The caller tricks the customer into revealing his or her civil registration number and password under the guise of verifying the customer’s identity and then into confi rming the new password by verifying the remainder of the security encryption code.