Frequently Asked Questions

Security Questions Are Easy to Guess or Breach

• Publicly Available Information: Many security question answers (e.g., mother’s maiden name, first pet, or high school) can be found online, especially via social media or data breaches.
• Social Engineering Attacks: Attackers can manipulate users into revealing security answers through phishing or phone scams.
• Credential Stuffing & Data Leaks: If security answers are leaked in a breach, attackers can reuse them to bypass authentication.

Because of these vulnerabilities, relying solely on security questions leaves organizations exposed to social engineering and account takeovers.

Dynamic & Real-Time Authentication

• Caller Verify uses Okta Verify push notifications or one-time passcodes (OTP) sent via SMS or email.
• These methods require real-time interaction from the legitimate account owner.
• Even if an attacker knows some personal details, they cannot approve a push notification on the victim’s device.

This ensures the user is actively present and authenticating, rather than relying on pre-set, potentially compromised answers.

Protection Against Replay & Phishing Attacks

• Traditional security questions can be reused indefinitely once exposed.
• Caller Verify generates a new challenge every time, making replay attacks impossible.
• Push notifications and OTPs add an additional security layer that prevents phishing attacks.

Even if attackers have some personal data, they still need access to the user’s phone or email.

Reduces Agent Fraud & Insider Threats

• Security questions can be misused by malicious agents or compromised call centers that store or leak answers.
• Caller Verify removes agent access to security answers, making insider fraud much harder.
• The verification process is logged, ensuring accountability and compliance.

Even support agents don’t see the verification data, reducing risk.

Compliance & Zero Trust Security

• Many regulations (e.g., GDPR, HIPAA, PCI-DSS) discourage or prohibit using static security questions for identity verification.
• Caller Verify aligns with Zero Trust security principles by verifying the user based on their real-time authentication, not stored knowledge.

OSFI Guideline B-13 Compliance

The Office of the Superintendent of Financial Institutions (OSFI) is a Canadian independent federal government agency that regulates and supervises more than 400 federally regulated financial institutions (FRFIs) to determine whether they are in sound financial condition and meeting their requirements, including the implementation of MFA. In Guideline B-13 Technology and Cyber Risk Management Section 3.2.7 OSFI requires that federally regulated financial institutions implement MFA across external-facing channels, and ensure that accounts are securely authenticated, managed, and audited to detect unauthorized access requests. Caller verification software can help entities comply with this requirement by verifying the identity of callers using MFA, before granting access to systems and data and by logging verification attempts.

HIPAA Security Rule Compliance

The Health Insurance Portability and Accountability Act (HIPAA) requires covered entities to implement reasonable and appropriate administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of electronic protected health information (ePHI). One of the technical safeguards required by HIPAA is access control, which includes implementing unique user identification, emergency access procedures, and automatic logoff. Caller verification software can help covered entities comply with the access control requirement by verifying the identity of callers before granting access to ePHI. HIPAA Security Rule, 45 CFR § 164.308(a)(1)(ii)(D).