--nick c

Australia

product development manager

Misha I didn't miss the point but my second line did confuse my argument.

A personalised pass code that the customer gives to the bank to be used to confirm that it is really the bank calling in the future is a really good idea. It will make it harder for a fraudster to set up shop and cold call customers Phishing for customer details.

It won't however stop a more targeted Identity theft attack where the fraudster has your initial details already but is hunting for more. In this case the FRAUDSTER calls the bank, gives them enough information to allow them to respond with your passcode. Now the fraudster has it.

The next call comes from the fraudster to you, and they are able to "validate" themselves to you because they have your passcode.

Before you know it, you have provided them with more trusted information than they originally had, and they head off and set up a new credit card in your name. Your identity has just been stolen.

Static passwords are better than nothing, but to beat phishing a one-time password from both the bank and the customer will be required.

--nick coster