by Ed Foster

Insecurity Over More Security Questions

analysis
May 4, 20072 mins

With phishing scams and other forms of identity theft targeting our bank accounts, financial institutions are increasingly adding additional security checks. But one reader wonders if asking you more questions isn't just a recipe for more points of failure. "All my online banking and credit card companies are creating three security questions which only I will have the answer to," the reader wrote. "Typically th

With phishing scams and other forms of identity theft targeting our bank accounts, financial institutions are increasingly adding additional security checks. But one reader wonders if asking you more questions isn’t just a recipe for more points of failure.

“All my online banking and credit card companies are creating three security questions which only I will have the answer to,” the reader wrote. “Typically they will ask me to identify the name of my high school, the street I lived on when I was in elementary school or some other similar, seemingly obscure question. These should be easy questions to answer, and in a general way they are.”

But with each company requiring its own set of security questions, remembering the precise answer starts to get more difficult. “Let’s take an example like the street I lived on as a kid,” the reader wrote. “When they re-ask the question to validate my security, I have to remember, did I only use lower case, or did I capitalize the first letter? Did I just type in the street name, or did I remember to put in the word ‘street’ at the end — i.e. was it ‘Main’ or ‘main’ or ‘Main Street’ or ‘Main St’ or ‘main street’ I typed?”

“My solution is to write down the security question with the answer, so when it is re-asked, I can look up what the correct answer is,” the reader wrote. “So now I have a stack of papers with my security questions and answers next to my computer. At least with my passwords, I had created a system where I could memorize them all and still have unique passwords for different sites.”

The more security questions the banks ask, the less secure the reader is feeling. “Bottom line — I find these security questions to be a false sense of protection. Anyone who really was targeting me can find the answers, and I have to keep a paper trail just to track all the correct answers. And that just increases the possibility that someone will find a way to compromise my information.”

Is there a better way for financial institutions to increase security without increasing the complexity we must deal with? Let’s hear your thoughts — post your comments on my website or write me at Foster@gripe2ed.com.

Read and post comments about this story here.