The 800 number can use ANI to check that you appear to be calling from the phone number associated with the account. Not perfect, but better than "coming from some IP address" is.

And sure, regular joes can't fake their ANI -- but can you count on a fraudster being a regular joe?


- ask

oh, I forgot to add: I (too) prefer the convenience of just having to call the number and give them my account number and have the robot be satisfied with that.

With credit cards then almost by law it's hard to care about the security. Fraud is almost 100% Not My Problem (speaking as card holder, speaking as merchant it's of course not so).


- ask

isn't that because it's linked to your phone number so they know it's you calling?

or someone on a lineman's headset at your phone box, since they already know where you live when they swiped your mail. shopping spree!

lol

Operator: "Hello, can I have your phone number and online account password?"
Me: "Yes my number is XXX-XXX-XXXX and the last four digits of my SSN are XXXX"
(they accept either)
Opertaor: "Thank you, next time you call you can also give us your online password of XXXXXXX"

WTF!?!?!?!?!?!

"Hello, we don't hash passwords. Don't ever use this password anywhere else, ever."

I just went through the same thing with Bank of America. Someone got my card number and started having a ball with it, the Bank shut it off so quick it wasn't funny, then called me. They sent out a new card and I found the same nonsense on the web site, so I called the 800 number and only had to give them the card number and the security code. The bad thing was it was a regular charge card with a whopping credit limit, the good thing was the realized quickly that I couldn't be in three different stores making purchases at the same time. So they declined everything and blocked the account.
~Mark

I've had cards where you only had to call the number. The robot answered and just said "your card has been activated". I thought that was clever.

I guess they figure that if you are calling from the right phone, and know the number to call, you probably have the card anyway so reciting digits from it gives no additional security.

They already have your SSN.

Oh, I'm quite certain of that. I object to how often it's "required" when it shouldn't be. Also that security principle that the more your credentials are asked for, the less important they become. I'm quite certain my operating system has my password, but once it asks me for it every 30 seconds to do any action, I stop thinking about why I'm entering it.

Wikipedia, unsurprisingly, explains why I hate giving out SSNs better than I could, for those that are confused:

http://en.wikipedia.org/wiki/Social_security_number