About three times a year I have a debate with someone calling from American Express about data security and identity theft. I've never blogged it before, because I didn't have an answer - and nobody likes a ranter! Now read on:
My mobile phone rings - the called ID says "witheld" or "private" and someone says "I'm calling from American Express, to confirm your identity, can you please tell me..." and then they ask for a piece of personal information.
Every other day, my bank, the press, financial advisers on TV all tell me "we will never ask you for personal information, do not give out personal information on phone or email, it could help someone steal your identity".
So I say "how do I know you're calling from American Express" - I even ask them to give me information only Amex would know. For example, what kind of card account do I have? There then follows a whole catch-22 conversation where they say they can't do this because it breaches the Data Protection Act and they have to verify my identity first. Anyway, I'm very bored with this conversation now, and have written to Amex several times outlining the inherent issue with this approach, but no response... and it's too frustrating to continue debating and for them to do nothing about it.
So finally, I have a solution. You know the CVC number on a card? On an Amex card, it's 4 digits on the front. On most others it's three digits on the back. It's that 'secret' code you give out to prove you have the card in your possession.
Well, why not put another number on the card? A number that only the card issuer knows? So when I ask "how do I know you're calling from American Express" they can say "do you have your card with you? well, the 5 digit number on the bottom left is...". Now, unless they're Derren Brown, I'm going to be pretty happy that they're not fooling me.
Alternatively, they ask me to set up a password for me to use when I call them - why don't they set up one that they use when they call me? This has happened for years in utility companies where vulnerable people set up a password that maintenance engineers use when they come to the house.
So come on credit card companies... it's two simple answers. It doesn't cost a lot to implement and it will make your customer's data more secure. Why not do it?