Truthfully, we doubt any organisation is able to give you a foolproof answer you're seeking for. With the current technology, we can verify an actual customer is by asking those few personal particulars. This is the quickest way to reach out to a customer urgently and get to the heart of the issue
We understand your concern to verify the caller. What we can suggest is these few measures to take when picking up a call asking for your details:
1. If at any time you're uncomfortable to proceed with the call, ask for the caller's name & where he's calling from. And end the call
2. Get in touch with OCBC Bank via the official channels
- Call 1800 363 3333. Our IVR has voice biometric & speech recognition to recognise a customer's voice.
- If you're unable to call, log in to your OCBC Internet Banking & send us a secured email. We can assist with any issues related to your account via that secured email
Aside from that, we wish to assure you that OCBC staff can only access account information on a need-to-know basis. For example, when a staff needs to reach out to a customer to advise on urgent account information
^Sh
Hi, i hope i am not being rude but i am extremely disappointed with the reply.
The underlying question is: " Do you think there is a potential flaw in the current setup where a client needs to provide sensitive info to a random caller using a random number. And if exploited, is the downside disastrous"
I might be paranoid, but i think the answer is a definite "YES".
Your answer seems to suggest there is nothing more that can be done to improve and to even eliminate the flaw completely.
I have suggested an alternative handshaking protocol described in my earlier post (i.e. give the client a code and the client call to the official number), I acknowledge that this is problematic in its own way.
I can also think of an alternative i.e.
1. Before the call is made, an SMS be sent from OCBC official header to the client alerting me of a call from OCBC regarding some urgent matters. With the setup of Singapore SMS Sender ID Registry, I can be certain the SMS is genuine and not a spoof. The SMS should contain a unique code.
2. OCBC staff then calls me, and gives me the code FIRST. So the onus is on the OCBC staff to prove to me he is real, before even proceeding to ask me anything.
3. If u are able to do all that, there is a 2 stage authentication going on, and personally I will actually be very comfortable with giving the last 4 NRIC numbers. (Maybe other forummers have other opinions though)
I'm sure with the team of talents in OCBC, someone should be able to come up with a SOLUTION. If OCBC has no solution, but recognises there is a problem, then maybe u guys should call up the other banks and MAS and tell them there is a problem that needs to be solved but u guys cannot solve. Unless u think the current setup has NO PROBLEMS. or that the risks are perfectly acceptable.
Again I must emphasis that currently, the client receives a call from a random person using a random phone number and is supposed to give sensitive info. The fella can then use these info i.e. name, phone and last4 NRIC or other verification answers. Can u confirm that a combination of these info, even if leaked, will not compromise my banking security?
At this stage, my solution is to reject all calls from OCBC regarding any matters. I simply cannot accept such a unsafe handshaking protocol. (NB: Actually i will reject all calls from all banks that practice this way of calling me. Pls understand I am not being mean to OCBC only - just that u guys are the only ones with a HWZ account, thus kanna this question)
