I just did you a message on your other post and asked you some Qs.  (we crossed in the post!)

Welcome.

Calculator is the only thing and a basic one as a lot of the AAT exam centres will not allow scientifc calcs.

Who are you with for your training?

edited re grammar

Hi Louisa 

Welcome to the forum

Cheshire wrote:

---

I didnt choose banking, it chose me. Well sort of. I fancied this boy....!!

---

I fancied my teacher, but it didn't make me want to go into teaching  

Actually she was lovely, and I had the real hots for her. Even today, her name is one of the answers when logging into my online banking. How sad is that!!!!!

"No one but me knows her name was Sally, and no one but me knows that I bank with Santander."

Well, if nobody knows those two factoids, that's okay then! (You can rest assured I won't tell anyone).

But being serious, it's not that simple - Johnny provided half the reason why when he mentioned social engineering, and the other half is good old fashioned research. Even snippets of information posted in disparate places can be pieced together by someone prepared to put the effort in.

For example, immediately after typing the above paragraph, it took me five seconds to learn what school and college you attended, and when. That just narrowed down the answer to the security question massively; the next step would be to research the school staff during that period, and a little more elimination and narrowing down could take place.

Social engineering is trivially easy when you know how to do it.

By the way, what would your stage name be if you were a1970s glam rock star? You take the name of your first pet, and follow it by your star sign...

VinceH wrote:

---

"No one but me knows her name was Sally, and no one but me knows that I bank with Santander."

Well, if nobody knows those two factoids, that's okay then! (You can rest assured I won't tell anyone).

But being serious, it's not that simple - Johnny provided half the reason why when he mentioned social engineering, and the other half is good old fashioned research. Even snippets of information posted in disparate places can be pieced together by someone prepared to put the effort in.

For example, immediately after typing the above paragraph, it took me five seconds to learn what school and college you attended, and when. That just narrowed down the answer to the security question massively; the next step would be to research the school staff during that period, and a little more elimination and narrowing down could take place.

Social engineering is trivially easy when you know how to do it.

By the way, what would your stage name be if you were a1970s glam rock star? You take the name of your first pet, and follow it by your star sign...

---

Oooops that's a fair point, but I'm 100% certain that you'll not be able to find the name of the teacher (and there were only two female teachers when I attended between 1972-77)  Obviously I've now changed that answer but having found the name of the teacher, you then have to find out which bank it is (I actually bank with 3 across personal and business) and then you need the log in for that particular bank in it's entireity, and the multi choice question is only a small part of that log in (so the teacher one may or may not come up) Even if you've got as far as knowing the teachers name, getting to that multi-choice question and getting the teacher option, you then have to know how I've actually entered it. 

As an aside, I got a phone call a few weeks ago asking me to confirm if I was a customer of a certain bank, I replied that I was (I wasn't but it made me chuckle) and the caller ended the call.  Been waiting ever since for someone to phone me from said branch telling me there's been a breach on my account and they need my debit card, or details thereof.  They haven't as yet, but I was really looking forward to having fun with that one.

By the way, what would your stage name be if you were a1970s glam rock star? You take the name of your first pet, and follow it by your star sign...

Like it, but you're not getting two of my other answers!!! 

Only joking - it's either Tara Virgo or Benji Virgo.  We had 3 dogs in total, but I can't remember in what order, and I can't remember the name of the other dog.  Although I'm certain Tara and Benji were the first two.

None of that information is related to any password I use.

"Oooops that's a fair point, but I'm 100% certain that you'll not be able to find the name of the teacher"

Maybe, maybe not - I've never had reason to look into school information, so I don't know what official records are maintained in (say) local education authority offices, and how accessible to the public they are. However, consider that until a few years ago there was a brilliant resource online for this that was largely populated with information provided by students and ex staff themselves - Friends Reunited. There may be other sites aiming to do similar things out there - or which could appear in future.

Even Facebook - I have a new(ish) account that I don't use, but when I did allow my time to be wasted on that site with my old, long since deleted account, there was a 'group' for my old school (and I think you could generally set your school and look for people who also went and/or worked there) - so that's another potential resource.

This is what I meant by information in disparate places.

"(and there were only two female teachers when I attended between 1972-77)"

I would say you've narrowed it down still further - but if someone was actually doing the legwork, they'd probably find that anyway - so all they then need to do is find pictures of them, and decide which one was Hotty McHotstuff, and which one was Buttugly McSourface. Or not; at this point it's 50/50 - so if they've found their names, they now have pretty good odds. Obviously those odds are still affected by things like how you've entered them; first name, last name, both, substitutions, etc - but like I said, it's all about narrowing down.

The pet name is fun - it not only gives you the answer to one common security question, but can potentially lead to the answer to another (which I've seen much less often - thankfully), because some names are more commonly used for some types of animal - so Thumper (as given by Joanne); probably a kangaroo rabbit. Benji I would have guessed at a dog (but you've said it was so no need) - Tara I've never heard used as a pet name before, and I might have guessed at it being a clever play on words and gone for a tarantula!

Similarly, star signs: I don't think I've ever seen any site/organisation asking for that as a security question (and any that does would be somewhere to steer well clear of) - but some places do use your DoB as such. A star sign doesn't give that away, but it does narrow down the month to within two and the day to within about thirty.

Virgo? 23rd August to 22nd September - so a 22 in 31 chance that your birthday is in September.

And Gemini? 21st May to 20th June - so a 20 in 31 chance of a June birthday.

I've just looked at both your profiles and can see that the balance of probabilities paid off in your cases. However, that you've made your DoBs public sort of means it was a pointless exercise - but personally, I'd not have them publicly displayed!

Unless it is a legal requirement, I never give out my date of birth. If a website insists I put one in, it gets a false one. If I'm logged into such a site and happen to visit my profile settings, I sometimes change the date of birth if it lets me. If a site allows me to keep my (hopefully false) DoB hidden, it gets hidden. Etc. Etc. Etc.

This is one of the things I disliked about using Facebook - other people will reveal things about you that you choose not to reveal yourself. You can keep your DoB hidden, but that won't stop some twerp who knows you and when your birthday is from saying "Happy nnth, Vince!" on that day!

And, of course, questions like that glam rock one are/were prevalent on sites like Facebook, just as on usenet way back when - and probably on various forums as well. They are designed to get people to reveal potentially useful information. Also beware mathematical ones where you start off with something like your age, but follow a number of steps that lead to some other amazing result, which you reveal. The mathematical steps can be reversed. Oops.

Me? Paranoid? You betcha!

Edit: A paragraph break vanished.

"The reason I looked her up is some months ago I had a very strange dream in which I was in contact with her and she died. It was that vivid I even checked the online obituary columns for a couple of months."

Perhaps you should have checked in the other direction - working backwards. It's possible that the dream was triggered by you already having seen some reference to her death but not consciously registering it. Your subconscious then threw it into a dream.

"Friends Reunited - I was on that, found a couple of lads from the school, one I knew, one I didn't, but no teachers appeared."

Am I misremembering (from only yesterday!) - when I looked, I think I established that your school was very small. If so, this may be a factor.

I was on Friends Reunited, and there were teachers from my old school. One of them even kindly pointed out to me that I was wrong about something - it was just like being at school again! :)

"I wasn't fully aware of how social engineering could be used for nefarious purposes."

When it's called social engineering, it is being used for nefarious purposes!

The problem is spotting that something that might otherwise appear to be 'a bit of fun' is in fact social engineering in disguise - so I choose to err on the side of paranoia caution.