Re: Authentication assimetry
Yes, I had this a couple of years ago with my $PENSION_COMPANY. I'd had an arranged online meeting to discuss pension arrangements with $COMPANY_PERSON1 which all went ok. $COMPANY_PERSON1 didn't indicate that I would be getting a follow-up call regarding how the meeting went.
Then, a few days later, I had a call on my mobile phone with the number withheld (alarm bell 1 goes off) from someone (let's call her $COMPANY_PERSON2) who claimed to be from $PENSION_COMPANY. She wanted to talk to me about my "recent contact" (very vague - alarm bell 2 goes off) with the company. She then asked me to provide answers to security questions. I refused and asked her to prove that she really was from $PENSION_COMPANY and why was she calling from a withheld number when this is now extremely frowned upon if not actually illegal now. I thought it reasonable to ask her to provide me with either one of my policy numbers or some digits (and their positions) from one of those numbers. She refused saying it was personal information and, after getting in a bit of a strop about my refusal to do what SHE wanted, in the end hung up on me.
I immediately contacted $COMPANY_PERSON1 and told her about my experience. She agreed that it sounded very suspicious and asked if I wanted to officially report it, which I agreed to. She took the full details and said I would be hearing from someone in a few days.
A few days later I received a call from $COMPANY_PERSON3 from a number that was associated with $PENSION_COMPANY and, as he had details about the "rogue" call and other things that only someone from the $PENSION_COMPANY should have possessed, I was happy to talk to him. He apologised as it turned out that the "rogue" call HAD come from someone employed by $PENSION_COMPANY who was working from home but hadn't done as she should have and routed the call via $PENSION_COMPANY's normal phone network. We spent some time discussing ways in which $PENSION_COMPANY could improve their ability to prove their own identity when asked for it (mainly the same as I'd asked $COMPANY_PERSON2 to do, which he thought was a reasonable way of going about things).
Then he asked, "Is £75 compensation for all the hassle ok?" Having not expected anything of the sort, I readily agreed. This was duly paid into my bank account a few days later and, also around the same time, I received a package containing a written apology along with 2 bottles of wine and a box of chocolates!
So, I think the lesson there is, if you complain properly, you can actually get good results and a proper company will learn from its mistakes. I do wonder, though, what sort of reprimand $COMPANY_PERSON2 got - hopefully, it was some decent training!