We have a service where people register online and log fairly sensitive records. They might want to phone up and ask for a status update on these records.
At the time they are calling, they may not be on a mobile device or calling from a number that is connected to their online account.
The most obvious things that come to mind is them setting their own questions and answers. The phone operator then asks for the X/Y/Z places characters from the answer for a given question.
Is this a reasonable enough attempt to verify the user? Can (should) more be done? Any decent use cases floating around?
Thanks in advance