Client cross checking security clearance application against name on billing

Question

Ontario Canada, engineering company.

Recently I started work on a new project for a long-term client of the company. I have worked numerous projects for this client in the past.

I get an email from a manager I have never heard of. She wants my mother's maiden name for billing on this new contract. This is new to me. I have never been asked this before. I ask questions.

It seems that there is a new billing system. The client demands we use it. And they demand this information because they want to cross-check my name against my security clearance form.

Um... Click, click... (These are the gears in my brain skipping.) My security clearance form is the only place my mother's maiden name has ever been entered in regard to employment. Mother's maiden name is one of the questions the Canadian government uses to renew lost documents. I know this because it was what they asked me to replace my birth certificate. Which I had to do before I got my security clearance that first time.

So the client's payroll clerks have access to my security clearance form, and they use it to cross check identity.

Am I right to be concerned or is this normal? As I understand it, the people who do security clearances are examined pretty carefully before they get those jobs. The security clearance form has a bunch of info beyond this. Like place of birth, public school, high school, home address at each age, etc. And I would have expected that the information on the application form was protected pretty closely.

Answer 1

My instinct would be to treat it as a Social engineering/Phishing scam until proven otherwise.

When it comes to things like Security questions - If someone needs my identity confirmed, then they can either pass whatever needs my details to me directly and I will fill them in, or they can sit me at their computer and I can authorize it that way.

Either way - I'm not going to give out the answers to my security questions to an individual.

Especially if they those same set of questions/answers are used in other locations.

Answer 2

You should speak about this with your supervisor.

I would be inclined to think it's phishing.

Answer 3

Am I right to be concerned...

Yes, you need to be concerned and you need to report it up the chain.

It doesn't matter if you're not sure. You don't have a choice. The default action is to report suspicious requests up the chain as quickly as possible (since you may not be the only person targeted).

And yes, it could be nothing, but there is no harm done if that's the case. Treat any attempt like this like a phishing attempt or a penetration test.