response isn't received from the customer. I've had this happen plenty of times: my card gets frozen because of suspected fraud, that forces me to call the bank, and then everything gets resolved. This is also an option that you have to use judiciously. People get irritated if you constantly freeze their cards for no good reason and ask them to call you to get it unfrozen.

Again, these aren't meant to be competing options: a banks best bet is to reach out to the customer immediately in a few different ways and establish communication over a secure channel (i.e. a well secured app or by calling the bank directly). Then you can ask them to verify themselves without worry, and you've taught them proper security best-practices. This also isn't particularly hard to do, or expensive to setup. Unfortunately, I doubt many banks operate this way.

But what about ...

This is worth a mention. The answer I gave is very straight-forward and simple, and is basically just: contact customers via phone/app, have them call you, and then straighten it out. This is such a simple answer that it is almost silly. There are plenty more options that we could come up with. How about the bank verify itself via some pre-shared secret? How about using some sort of OTP scheme? What about some form of pre-shared private-key encryption scheme? (that last one is practically gibberish). There are probably lots of ideas people could come up with to let a bank verify itself to a customer to get the process rolling and not force the customer to call the bank back. The underlying problem with all of these though is that it relies upon the customer to be able to understand and follow whatever the method is successfully a high percentage of the time. That is never going to happen.

The reason we know it is never going to happen is because it's hard to get people to follow even the simplest of advice: "Don't give out personal information to unsolicited callers! Just call your bank directly" or more generally "Don't reuse your password on multiple websites!". Banks aren't bad at security because banks suck: they are bad at security because WE are bad at security. Banks are limited in their options by what they can actually get their customers to do, which is not necessarily much.

Answer 4

I don't think there's any good way for an organization to verify themselves over the phone.

The primary reason is that consumers aren't familiar with how verification works, and could easily be fooled with providing some easily gotten information if the consumer expects the other party to verify themselves (Home address, first 4 digits of the credit card, etc). Even if you're a security researcher and not prey to this more simple form of social engineering, how are you supposed to be familiar with every credit card company or banks verification scheme, and whether it's "good" or not?

The implication here is that banks and credit card companies should never contact consumers and ask for any personal details. Fraud has been going on for a long time, and banks and credit card companies have dealt with it for many years without calling up consumers.

In other words, block the transaction, and let the consumer call YOU rather than the other way around.

Alternatively, send a text/email when a fraudulent charge is suspected and blocked. But even this might invite the potential for fraudsters to start emulating this behavior, and get consumers to contact them via a fake phone number in the text.

Answer 5

An organisation (particularly one where it is important to authenticate before passing too many details over) could leverage existing 2 factor authentication technology, like the one-time pad a user may use to authenticate access to a bank account or a phone application akin to Google Authenticator.

My bank's website uses this in 2 ways: firstly you simply generate a token to gain access to the site in the first place, using a little device that has the 'seed' locked to your account. This may be familiar to many as standard '2 Factor Authentication'. The other way it uses this is via a challenge/response method when I want to add a new account payee to the system: I enter the new bank details, the website then generates a 8 digit code. I punch this into the bank's device and it returns another 8 digit code - if the returned code matches what the website thinks it should be, that account payee is added to my list of authorised parties and I can then send money.

An organisation with sufficient will could utilise this in reverse - if the bank, credit card company, whatever calls you then you could give them an 8 digit number, they punch that into their systems which returns a response code. If that matches the response code that your device/phone app is displaying then you have effectively authenticated each other. It may initially be onerous for customers to use, but it would have 2 benefits; that of training people in good habits that may be of use elsewhere on the internet (and other untrusted zones) and also generating absolute confidence in the organisation.

There would be the proviso that this would need to be deployed properly with all the usual safeguards, code reviews, caveats and the like to make the system meaningfully secure.