Have you ever been asked this security question?

[madoka]

I had to change my credit card due to fraudulent charges, so places where I had recurring charges are now calling me for my new number.

Earthlink calls me because I have an email account with them. It's an Indian customer service rep with a thick accent, so I have to ask him to repeat things. He verifies my name, email address, and new credit card number. Then he asks me if I'd like to prepay my account for an year and I said yes.

For security purposes, he asks me what my father's middle name is.

I told him:

1. You've already verified my info, so what security purpose is there in this situation? To prevent some benevolent stranger from prepaying my account?

2. Who on earth asks for your father's middle name? I asked him twice if he meant mother's maiden, and he confirmed each time he needed my father's middle.

Since I've never given my father's middle name to anyone, I don't know what it would prove. Have you ever been asked this question before?

 

[Sonikku]

Clearly he was fishing for security question answers so he could take control of some of your accounts via password resets.

 

[olds]

Clearly he was fishing for security question answers so he could take control of some of your accounts via password resets.

Phishing

 

[Humpy]

Don't act like we don't know your father's middle name is James.

 

[mrjminer]

I had to change my credit card due to fraudulent charges, so places where I had recurring charges are now calling me for my new number.

Why would you give any information to them at all

Might as well go ahead and change your card number again now, fool

 

[LTC8K6]

Calling you for a credit card number?

No.

 

[who?]

Since people are less likely to have used this on other sites it's probably more secure.

 

[DaveSimmons]

I would never give them the info over the phone. Odds of that really being Earthlink are not great.

After you change your CC again because of the new fraudulent charges:

Next time you get a call like that, say "thanks for reminding me, I'll go to the website and update my card." Then go to the website directly, not by clicking on some link in an email, and update your card.

 

[lupi]

WTF?

 

[madoka]

No, it was definitely Earthlink. He knew my name, email account, what my charges were for, how much it cost per month, how much I was overdue, etc.

It's just a weird question to ask, since no one asks for your father's middle name. I wonder if it's a cultural difference with India.

 

[thesmokingman]

No one uses father's middle name cuz the father's middle name carries no weight like the mother's!

 

[KeithTalent]

He called you? Phishing. I always make sure I have initiated contact before providing any info. If someone calls me, I hang up and call the main number on my card or I go to the main website and log in securely that way.

KT

 

[gorcorps]

No, it was definitely Earthlink. He knew my name, email account, what my charges were for, how much it cost per month, how much I was overdue, etc.

It's just a weird question to ask, since no one asks for your father's middle name. I wonder if it's a cultural difference with India.

He's good, and you bought it

Good luck getting your identity back :\

 

[WHAMPOM]

I had to change my credit card due to fraudulent charges, so places where I had recurring charges are now calling me for my new number.

Earthlink calls me because I have an email account with them. It's an Indian customer service rep with a thick accent, so I have to ask him to repeat things. He verifies my name, email address, and new credit card number. Then he asks me if I'd like to prepay my account for an year and I said yes.

For security purposes, he asks me what my father's middle name is.

I told him:

1. You've already verified my info, so what security purpose is there in this situation? To prevent some benevolent stranger from prepaying my account?

2. Who on earth asks for your father's middle name? I asked him twice if he meant mother's maiden, and he confirmed each time he needed my father's middle.

Since I've never given my father's middle name to anyone, I don't know what it would prove. Have you ever been asked this question before?

Every one I do business with tells me they will never call and ask me for this kind of information. You just gave your new info to the people charging fraudulently on your last one.

 

[glenn1]

If trainers ever wanted an example for the topic of phishing and what to do and not to do, they could just quote OP's post. This is like one of the poorly written and acted scenarios that us corporate types get forced to take in annual training. You could just drop in some poorly drawn clip art and you'd have a ready made learning event.

 

[randay]

it is now clear why you have had fraudulent charges. call your credit card company and change your card number again. then proceed to learn how to not give away your credit card information over the phone to random people who call you claiming to be someone/something that you cannot verify.

 

[WHAMPOM]

No, it was definitely Earthlink. He knew my name, email account, what my charges were for, how much it cost per month, how much I was overdue, etc.

It's just a weird question to ask, since no one asks for your father's middle name. I wonder if it's a cultural difference with India.

You used your father's middle name as a security question and forgot it? He knew your info by using your old card to get it. You are now in the shame me twice terrority.

 

[thesmokingman]

Oh the ironing...

 

[Miramonti]

I always use Roboform to generate a unique random 'password' to use for all security answers (then of course save the fields as a new passcard.)

 

[MtnMan]

NEVER give a credit card number to someone that calls you.

 

[ViviTheMage]

RIP OP's identity

cancel that card at a minimum.

 

[John Connor]

Social engineering. Now you should wonder how he had the other info.

 

[Dr. Zaus]

Social engineering. Now you should wonder how he had the other info.

If he's late it's almost all available via credit report.

 

[Carson Dyle]

He told _you_ the credit card number on the phone? The entire number? Are you sure??

In a system configured to store credit card information securely, I wouldn't think CSRs would have access to CC numbers. That would be be a huge security hole. They would have no need to see them, as they'd only be used by the computer systems to make transactions. Nobody is going to key those numbers into a card terminal.

If the guy who called you actually did have your CC number, I would cancel it ASAP.

 

[Dr. Zaus]

He told _you_ the credit card number on the phone? The entire number? Are you sure??

In a system configured to store credit card information securely, I wouldn't think CSRs would have access to CC numbers. That would be be a huge security hole. They would have no need to see them, as they'd only be used by the computer systems to make transactions. Nobody is going to key those numbers into a card terminal.

If the guy who called you actually did have your CC number, I would cancel it ASAP.

He just said he 'verified it' now who gave the information up first. The 'real' verification was this:

No, it was definitely Earthlink. He knew my name, email account, what my charges were for, how much it cost per month, how much I was overdue,

And when you get far enough behind the company reports almost all of this to the credit agencies.