Instead of using information you give to your credit-card company — your pet’s name, or your favorite movie — this type of verification makes use of information about you gleaned without your knowledge from public databases. London-based credit agency Experian, for instance, culls information from hundreds of sources — including courthouse records, electoral registries and BT — to supply its 200-plus British clients with so-called challenge questions. If a customer arouses suspicion, the credit-card company sends the name to Experian and gets back, seconds later, a list of questions that can be put to the customer to verify his identity.

Although Experian is developing similar services in other European countries, this kind of “out of wallet” authentication — so named because answers to the questions are rarely found in written form — is growing most rapidly in the United States, where privacy laws are less strict. For each challenge, Experian charges a dollar or two, depending on volume. Jim Lound, Experian’s product director, says the alternative — requiring applicants to submit additional documents—is even more expensive.

What happens, though, if you can’t remember which bank refinanced the loan on your first home? Or what if wrong information on some database causes you to answer a given question incorrectly? Authentication firms say that it’s up to their clients — the banks or credit-card companies — to build in some kind of tolerance for wrong answers.

Out-of-wallet authentication may inadvertently make some kinds of identity theft easier. Because it dramatically increases the value of the data held in credit bureaus and databases, it is more tempting for employees of these organizations to pilfer the data.

Seattle-based ex-con Ronald Hemphill told Newsweek that he once paid more than 60 people with insider database access in many organisations to send him information on (usually wealthy) individuals he chose to impersonate; a complete profile of a target cost less than $1,000. His fraud ring rapidly flipped through the profiles during out-of-wallet tests, routinely defeating them.

—Newsweek / BENJAMIN SUTHERLAND