# Your bank calls you up and asks for your SSN: what do you do? **URL:** \ **Category:** In My Humble Opinion\ **Created:** [December 28, 2021, 11:56pm UTC](https://boards.straightdope.com/t/your-bank-calls-you-up-and-asks-for-your-ssn-what-do-you-do/956818 "2021-12-28T23:56:30Z")\ **Posts on this page:** 18\ **Page:** 3
**Author:** ![Briny\_Deep](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/briny_deep/32/17188_2.png) [@Briny\_Deep](https://boards.straightdope.com/u/Briny_Deep)\ **Post date:** [December 30, 2021, 2:50pm UTC](https://boards.straightdope.com/t/your-bank-calls-you-up-and-asks-for-your-ssn-what-do-you-do/956818/41 "2021-12-30T14:50:23Z")
> [@HMS\_Irruncible](#): > > You were prudent and well within rights to be extra-secure by calling back. I might have done the same. But to close an account for this reason… well, it’s your time to waste if youwant. It’s kind of a throwaway account, not much money, and I was on the fence till (as above) I discovered they’d changed their service charge agreement in their own favor without ever notifying me. Two strikes and you’re out, in this case. ---
**Author:** ![Riemann](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/riemann/32/3133_2.png) [@Riemann](https://boards.straightdope.com/u/Riemann)\ **Post date:** [December 30, 2021, 2:52pm UTC](https://boards.straightdope.com/t/your-bank-calls-you-up-and-asks-for-your-ssn-what-do-you-do/956818/42 "2021-12-30T14:52:25Z")
> [@HMS\_Irruncible](#): > > But any time the bank calls you to discuss your account, they should ask for an authentication secret to verify your identity. That’s a perfectly good practice! And you implicitly agreed with this practice when you sign up Er, what? No, it’s a terrible practice to ask for confidential identifying information when an unidentified number _calls you_. They know who you are because they called you. You don’t know who _they_ are. If it’s essential to verify that someone other than the account holder didn’t answer the phone, there has to be some other procedure - calling back, or some kind of _exchange_ of information - some kind of question-and-response procedure where both the question and the answer are secret. ---
**Author:** ![Briny\_Deep](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/briny_deep/32/17188_2.png) [@Briny\_Deep](https://boards.straightdope.com/u/Briny_Deep)\ **Post date:** [December 30, 2021, 2:53pm UTC](https://boards.straightdope.com/t/your-bank-calls-you-up-and-asks-for-your-ssn-what-do-you-do/956818/43 "2021-12-30T14:53:56Z")
> [@Riemann](#): > > Er, what? No, it’s a terrible practice to ask for confidential identifying information when an unidentified number _calls you_ . They know who you are because they called you. You don’t know who _they_ are. x1000. This is the entire point. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [December 30, 2021, 2:54pm UTC](https://boards.straightdope.com/t/your-bank-calls-you-up-and-asks-for-your-ssn-what-do-you-do/956818/44 "2021-12-30T14:54:19Z")
It’s stupid because by doing exactly what scammers would do, it provides cover for scammers. The proper response to someone calling you and asking for your SSN is to call the police. Yes, they need to verify who you are. By calling you, they’ve already done that: They know that you’re the person with your phone number. How do they verify who THEY are? ---
**Author:** ![running\_coach](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/running_coach/32/15836_2.png) [@running\_coach](https://boards.straightdope.com/u/running_coach)\ **Post date:** [December 30, 2021, 3:00pm UTC](https://boards.straightdope.com/t/your-bank-calls-you-up-and-asks-for-your-ssn-what-do-you-do/956818/45 "2021-12-30T15:00:57Z")
> [@Chronos](#): > > Yes, they need to verify who you are. By calling you, they’ve already done that: They know that you’re the person with your phone number. How do they verify who THEY are? - Maybe allow the customer to designate a passcode/phrase/PIN the service rep can use to authenticate? ---
**Author:** ![Briny\_Deep](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/briny_deep/32/17188_2.png) [@Briny\_Deep](https://boards.straightdope.com/u/Briny_Deep)\ **Post date:** [December 30, 2021, 3:02pm UTC](https://boards.straightdope.com/t/your-bank-calls-you-up-and-asks-for-your-ssn-what-do-you-do/956818/46 "2021-12-30T15:02:36Z")
> [@running\_coach](#): > > Maybe allow the customer to designate a passcode/phrase/PIN the service rep can use to authenticate? Ho ho, I like that! ---
**Author:** ![HMS\_Irruncible](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/hms_irruncible/32/7394_2.png) [@HMS\_Irruncible](https://boards.straightdope.com/u/HMS_Irruncible)\ **Post date:** [December 30, 2021, 3:03pm UTC](https://boards.straightdope.com/t/your-bank-calls-you-up-and-asks-for-your-ssn-what-do-you-do/956818/47 "2021-12-30T15:03:56Z")
> [@Riemann](#): > > Er, what? No, it’s a terrible practice to ask for confidential identifying information when an unidentified number _calls you_ . They know who you are because they called you. You don’t know who _they_ are. Er… if you have my phone number, you have no idea whatsoever that I’m the person who answers it. If your bank ever expects to proactively call you, they _must_ have some way of authenticating you, whether that’s SSN or some other secret. ---
**Author:** ![Riemann](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/riemann/32/3133_2.png) [@Riemann](https://boards.straightdope.com/u/Riemann)\ **Post date:** [December 30, 2021, 3:04pm UTC](https://boards.straightdope.com/t/your-bank-calls-you-up-and-asks-for-your-ssn-what-do-you-do/956818/48 "2021-12-30T15:04:08Z")
> [@running\_coach](#): > > a passcode/phrase/PIN the service rep can use to authenticate? It seems to me that a question and answer set up the customer serves this purpose. Just as “what is your SSNO” is not acceptable, it could not be something as vague as “what is the name of your pet”. The question itself should contain information that would be unknown to a scammer. For example" “What is the middle name of your Aunt Jemima?” ---
**Author:** ![Riemann](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/riemann/32/3133_2.png) [@Riemann](https://boards.straightdope.com/u/Riemann)\ **Post date:** [December 30, 2021, 3:06pm UTC](https://boards.straightdope.com/t/your-bank-calls-you-up-and-asks-for-your-ssn-what-do-you-do/956818/49 "2021-12-30T15:06:23Z")
> [@HMS\_Irruncible](#): > > Er… if you have my phone number, you have no idea whatsoever that I’m the person who answers it. If your bank ever expects to proactively call you, they _must_ have some way of authenticating you, whether that’s SSN or some other secret. Which I addressed, in the second part of my post. Many people would be happy to stipulate ahead of time that if the bank calls their cellphone, the bank can assume that nobody else has access to the phone. Alternatively, some _exchange_ of information must take place - it cannot just be a one-way flow of identifying information from the person who answers the phone to the caller. In any event, if the “wrong” person _answers_ the phone, the consequential damage is relatively small - a family member or colleague who should not be told things about your account; or at worst a random stranger if the bank misdialled. Whereas if the “wrong” person is calling, they will certainly be a scammer. It’s much more vital that the _caller_ be identified correctly. ---
**Author:** ![Briny\_Deep](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/briny_deep/32/17188_2.png) [@Briny\_Deep](https://boards.straightdope.com/u/Briny_Deep)\ **Post date:** [December 30, 2021, 3:22pm UTC](https://boards.straightdope.com/t/your-bank-calls-you-up-and-asks-for-your-ssn-what-do-you-do/956818/50 "2021-12-30T15:22:45Z")
> [@Riemann](#): > > Whereas if the “wrong” person is calling, they will certainly be a scammer. It’s much more vital that the _caller_ be identified correctly. Which is why they quite properly give you the third degree _when you call them._ ---
**Author:** ![control-z](https://avatars.discourse-cdn.com/v4/letter/c/eada6e/32.png) [@control-z](https://boards.straightdope.com/u/control-z)\ **Post date:** [December 30, 2021, 3:29pm UTC](https://boards.straightdope.com/t/your-bank-calls-you-up-and-asks-for-your-ssn-what-do-you-do/956818/51 "2021-12-30T15:29:58Z")
I would have called back too, but closing the account over it is likely pointless. Knowing human nature, _every_ financial institution likely does stupid things with your info, you just usually don’t see it. ---
**Author:** ![susan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/susan/32/17537_2.png) [@susan](https://boards.straightdope.com/u/susan)\ **Post date:** [December 30, 2021, 5:01pm UTC](https://boards.straightdope.com/t/your-bank-calls-you-up-and-asks-for-your-ssn-what-do-you-do/956818/52 "2021-12-30T17:01:31Z")
I use a credit union. They never ever call, but instead use mail or email. If I need to prove my identity, there’s a PIN on the account that’s different from my ATM PIN, set up after a check we wrote was stolen. ---
**Author:** ![TroutMan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/troutman/32/6721_2.png) [@TroutMan](https://boards.straightdope.com/u/TroutMan)\ **Post date:** [December 30, 2021, 9:20pm UTC](https://boards.straightdope.com/t/your-bank-calls-you-up-and-asks-for-your-ssn-what-do-you-do/956818/53 "2021-12-30T21:20:05Z")
I was on my bank website last night and noticed their standard banner across the top that states they will _never_ call and ask for your account number or SSN. Those who are saying it’s fine or that every bank has similar lax security are just flat-out wrong. ---
**Author:** ![Mark\_Finn](https://avatars.discourse-cdn.com/v4/letter/m/34f0e0/32.png) [@Mark\_Finn](https://boards.straightdope.com/u/Mark_Finn)\ **Post date:** [December 31, 2021, 12:34pm UTC](https://boards.straightdope.com/t/your-bank-calls-you-up-and-asks-for-your-ssn-what-do-you-do/956818/54 "2021-12-31T12:34:57Z")
A credit card scammer tried to get me by asking if my card number started with “xxxx”. Of course - all credit cards issued by this company in this country start with the same four digits. I didn’t fall for it. ---
**Author:** ![kayaker](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kayaker/32/441_2.png) [@kayaker](https://boards.straightdope.com/u/kayaker)\ **Post date:** [December 31, 2021, 1:38pm UTC](https://boards.straightdope.com/t/your-bank-calls-you-up-and-asks-for-your-ssn-what-do-you-do/956818/55 "2021-12-31T13:38:12Z")
> [@Redcanoe](#): > > My last 4 digits were stamped on my underwear. Maybe try increasing fiber in your diet. ---
**Author:** ![Spiderman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/spiderman/32/230_2.png) [@Spiderman](https://boards.straightdope.com/u/Spiderman)\ **Post date:** [December 31, 2021, 5:20pm UTC](https://boards.straightdope.com/t/your-bank-calls-you-up-and-asks-for-your-ssn-what-do-you-do/956818/56 "2021-12-31T17:20:24Z")
> [@HMS\_Irruncible](#): > > > [@digs](#): > > > > But first, speak to (or email) an officer about their incredibly lax security! > > That’s not lax security. They already have your SSN, and they weren’t going to give it to anyone else. The bank has an obligation _to you_ to ensure that when they contact you, it’s definitely you. This is entirely appropriate! > > > [@Briny\_Deep](#): > > > > Tomorrow I will be withdrawing my entire balance and closing the account. > > You were prudent and well within rights to be extra-secure by calling back. I might have done the same. But to close an account for this reason… well, it’s your time to waste if you want. It _absolutely_ is lax security. While the bank is required to get your SSN to open the acct, it should be masked to all but essential personnel to help prevent identity theft by a rogue employee. Call center employees are _not_ considered those essential personnel. The first 5 digits should either be masked or not display at all. I’d also bet a regulator would come down on them if they found out about this poor practice. ---
**Author:** ![running\_coach](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/running_coach/32/15836_2.png) [@running\_coach](https://boards.straightdope.com/u/running_coach)\ **Post date:** [December 31, 2021, 5:25pm UTC](https://boards.straightdope.com/t/your-bank-calls-you-up-and-asks-for-your-ssn-what-do-you-do/956818/57 "2021-12-31T17:25:18Z")
> [@Spiderman](#): > > It _absolutely_ is lax security. While the bank is required to get your SSN to open the acct, it should be masked to all but essential personnel to help prevent identity theft by a rogue employee. Call center employees are _not_ considered those essential personnel. It also trains customers to fall for scams. I wonder if the decades of overseas “customer service” centers are part of the willingness to fall for scams. I’ve heard Microsoft/Norton/McCaffee scammers claim to need SSNs and birthdates in order to cancel services and issue refunds. ---
**Author:** ![TokyoBayer](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tokyobayer/32/13989_2.png) [@TokyoBayer](https://boards.straightdope.com/u/TokyoBayer)\ **Post date:** [January 3, 2022, 12:30pm UTC](https://boards.straightdope.com/t/your-bank-calls-you-up-and-asks-for-your-ssn-what-do-you-do/956818/58 "2022-01-03T12:30:07Z")
My wife has had her credit card compromised twice. Both times, she got a call from the credit card company. They explained the problem and why they flagged the transactions. Then, they instructed her to call the phone number listed on the credit card and which department to speak to in order to cancel her current card and obtain a replacement. [Previous page](https://boards.straightdope.com/t/your-bank-calls-you-up-and-asks-for-your-ssn-what-do-you-do/956818.md?page=2)