Why knowledge-based authentication? Because, in theory, it’s something you know that no one else knows.
“Safe words” are a form of KBA.
- You get a call from your son, who says he’s in jail and won’t be released unless you send money now. The voice sounds like your son, so you send the money. Of course, it isn’t your son, but a deepfake engineered to scam you of your money..
- But if your son volunteers the “safe words” that the two of you previously selected, you have a much higher assurance that the voice on the phone is your son.
But, as Secrets of Privacy notes, safe words are also vulnerable. Some of their tips:
Safe words, not safe word
While password length requirements sometimes become ridiculous, they have a purpose. A longer password is harder to guess than a shorter one.
Similarly, four safe words are harder to guess than a single one.
Provided the words are unrelated. “The quick brown fox” is a terrible safe phrase.
That no one else knows
If someone can read your safe phrase online, it’s unsafe. I cannot use “California State University Fullerton” (on my LinkedIn profile) or “biometric product marketing expert” (all over this website).
Established together, preferably in person
Don’t rely on online establishment. People see things.
“Don’t text the safe phrase (even via Signal), never email it and don’t save it somewhere like in a cloud document or note app.”
And one more thing
If your purported son calls you, he’s the one to use the safe phrase…not you.
“Eva Velasquez, CEO of the Identity Theft Resource Center, sees this mistake constantly. A family sets up a safe word, and then in the panic of an actual emergency call, the intended victim blurts it out themselves trying to be helpful or trying to speed things along. A scammer who hears “wait, is this about our safe word, it’s soggy trombone” now owns your safe word. The rule has to run one direction only. Whoever is asking for money says the phrase unprompted, or the call gets treated as fraud, no exceptions.”
Admittedly the victim is under extreme pressure, but try to remember this. Blurting out the safe word is the equivalent of leaving your house keys in your front door lock, with a red arrow labeled “For burglars.”
When done right, safe phrases work
But don’t let this scare you away from safe phrases.
“The reason a safe phrase beats even a flawless voice clone is that it doesn’t rely on the voice being fake or real. It relies on information the scammer physically cannot have.”
Bredemarket 