Challenge-Response System - Proving Your Identity Over the Phone

1. Purpose

The Challenge/Response Verification system (CRV) is designed to allow users to prove their identity over the phone to the Help Desk or to electronic systems when they have forgotten their NetID password. Users of the CRV will be able to choose questions to which only they would know the answer. Unlike asking for Social Security Numbers, the CRV will allow users to securely prove their identities without the associated confidentiality concerns.

2. Effective Date

Before the CRV was available, the Help Desk accepted knowledge of the date of birth and the last four digits of a Social Security Number as proof of identification when a user calls in over the phone. Until October 1, 2005 the Help Desk will make use of either the challenges set in the CRV or the last four digits of the SSN. After October 1, 2005, users requesting password changes must either have use the CRV OR present a picture ID in person at the Help Desk.

3. Procedure


• In order to use the CRV, users must establish questions (Challenges) and answers (Responses) with the Online@Duke system. http://www.duke.edu/online/crv


• Users must choose or create at least three questions, but can choose more.


• These questions may last indefinitely, but users are encouraged to change them once they have been used.


• When trying to change your password over the phone, you will be asked three of your questions and must answer all of them correctly.


• For security purposes, when anyone views your questions, you will receive an e-mail message notifying you that someone accessed your questions.


• When someone attempts to answer your questions, a second e-mail message will be sent to you stating which questions were asked and which were answered correctly.


March 16, 2005