Dateline: a couple of minutes ago. My mobile phone rings. It’s Internode, my soon-to-be ISP. They’ve noted that I ordered a new ADSL2 modem to go along with my upgrade to their service from my soon-to-be-ex ISP, but I’ll need to pay for it. Would I be available to pay for that now, if they put me through to the accounts department? “Sure!” I say. They put me through. A nice polite fellow takes down my credit card details and quotes me a receipt number. Have a nice day, he says.
He then hangs up the phone and forwards my details to his mafia masters. Shortly afterward, my credit card gets maxed out, and my identity is stolen for use by Ukrainian kitten stranglers.
… Or it would be, or could be, if I were careless and unlucky. Here’s what really happened:
Dateline: a couple of minutes ago. My mobile phone rings. It’s Internode, my soon-to-be ISP. They’ve noted that I ordered a new ADSL2 modem to go along with my upgrade to their service from my soon-to-be-ex ISP, but I’ll need to pay for it. Would I be available to pay for that now, if they put me through to the accounts department? “Of course not!” I say. You could be anyone! I’m sure I mentioned my plans to change to Internode on at least one public blog comment in the last few days. If you’re really from Internode, prove it: send me an email with the details for your payments website, and I’ll pay there, happily.
This is not rocket science. Security Through Sincerity, as I call it, is freakishly common. I got a call from the Commonwealth Bank, if you can believe it, asking me to quote them all sorts of details about my identity and account so they could talk to me about it. They wouldn’t prove who they were by (a) giving me a phone number I could call them on, or (b) telling me something only the bank would know about my account, because that would be a security breach! I told them to go stick their heads in a pig. But the best bit is that, not long after, they sent a form letter to all their customers, proudly announcing that their security measures were being beefed up, and reassuring us that all future cold callers would identify themselves by, in effect, saying they were from the Commonwealth Bank.
No doubt they would do so very sincerely, so we’d know it was true.
It’s alarming that banks and ISPs aren’t checking their processes. A lot of people trust the voice on the other end of the phone, forgetting that it’s not hard to put clues together and deduce personal information about pretty much anyone. Perhaps they feel a little silly, even impolite, questioning these people, all of whom presumably know what they’re doing. The result is, of course, identity theft and fraud, and a lot of people left out of pocket while the Black Hats prosper.
The only solution is for those big businesses to audit and improve their policies, and kick up an almighty fuss about their competitors who don’t follow suit. All else being reasonably equal, I’ll happily move to a service provider that understands this sort of simple concept. Sadly, they’re pretty sparse.
Meanwhile, a happy ending: Internode sent me an email with identifying details that only they know. I logged on to their accounts website and paid for the modem. No worries.