“Hi, this is Mark from Experian. We’re calling to update your contact information…”

That’s how I was greeted when I answered the phone just now. This was nominally someone from one of the big 3 credit reporting agencies calling to make sure they had current contact information for their database. Harmless enough, right?

Well… probably. But I tend to be pretty guarded about giving out my personal information. It’s remarkable to me that these companies expect people to simply pick up the phone and start answering questions about names, phone numbers, addresses, and whatnot, without ever questioning whether or not the caller is who they say they are. 99% of the time I’m sure it really is someone from Experian, or Wells Fargo’s Loan department, or the Census Bureau. But the cost of misplaced trust the other 1% of the time can be pretty high. Thus I typically answer with a curt, “I’m sorry, but I don’t give out personal information to callers. Can you please give me the contact information for the person I should talk to about this?”

This invariably illicits a brief pause of confusion as they process this unexpected resistence. They’re not used to having people question their veracity. After taking a deep breath, they try again: “Um, sir, I’m the person you can talk to. I’m with First National Trans-Federal Mutual Corp” they repeat, implying, “it’s okay, we’re Big Business, you can trust us!”, which leads to a proverbial fork in the conversation.

The low road, the easy route, is to just play dumb. These folks may not understand the problems of mutual authentication, but they are wonderfully well-prepared to deal with someone who’s, shall we say, cognitively challenged. They’ll regurgitate some thank-you-for-your-business and can-we-talk-to-the-head-of-your-household speech before eventually giving up.

But occasionally I get into a benevolent mood and elaborate on why it is I don’t trust them. More often than not this leads to the same speech. But sometimes I’ll find myself debating the security of 512-bit RSA encryption, and modern applications of Merkle’s Puzzle in telemarketing… at which point I know i’m talking to a scam artist and not a real customer support person.