"What is your password" phone call

Minority · 26 Jul 2006 at 22:07

BrenOS said:
I'd say it's good business practice actually. We won't disclose any details of your account over the phone until you can confirm the password you set up with us.

I disagree. If you ring a company then fair enough, but someone ringing you and asking for a password is just silly.

Kell_ee001 · 26 Jul 2006 at 22:11

Minority said:
I disagree. If you ring a company then fair enough, but someone ringing you and asking for a password is just silly.

They're making sure they have called the correct number and are speaking to the correct person. How's that silly? :confused:

Dolph · 26 Jul 2006 at 22:12

07973100194 is definitely Orange customer services.

As for the password thing, that is standard practice, as is the use of a single letter from the password as verification if you ask for it.

It would have been a standard welcome call, nothing to worry about, however as with all these things if you are unsure, then there is nothing wrong with refusing to give information, or calling customer services to check it was legit (a note would have been applied as part of the call procedure).

beh · 26 Jul 2006 at 22:41

Hmm, my brother had a similar slightly suspicious call after he set up a new contract with o2 cept with number withheld. Seemingly started out as a courtesy call mentioning very vague details and then mentioned something to do with changing the insurance and asked for his CC details. Though perhaps just being overly paranoid.

Redrum · 26 Jul 2006 at 23:15

I wouldn’t have given the password out, and I think its bad practice for them to request it. Fair enough, when you call them they should ask security questions, but not when they are calling you, its you that should be verifying whose calling you. By them doing this, they are encouraging you to give out information to people calling you which I think is very bad, as it leaves people open to a known technique called social engineering.

ArmyofHarmony · 26 Jul 2006 at 23:17

Must have been a password specifically for the purpose of identifying urself on the phone

(ie, nothing important)

I had someone ask me for a pin number the other day, can't remember what i was ringing... but i didn;t know my pin anyway so they told me it

I think it was an online casino or something.

Dolph · 26 Jul 2006 at 23:30

Redrum said:
I wouldn’t have given the password out, and I think its bad practice for them to request it. Fair enough, when you call them they should ask security questions, but not when they are calling you, its you that should be verifying whose calling you. By them doing this, they are encouraging you to give out information to people calling you which I think is very bad, as it leaves people open to a known technique called social engineering.

So how would you suggest that a company contacting someone ensures they comply with DPA and don't simply start giving out someone's information without verifying who they are speaking to? The only way to do that is to request some specific information that only the customer should be likely to know...

As previously stated, the company involved will verify themselves on request by giving a limited piece of information (in this case a letter or two from the password) as a means of verification, something that could only be done if you had the password in front of you anyway.

mrbios · 26 Jul 2006 at 23:40

ahhhh so thats what that number is, ive had 2 missed calls from that number in the past few days, cheers for that lol

Redrum · 27 Jul 2006 at 00:14

Dolph said:
So how would you suggest that a company contacting someone ensures they comply with DPA and don't simply start giving out someone's information without verifying who they are speaking to? The only way to do that is to request some specific information that only the customer should be likely to know...

As previously stated, the company involved will verify themselves on request by giving a limited piece of information (in this case a letter or two from the password) as a means of verification, something that could only be done if you had the password in front of you anyway.

If they are making the call to the customer, then they are doing so on a number the customer has provided, therefore it should be accepted that if you ring that number you will either get the customer, or you will get someone associated (family/friend etc) with the customer, who will pass the phone over to them.

I used to work in a fairly large call centre, where the management were very strict on DPA checks with the customers. So much so that it used to result in many escalated calls to the managers. However, the rules only ever applied to inbound calls. We even left messages on voicemails and answer-phones with information relating to the account.

Energize · 27 Jul 2006 at 02:21

Kell_ee001 said:
They're making sure they have called the correct number and are speaking to the correct person. How's that silly?

Because it makes it harder for the customer to tell between fake calls and legitimate ones just like the op who hung up because of it. Its just like say paypal emailing you asking for your password, it would be a stupid idea it just encourages people to give out information to random people that ask them for it, not to mention the fact that the call could be monitored by someone else.

PinkPig · 27 Jul 2006 at 07:07

I agree that Orange are taking part in very bad practice by ever asking for a password over the phone - people ought to be rightly suspicious of anyone trying to do that. They can (and other companies do) identify people by other safer means - such as recent usage of the phone, something like "the third and sixth digit of your password" (changing each time), a seperate "secret phrase" also chosen when you open your account, or so on. I'm sure you're not the first person to refuse to give a password - in this day and age we expect passwords to be entered only electronically.

Dolph · 27 Jul 2006 at 07:31

Redrum said:
If they are making the call to the customer, then they are doing so on a number the customer has provided, therefore it should be accepted that if you ring that number you will either get the customer, or you will get someone associated (family/friend etc) with the customer, who will pass the phone over to them.

Ah, the assumption approach... given that probably at least half the mobile phones on the orange network are not in direct use by the account holder, that would be a really bad approach to use...

I used to work in a fairly large call centre, where the management were very strict on DPA checks with the customers. So much so that it used to result in many escalated calls to the managers. However, the rules only ever applied to inbound calls. We even left messages on voicemails and answer-phones with information relating to the account.

That was obiviously considered acceptable by your former company with regards to DPA, personally I'd consider that far worse than actually trying to verify the customer....

Samtheman1k · 27 Jul 2006 at 08:27

BrenOS said:
It doesn't work like that. Do you think that the customer services call centre(s) has one mobile they pass around?

Sometimes it feels like it...

Samtheman1k · 27 Jul 2006 at 08:30

Redrum said:
If they are making the call to the customer, then they are doing so on a number the customer has provided, therefore it should be accepted that if you ring that number you will either get the customer, or you will get someone associated (family/friend etc) with the customer, who will pass the phone over to them.

I used to work in a fairly large call centre, where the management were very strict on DPA checks with the customers. So much so that it used to result in many escalated calls to the managers. However, the rules only ever applied to inbound calls. We even left messages on voicemails and answer-phones with information relating to the account.

How you do know it's not a work colleage who answereed your phone on your desk whilst you were away. Or someone nicked your phone. Or your malicious housemate. Or...

Adeline · 27 Jul 2006 at 10:15

Just this moment got a call to upgrade my contract phone on orange, yet my phone is pay as you go.
I havent had this before, Its very strange as I am on pay as you go.
The number started with 08447....
I get really confused about these kind of phone calls.

Sirrel Squirrel · 27 Jul 2006 at 12:35

I just had a thought, rather than ask for the whole password they could just ask for say the first letter and a random one from the middle, that's what my bank ask for when I phone them up plus the usual security stuff.

Murf · 27 Jul 2006 at 13:18

I get these kind of calls and they make me really angry truth be told. Main reason being when I politely but firmly inform them I won't accept unsolicited calls and that if any response from me is required they need to request it from me in writing they invariably fail to do so, and call again, normally 4-5 times per incident til they get the idea. Some of their systems seem to be so rigid they can't even take me off their list and deal with me in writing. They just keep getting people to call. :mad:

Anyone calling me asking for personal details can get bent. I'm not risking it.

nin9abadga · 27 Jul 2006 at 13:27

Gilly said:
The bird at Orange didn't sound at all surprised that non-Orange sales teams were contacting me, nor that they knew when my contract was up - which seems to me like Orange are selling on info.

i had the same problem with O2. my contract was coming to an end and i started getting pestered by random comapnies trying to sell me three/3 contracts and phones - im talking 2 or 3 a day for a week. i got so sick of them in the end that i called O2 and demanded and explanation and accused them of selling on my details. it turns out that they are part of the same group (apparently) which is why my details were "shared".

nin9a