Here’s a scenario that plays out millions of times a day: your phone rings, the caller ID says your bank’s name, and a person on the other end says they’re calling from the fraud department about “suspicious activity” on your account. Then, before they’ll discuss anything, they ask you to confirm your identity — full name, date of birth, account number, sometimes the last four (or all nine) digits of your social security number.
Notice what’s missing from that exchange. At no point did the bank prove anything to you. You’re the one being asked to authenticate. They never have to.
The asymmetry is the whole problem
Authentication is supposed to run both directions when money and identity are on the line. A bank teller checks your ID before handing over cash. A website shows a padlock and a certificate before you type in a password. But an inbound phone call from “your bank” gets to skip all of that, because the entire system was built around the assumption that the bank is calling you, so of course it’s really the bank.
That assumption is exactly what makes vishing (voice phishing) so effective. Caller ID can be spoofed trivially — there’s no cryptographic verification behind the number that shows up on your screen, the same way there’s none behind the “From” field of an email. A scammer can display your real bank’s actual customer service number, say the right things about “recent purchases” or “unusual login attempts,” and you have no built-in way to tell them apart from the real thing, because the real thing never gives you anything to check against either.
Why banks train you to do exactly the wrong thing
Legitimate banks really do call customers about fraud alerts, and when they do, their own scripts ask you to “verify your identity” first, before they’ll talk. Compare this to interactions people already understand intuitively: nobody hands their passport to a stranger who cold-calls claiming to be from the passport office. But because banks have normalized “verify yourself before we help you” as standard procedure, they’ve spent decades training their own customers to comply with the exact request a scammer needs to make the scam work.
This isn’t a hypothetical training-flaw argument — it’s structural. If the legitimate process and the fraudulent process are indistinguishable from the customer’s side of the phone call, then the customer’s ability to detect fraud is capped at zero, no matter how careful or well-informed they are. You cannot out-vigilance a system that gives you no signal to be vigilant about.
What real mutual authentication would look like
None of this is a hard cryptography problem — it’s a business-process problem the industry has simply chosen not to fix, probably because inbound-call fraud losses are treated as an acceptable cost and shifting liability onto the customer’s “you should have known better” is cheaper than shifting to a system where the caller ID meaningfully means something. Some ways it could work:
- Bank-initiated calls should offer you something to verify, not ask you to verify yourself first — a case number you can call back and check, or a one-time code pushed to the bank’s own app that only the real bank could generate and you confirm rather than read aloud.
- Never ask for full SSN or a password/PIN over an inbound call, period — a legitimate fraud department does not need your full nine digits to discuss a flagged transaction; if they say they do, that’s a tell in itself.
- Default to callback-only for anything sensitive — hang up, dial the number on the back of your card yourself, and let the bank re-authenticate you on a connection you initiated. This is already the standard advice, but it exists as a workaround for a design flaw, not because it should be the customer’s job to compensate for the bank’s failure to prove itself.
- STIR/SHAKEN and similar caller-ID attestation frameworks help but don’t solve this — they can flag a spoofed number, but they don’t stop a call center employee from asking for a SSN, and consumers have no visibility into attestation levels anyway.
The practical upshot
If you take one thing from this: no legitimate call should ever require you to supply your full social security number, a password, or a one-time passcode you just received by text, no matter how official the caller ID looks or how much the person on the line already seems to know about you (scammers often do have your name, address, and partial account details already, from a data breach — that’s not proof of anything). The correct response to any inbound call asking for that kind of information is to hang up and call the number on your card or statement yourself. Until banks change how these calls work — and there’s little sign they’re motivated to — that fifteen-second habit is doing work the industry itself should be doing.
