When is a security code not secure? When it's only 1% as effective as it should be.
I recently applied for an account with
Intelligent Finance, the online arm of
Halifax, and because of some problems at their end I ended up having to ring them a number of times. To verify your identity they ask you for your full name and address, both publicly available, and two random digits of a 4 digit security code.
Except they don't. Every time I've rung them (6 times in 2 weeks) it is
always the 1st & 3rd digits; if you've got an account with them try it and see. So from a possible 10000 combinations it is down to 100, which doesn't exactly fill me with confidence - it's like having a 2 digit pin number for your cash card. Perhaps I've been exceedingly (un)lucky, but if that's the case then I'm going to start playing the lottery again. More likely they figure that as it's an Internet-based account you're unlikely to ring them that often so no-one would cotton on.