nick coster

Australia

product development manager

Although I agree that this is a good step it makes the believability of a potential con stronger.

Let's say my bank password is "rabbit" and the bank calls me or I call the bank.

First the bank needs to ensure that they have the right customer, at least to a first level of authentication, so I provide them with my username or account number.

Now they tell me my secret password - "rabbit". So far so good....

Except I am actually a fraudster phishing the bank. Now I have the customers secret bank password. I can hang up and proceed with cold calling this unlucky customer and use the "secret" bank password to gain the customers trust. Now I just ask for all of the answers to all of the other identification questions that will allow me to steal the identity of the customer. <Dr Evil laughter>

The point here really is that a static password can be defeated quite easily in this manner. What is really needed is some way of sharing a pass code is available and useful only to the bank and the customer and cannot be replayed more than once. This is a harder problem to solve.

I am a big supporter of adding simple methods of raising the security bar, however customers must understand that it is only an incremental increase and should remain on their guard.

--nick c