And as for actions to take, if one is concerned, one can go change one's online account password directly after the call.

In my opinion, this is a very bad practice, because it undermines the effort of teaching users to never, ever, tell their password to anybody.

@jacco well it depends, do you count an IVR system (automated not human) as a person? and in that case do you differentiate it from a website? The problem is that you've got to authenticate the customer somehow on each channel. IVR is better than giving your password to a human operator. And the problem with the having multiple sets of creds (one for each channel) is that user's just forget the ones they don't use frequently

Yep, very similar to systems that ask you for SSN via IVR prior to passing you to a rep, to avoid revealing info to customer reps. You are authenticating with a system just as you would authenticate with a website.

What systems request a for a users password? I know HSBS use a system that is based on nuances in the users voice (and had been found to be flawed). Are there biometric voice id systems that specifically request a users secret password?

@TheJulyPlot The bank has to authenticate customers somehow. Personally I've not experienced voice recognition from an organization,but it would seem to me that they'd need a good base sample from customers to do accurate detection and that it would be susceptible to things like having a cold, or a bad phone line, which could make it a frustrating experience for customers.

I'm surprised this is the only reasonable answer.

Your recent edits helped clarify the situation, but even still I have a hard time with a bank doing this. Your general answer is certainly correct (the system needs to authenticate you, like any other system), but asking for the password to your web account seems crazy. The biggest issue is that web passwords are meant to be typed: I can't imagine how difficult it would be to build a system that can automatically understand the combination of special characters, numbers, and dictionary words that people might try to speak in different ways. It just doesn't make sense to me.

yeah the usuability aspect I'm not sure about and I'd be concerned to hear if the bank is constraining character choice to ease recognition, however with that said, voice recognition is a lot better than it used to be, so it's possible they can do this well...

@RоryMcCune, I'm sceptical about the typical end-user's ability to differentiate between an IVR system and a person. To most end-user's a phone is a phone. Educating them to never tell their password to anybody is hard enough. I think it is near impossible to get the message across that they should only give their password to automated systems, where it is up to them to figure out if a voice on the telephone is a human or a human-sounding automated system. I believe the system of passwords is fragile enough as it is, we should keep the message as simple as possible.

@Jacco in that case how do you suggest banks authenticate users on the phone channel?

I'm not sure a phone channel is the suitable channel for performing actions that require authentication (alternatives are: website, smartphone-app, showing up in-person at a bank with an ID, etc). If the bank however decided it did want to support phone as a valid communications channel for stuff that would require authentication, the only valid options I see, is having either out-of-band authentication or have them call the customer, on a pre-registered phone number (in which case you run into the reverse issue: how to identify that you are talking to a bank employee, and not some scammer).

Asking for web password over phone would go horribly wrong if one uses a password manager to generate strong passwords which aren't meant to be memorized or typed in manually.

I don't see how it would go horribly wrong, other than having the customer spelling a really long random password. I would be tempted to set the online banking password to an extremely long one, in order to make their system break, though. Sir, when I try giving your IVR my 150 character password to your voice system, it stops me before I am able to finish...

Surprised no-one mentioned the risk of you needing to say your password out loud personally, I'd rather type a 4 digit PIN than say a password out loud.

Another approach which I find interesting as a security-enthusiast: pindrop.com

And even if the human operator would ask for the credentials, it isn't dangerous. When I call my bank, theres a automatic authentication solution that works if you have an authentication app on the phone. But if not, you have to select "I cannot authenticate", go through to the human operator and tell the human operator both my PIN and the one-time token password. Its not dangerous, because every human operator on a bank is usually vetted and recorded, so if a human operator would misuse your login details, it can be traced. You can trust your bank.

So if you trust your bank, they have safeguards in Place to prevent a untrustworthy employee from misusing login details they get in a phone call. Usually the employee has to agree that the bank may monitor the employee's own accounts (even on other banks) to prevent the employee from stealing a customer's Money.

Whilst, as a customer, you're unlikely to be at financial risk from employee fraud as the bank would be obliged to refund any loss, it's fair to say that employee fraud is not unknown, so I wouldn't say that it was necessarily "safe" to do so.