Banks urged to change security policies

Basic security questions, such as asking for a user's mother's maiden name or post code, can be circumvented far too easily and should not be used, according to Symantec.

The security firm said that this type of information is often readily available online and easy accessible through a few quick searches, and that these types of questions are no longer enough to confirm an identity.

"All you need to steal someone's identity can be obtained simply by looking at the Census data," said Guy Bunker, chief scientist at Symantec.

"Bank and credit card companies use information such as mother's maiden name as a standard security question, but it's no longer enough. They have to look at other ways to prove that you are who you say you are."

Bunker reckons that, although a lot of work has been done to improve security when accessing accounts online, telephone banking is wide open to abuse.

Operators who need to confirm a customer's identity should be seeking more random information, or asking for individual characters from a predefined pass-phrase, thereby mitigating the risk if someone overhears the conversation.

"Banks must start asking questions that no one else can find the information for. First pet's name or favourite film would be fine, as long as the answers to these aren't published on a social networking site. The ideal scenario would be for people to choose their own questions," he said.

Symantec's recent Underground Economy Report (PDF) found that full identities are the third most common specific item requested by online criminals, accounting for nine per cent of the requested total.

Full identities are very popular with fraudsters as it makes it easier to access existing accounts, and allows them to create new accounts in the victim's name, potentially giving them access to a much larger payout and extending the time until the fraud is detected.

To help combat this type of fraud, some financial institutions have implemented other authentication technologies, including voice identification, to help verify the caller's identity.

"Confidence in the banking system in the UK is at an all-time low. It is time banks took responsibility for ensuring the security of their customers online and over the phone," concluded Bunker.