I learned an interesting thing about human biology this weekend. If you tilt your head back, don't think about swallowing, and pour water into your mouth, you can pour it directly into your lungs.

Anyone who thinks humans are the product of intelligent design should not be allowed to design anything.

Did I imagine it? I could have sworn that FCA issued guidance a few years ago that said 'if you are calling a customer, you must provide them with a mechanism to verify that the person on the phone is, in fact, calling from you before you ask for any personal information? Doing anything else is just training people to fall for phishing scams.

And yet, a couple of weeks ago, I had a call from someone at Admiral Insurance (FCA regulated) who had no mechanism to verify that she was actually from Admiral. Fidelity (also FCA regulated) has the same problem. In both cases, the only way I had of ensuring that they were really them was to take their name and then find the number on their web site, call back, and then ask to be put through to them (by which time they may be on another call so I need to hold).

The Admiral one was really bad. Her only suggestions were that she could send me a text message or an email confirming that she had called me. Anyone who can spoof caller ID can easily send a fake SMS and anyone can send a fake email (I have a better chance of being able to tell that it's fake than most of the population, but definitely not 100%).

The only place I've seen do this properly is Barclays. When they call me, they can send me a message in the app that says the name of the person who called me and the number that they called me on, which avoids most MITM problems as well (unless someone has done SIM cloning things and is doing a MITM attack and that's just really hard).

I blame a lot of this kind of thing on #Signal not having a permissively licensed client library. If they did, the recommendation for any company that needs to talk to me securely would be 'send me a message on Signal'. The choice of APLv3 means that anyone wanting to do this would need to write their own implementation of the (moving target) Signal protocol.