The call started the way they all do. A recorded woman told me my call was important, followed by 37 minutes of evidence to the contrary.

Eventually a human arrived. His name was Gareth, he was cheerful, and he had the voice of a man who’d been taught in training to smile so the customer could hear it. I could hear it. It was unsettling.

“Before I can help, I just need to ask a few security questions, Mr Malik. Is that okay?”

As if I could say no. “Absolutely,” I said, a man with nothing to hide.

“What was the make of your first car?”

This I knew. I’d had a system for years, a very clever system… which was that I’d lied.

“Potato,” I said, with the confidence of a man who was pitching a product on Dragons Den.

Keys clicked. “I’m afraid that’s not what I have.”

“Batman?”

“That’s not what I have either.”

Gareth did not laugh, which I respected. He was listening to an adult guess between a vegetable and a superhero as his own first car, and he held it together better than I would have.

“No problem. Let’s try your mother’s maiden name.”

Now, years ago I read the advice. Every security person says it, and I’ve said it myself, probably smugly, probably at a conference… don’t give real answers to security questions, because real answers are on your Facebook, your family tree site and your auntie’s 60th birthday post. Make something up. Treat the answer like a password.

So I had. And then, like a password, I’d forgotten it.

I tried my mum’s actual maiden name first, on the theory that past me might have chosen honesty. Wrong. I tried a made-up one. Wrong. I tried a second made-up one with an ever-increasing amount of dread filling my stomach.

“I’m sorry, Mr Malik, that’s three unsuccessful attempts on that question.”

Gareth actually sounded sorry. Even if he wanted to help me, he couldn’t.

“No worries, we can verify you another way. Can you tell me the amount and merchant of your last three transactions?”

I stared at the ceiling. What had I bought? Something with a Greggs in it, probably. Something I’d have preferred not to confirm to a stranger anyway. I got one of the three, which I’d call a “partial match” and Gareth’s classed as a “no”.

“Okay, what I can do is send a one-time code to your registered mobile number.”

“Lovely.”

“It ends in 4-4-1-7.”

It did not end in 4-4-1-7. It was a number I’d last owned in 2016, and it now belonged to someone who was, in all likelihood, receiving my one-time codes and wondering what he’d done to deserve them.

I think that was the point Gareth reached the end of his flow chart.

“What I’ll need to do,” said Gareth, “is raise this with our security team. They’ll review it and either call you back within two working days, or we can post a verification letter to the address we have on file.”

“Which address is that?”

“I can’t tell you that, I’m afraid. For security.”

“Of course.”

“Is there anything else I can help with today?”

64 minutes of hold music, guesses and a man being kind to me in a script and all I’d achieved was getting locked out.

Joking aside, it was a perfectly functioning system. Every control did what it was designed to do. The questions asked. The answers didn’t match. The fallbacks fell back. The only thing that failed was me, and I’d been the one who set it up.

“Mr Malik? Is there anything else?”

“No, Gareth,” I said. “You’ve been brilliant.”

He had been, too. He’d been brilliant, patient and warm, and he’d followed the process to the letter.

Somewhere else, on a different call to a different help desk, someone with a good phone voice and a LinkedIn tab open would be getting very different results. We’ve seen it happen repeatedly with incidents around the world. A silver-tongued conman convinces a helpful support worker to let them into their account resulting in havoc. So top marks to Gareth, even though I could tell he believed me, he stood his ground.

I hung up and went to find a pen, to write down a made-up answer I’d definitely remember this time.

I wrote down “Potato”. Then I crossed it out and wrote “Batman”.

I still don’t know which one it is.