Companies requiring identity confirmation when calling YOU

[Shermann]

I've had two occurrences this week of companies calling me and asking me to provide my date of birth to identify myself before they will speak with me. Having a tech and security background, I sort of balk at this.

In both cases this was legitimate. One was the doctor's office and the other the pharmacy. So, I get it, they want to identify me before discussing private medical details. But I have the phone registered on my account in my possession, and in most cases that satisfies the 2FA requirement. And they called me! If somebody is out to steal your identity, maybe you shouldn't lend them your phone.

I refused to provide any sensitive personal information in that situation, and they talked to me anyway.

My concern is that if this becomes commonplace, then people will let their guard down and readily provide their personal information during a very rudimentary phishing attack. Spoofing a phone number is unfortunately still very easy.

What should healthcare providers be doing in this case? Thoughts? Do you draw the line at date of birth or just social security number?

[Raven123]

1. I never give my SSN. If I have concerns, I hang up and call the office myself

[Bluestocking]

2. I refuse to provide personal info

If someone called me. It has resulted in the end of phone calls. It is not worth the risk. There are a lot of bad people out there.

[stopdiggin]

3. date of birth is absolutely commonplace for any kind of medical

it is THE number that they use (in common, and across platform) to access your file(s)

Having said that - exercising real caution with any kind of phone call coming YOUR direction - is basic common sense.

[Midnight Writer]

4. If I google myself, my date of birth, my address, my phone number, e-mail, names of my relatives, my salary, all pop up.

The cat is already out of the bag.

[Shermann]

6. I am a bit jaded about these things, but my private info isn't THAT easily searchable.

That said I've been swept up in a half dozen data breaches that I KNOW about by now.

The SSN is still the big one and they haven't asked for that yet. Maybe date of birth isn't even worth fretting about anymore?

[OC375]

5. I Don't Answer the Phone

It's for my convenience, it isn't a communications suicide pact. Don't answer the door either, for that matter, unless I'm expecting someone. It's always someone who wants something from me. 90% of my mail never gets opened for the same reason. If I cut out TV, and I'm pretty much a free man... except for the internet.

[GAJMac]

7. Best to call them at their publically published number.

Short of that, ask for the last four of the SSN. Also, to help foil infected attachments I have a code word I share with my family and friends. If I send an attachment, the subject line will include the code word. Without that, they know it's not really from me.

[Nittersing]

8. My MDs office called (I didn't pick up) and at the end of the message

he said, "I'll call back in 5 minutes." Which he did and then I picked up. First time, for me, a call was handled that way and I thought it was pretty brilliant.