Forest Global Training Partners

Cyber Risks · Krebs on Security

Simple Banking Security Tip: Verbal Passwords

Summary: Krebs recounts moving his accounts to institutions that let him add a verbal passphrase required before any phone discussion of account details, and describes testing banks by claiming he forgot the phrase to see whether staff would fall back on SSN, date of birth, or knowledge-based authentication questions. He cites Gartner analyst Avivah Litan saying a verbal password adds more security than KBA built on compromised credit bureau and life history data, and notes it is free and convenient but should be unique and not reused from online passwords.

What's compelling: Krebs found that many customer service staff would accept SSN and date of birth alone when he said he did not remember the phrase, and one commenter describes a SIM-swap attack that cleared out a coworker's bank accounts in under 30 minutes using one-time codes tied to a phone number.

Read the original at Krebs on Security ↗

Topics
Identity & Access Management
Related