The Banks Need To Update Their Security

Bank of Montreal's MasterCard folks called me on a routine matter. Their call was from an auto-dialer. I don't tend to answer ID blocked / missing numbers since they are invariably telemarketers. When this call went to vmail, only the last half of the automated message was captured by my voicemail.

Given the amount of phishing that goes on (people claiming to be banks, insurance companies, etc. online and getting innocent citizens to divulge key financial or identification data), I wasn't convinced it was the actual bank calling me.

So I went to their website and looked up their 800 number. It didn't match the incoming call. There was no sign of the number that came in anywhere on their website either.

So, we have a portion of the bank calling me and not having a CLID show up on my cell and then not having that number represented anywhere on their website.

So how am I to know if it is the bank? I cannot.

You might say, simply answer the call. But that won't solve the problem. They'll ask if I am so-and-so and I will say maybe as having my name proves nothing. If they ARE the bank, they have NO BUSINESS giving any more than my name because they have no way to authenticate me. Just because someone picked up the phone when they called my number doesn't mean I'm the one holding the phone.

So I can't know it is them, as they can't provide me with any information they know without breaching my privacy until they are sure I am who they are looking to talk to and the only way they can authenticate that is to test that person on the phone against the actual information in my file - which discloses personal information they should not be disclosing IF the person they are talking to is not me.

There is NO MEANS to mutually authenticate.

The solution is relatively bulletproof and simple so I have no ideas why the banks can't be bothered and I passed on the suggestion in the faint hope that it might reach their IT department.

Before discussing my method of mutual authentication, they could at least do the following:

1. Have a valid Caller Line ID display when you call indicating it is the bank.
2. Have all of your phone numbers, no matter the department, listed on your website if calls will originate there. I emailed their contact email from the website and he explained it was one of their numbers and who was calling me, but this is a horrible method where every cardholder would have to do this and that's ridiculous.

Now, my method:

1. Issue me a credit card.
2. Using an out-of-band method like paper mail or forcing me to come to a branch and pick it up, send me a message two authentication numbers (long random letter/number strings). If I get it by mail, that's as secure as how I get my PIN from them. If I have to go to the branch to pick up my authentication codes, even moreso as I'll have to show ID there.
3. When someone from the bank calls me, they ask to speak to me. They say who they are and that they wish to authenticate my ID. The customer service clerk has pulled up these numbers from the database and I have them on my piece of paper which I get from my safe. (If I don't have it, I give them a time to call me back later)
4. They read me a number. I check my card. If it is not on my card, they are not who they say they are and I hang up and report them to the authorities. If it is on my card, I read them back the other number. They check that versus their database and decide I am who I am. Two way authentication is achieved without either of us disclosing anything like address or other financial details. I don't give up my validation number unless their validation number to me is correct. In order for someone to guess the right long alphanumeric string to challenge me with, they'd need to hack the bank and the bank's security should be preventing that or detecting it to get people to invalidate their codes and get new ones or they aren't doing their job.

For added security, make these one-time codes. After use, the cardholder has to pickup another one from paper mail or at th branch.

This mechanism, in order to be compromised, requires my value sheet to fall into hostile hands (about as bad as losing a PIN which we already accept as a risk) or the bank to be hacked or otherwise compromised (a very bad thing and the bank should be working hard to avoid this outcome).

It makes two-way authentication simple, easy to execute, and very hard to compromise.

What they have now is a sad and ineffective process where, if I'm taking due care, I won't answer them unless they disclose information they pragmatically and legally must not disclose until they are sure who I am. It's a catch-22 for both of us.

So, banks.... why haven't you fixed this?

And while you are at it, Europe is using one-time codes for internet transactions so your Credit Card number never goes to a vendor. (How: Vendor gives you a price, you hop on your mobile, go to your banks site, enter some particulars - vendor code, amount - and a one-time authorization number is generated and sent to your phone which you give to the vendor selling you stuff. He never gets your CC number, he can only bill you once (rather than repeat charging), and you'll be sure he is getting paid.

So, again, banks of North America, why haven't you adopted this system? The Europeans can make it work and its much safer than giving out your CC number to ever small business or big business, many of whom are insufficiently secure....

There's a lot of room for simple improvement here.