I bank with one of the big four banks in Australia I recently got a call, and it started off

"Hi I'm Taylor¹ I'm calling from {bank_name} and I'd like to talk to you about a letter you received from the bank recently"

I hadn't seen any letter but I've migrated all my bills to paperless and I on only check my snail mail once every week or two. I said so and the call continued.

"I apologizes for this but I need to let you know this call is being recorded for quality assurance purposes, and as I am accessing your profile I will need to verify your account, I'll need your full name including middle name, current address and date of birth."

At this point Taylor had provided me with no details to prove the call has come from the bank. The call had come from an odd number² and they were asking for personal information.

So I asked Taylor if I could call back to verify the call was from the bank and also asked for Taylor's last name. Taylor seemed genuinely surprised and almost a little offended that I didn't just trust that this mysterious call was from my bank. Taylor then told me that employees were not allowed to give out their last name for privacy reasons but suggested that I call back on the same number that I had in my caller ID. That number is not publicly available anywhere on the bank website. In fact when I Googled the number I found other people asking about the same number on the bank's forums with a moderator saying "I am unable to confirm whether this is a {bank_name} phone number;"

So I called the bank using the number on their contact us page and I was expecting to hear them say, "Yes it's a scam, it's been doing the rounds and we are doing our best to stop it but comes from outside Australia and it's hard to shutdown." Instead I spoke to Sandy³ who actually laughed and also seemed very surprised that I'd though someone cold calling me and calming to be from a bank with about a 20% market share⁴ might not be genuine.

As it turned out the call was genuine and they were trying to sell me a an "upgrade" on my mortgage.

I saw Tory Hunt write about this almost two years ago. I thought banks were getting on top of this sort of thing, and I thought my bank had a pretty good security team. I met a few people who claimed to be part of their security teem at Ruxcon and they seemed pretty switched on.

I guess this is the sort of thing a marketing manager might setup without really thinking about the security implications but it's almost training people to just accept cold calls and give out information. I'm amazed they don't get more people calling back to verify but it seemed like I was an anomaly.