- In what month was Melanie (my wife who they mentioned by name) born?
- Which of the following people am I “associated” with?
- What was the recorded sale price of my home?
- Which of the listed counties have I lived in?
Each question had four possible answers. The second question listed four people and it turned out that the one I’m “associated” with is my half-sister’s fiancé. Now, to be honest, I’m not close with my half-siblings; they’re much younger than I am and from my dad’s second marriage. I knew she was engaged and I could have guessed at his first name, but I couldn’t have recalled the last name off the top of my head. But since the first name guess was on the list for only one of the people, I chose it. I was right.
What’s creeping me out is that Federal Express knew who he is, but I didn’t. But the sad reality is that, as a security measure, these questions are terrible. It’s obvious that they’re data-mining publicly available records, including social media. and if they could find that information, someone impersonating me could. In fact, I bet I could easily find the answers to questions 1, 3, and 4 for most people through some Google searching1 and question 2 if they have a fairly open social media presence (which I’m guessing they rely on in order to get that answer.)
FedEx says they don’t store this information, but that’s no comfort, because they already had it to begin with. The information came from somewhere and could just as easily be retrieved.
So what we have is a creepy Big Brother corporation that uses personal information in a creepy “we know you” way, but in a way that provides no actual security. Great. What else do they know? And if they know it, who else can get this stuff? We’re living in a new era.
- A spouse’s birthday would be standard social media searching and if I knew their address in order to signup for the account, the last sale price is in Zillow, among other places. ↩
Image Credit
- bigbrother.3acc5393e8c04ae184725851d1543e37: GraphicStock | Copyright by owner. Used with permission.
I’ve had security questions like that, but they’ve obviously come from my credit report, and are not things that could be easily web – crawled.
Chances are that FedEx knows nothing about you but rather used a knowledge based authentication service (like LexusNexus Risk Solutions). The authentication provider creates and then verifies the responses to 3 or 4 questions based on public information. This is becoming pretty standard for internet and electronic options (like digital signature) where the vendor wants to one-time or periodically confirm that you are who you purport to be. When my company used Docusign for some of our documents, the Docusign authentication used KBA from LexusNexus to verify identifies.
I got the same question from FedEx and they listed 4 people I’ve never heard of. WTF?? Of course I got it wrong and they just gave me the generic something went wrong message.
I just ran across the exact same scenario and initially assumed they had access to my credit report until one of the verification security question was the manufacturer of at least one of my vehicles (keep in mind we have a total of 5, all by different manufacturers) with one correct match and four other (obviously wrong) options that didn’t match either of the 5 vehicle manufacturers we had “associated with our name.”
That information is not on a credit report…or our social media, so if that’s not creepy, I don’t know what is. Anyone know of that type of information is obtainable through the LexusNexus screen provider mentioned above?
Just had the same experience and I failed to answer the questions correctly. One was a question about who lived in my household before me (how am I supposed to know?) and another asked me to identify the last 4 digits of a drivers license I had in another state 20 years ago. Nuts.