We have a service where people register online and log fairly sensitive records. They might want to phone up and ask for a status update on these records.

At the time they are calling, they may not be on a mobile device or calling from a number that is connected to their online account.

The most obvious things that come to mind is them setting their own questions and answers. The phone operator then asks for the X/Y/Z places characters from the answer for a given question.

Is this a reasonable enough attempt to verify the user? Can (should) more be done? Any decent use cases floating around?

Thanks in advance

  • Depends on what's available. Do you have an app to push an authorization request, like Microsoft's app? TOTP authentication where you can ask for the current code? Security questions are often easy to bypass with various social engineering techniques, unless your phone operators are very well-trained and the answers are truly secret and difficult to guess. – Natanael Feb 19 '19 at 13:09
  • No such app. I guess it's a question of accessibility vs security? Could they set the questions themselves maybe? – Digital Skateboarders Feb 20 '19 at 7:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.