Ask Me Security Questions Only About Me
Debbie Levitt ????
LifeAfterTech.info ???? & dcx.to - Strategist, author, coach, researcher, and designer finding & solving human problems. "The Mary Poppins of CX and UX"
I’ve noticed a strange trend in security questions. Perhaps security-minded people think that too many people might know the standard questions. Maybe you know my mother’s maiden name, where I was born, or the addresses where I used to live.
The trend is to ask me questions about people the system thinks I’m associated with. Here is an example from a screen I faced in May 2023:
Image description: Photo of a screen asking in which city “Ellen Levitt” currently lives or owns property. The choices are four cities in Connecticut and “none of the above or I am not familiar with this person.”
I don’t know the answer to this. I really don’t. No clue. And I’ve been asked about this person before.
First, I thought about trying to Google “Ellen Levitt” to see if I can figure out where they live, but this was at a kiosk and I was being watched. So that tactic wouldn’t be the right one!
When I told the attendant that I didn’t know the answer and had nothing to do with this person, they suggested I select the last answer. The system accepted that answer, and I passed the security verification.
But what if “none of the above or I am not familiar with that person” is the wrong answer? I don’t want to fail a security check because I can’t guess where someone else lives.
Failing a security check can have outcomes a customer won’t want. We must consider this as well.
DEI means we must be more sensitive to people’s realities.
Public records might imagine that I have something to do with certain people, but public records have no idea what anybody’s reality might be.
领英推荐
Asking about family members, especially parents, is as poor a security question as anything else. If you find out someone’s parents’ names, then you can look up where they live. Now you can answer this increasingly common security question.
I’ve been asked better security questions.
In the USA, I have been asked security questions about which car I owned or leased in a certain year. You’d need a good memory, but I thought that was a good one. Even my best friends might not remember what I drove in what year, but I’ll remember what I spent months paying for.
People might know my favorite sports team, my favorite ice cream flavor, favorite food, favorite subject in school, etc. These are common things friends tend to know about each other over time, so they don’t make great security questions.
I challenge identify verification industries and systems to come up with better security questions that are about me and only me, but are questions only I might know the answer to. OK, a spouse or my bestest bestest friend might know, but nearly the entire population of the earth won’t know, and hopefully won’t guess.
Better ideas…
Why are there always five answer choices? That’s a 20% chance of guessing correctly. How about a screen with 12 choices? That’s an 8.3% chance of guessing correctly. Ask three questions, and someone might by way less likely to guess correctly when three questions each have 12 possible answers.
I also think about how I do things in Italy. Let’s say I want to log into my online medical records. The website doesn’t let me in until I scan a QR code on the screen with an app, and verify myself in the app with a passcode or fingerprint.
The app previously verified me through multiple steps including submitting government IDs, a live photo of me, and some require me to video call someone who makes sure me face and info match my IDs. This took more time and effort to set up, but then it’s done. I can scan endless QR codes, and prove I’m me.
- - - - -
Delta CX is a full-service CX and UX agency and consultancy. We offer training, product and service strategy, and business change and business design consulting, including CX and UX research and design. We help businesses make and save money by improving teams, collaboration, processes, empowerment, agility, efficiency, and customer-centricity. Check us out at https://customercentricity.com.
Check out our new book, Customers Know You Suck. https://cxcc.to/ckys And join our Patreon community https://patreon.com/cxcc
User-Centered Design Professional | NNg Certified UX Designer | Passionately curious and always learning | my opinions are my own
1 年Had this happen to me recently on a pretty large brokerage site. I selected the “correct” answers to the questions of “do you know what day X was born?” and “are you affiliated with any of Y?”, but to my surprise I couldn’t be verified! Got a little paranoid, so I waited the 20 min on the phone to speak with someone and they assured me it’s fine (without actually telling me why *I* was incorrect). I don’t use them anymore to say the least ??
Technical Consultant & Help Desk Support
1 年There is so much opportunity for improving experiences logging into systems. (Also, on my home computers, why the heck do we even get logged out of things so often?) Friends and family ask me to help them with an app or site they signed up for, and right off the bat, they can't even remember the password they chose. When they remember their passwords, I give them a lecture about not choosing pet names, kid names, birthdays, and so on. When I'm feeling brave or overly optimistic, I go on to explain the importance of multi-factor authentication.
Senior Cloud Developer @ Hewlett Packard Enterprise | Cloud Solutions Architect
1 年The Italian SPID is the best way to identify someone and let them share personal information securely with multiple systems.
Data Scientist | Mixed Methods Researcher | Trainer | Animal Lover
1 年First, I 100% agree that questions about potential previous or current associates are problematic on multiple levels, including those listed above. Imagine being asked about an associate who was in the military and moved every 4 years. Good luck knowing their address history. The car question can be problematic because it’s easily phished. Public records might have vehicle ownership information. It’s also a common question floating around “getting to know you” posts on social media. Now, users don’t have to give the correct answers if they’re typing in an answer to a question. Heck, the car you choose needn’t exist. If your first car was a 1900 Delorian, then all the more power to your password. But most people don’t think of this. Too many people answer questions on social media without realizing that they could be phishing questions. They think it’s all fun reminiscence. Education might help, but not with older demographics or people who don’t understand technology well. Alas, hackers are usually a step ahead of us. The key is to find something people will remember, but not something they commonly share or would be on public record. Perhaps “Name a smaller city that isn’t near you that you can remember easily.”?
I know Carlota Sage will love this article!