Today, Saturday, 31-Jan-2009, I got a call from someone claiming to be calling from "HSBC" offering me an upgrade from my existing life time free gold credit card to life time free platinum credit card. I was asked to confirm certain identification details on the phone, which I refused since I didn't know who was really calling (anybody could be calling in the name of HSBC). I wanted an option to avail this upgrade by calling up the call center, but there didn't seem to be such an option. I was later told that they were a TPA authorized by HSBC to offer this upgrade, but couldn't pass on the verification completion to HSBC.
It makes me wonder why HSBC would end up doing such a thing, if it really is a genuine call. There's some amount of security, identity and data privacy issues at stake here, in the given model.
IMHO, there needs to be an option for HSBC's existing customer who could get such genuine calls to be able to call the call center and complete the rest of the verification. Otherwise, HSBC's customers wouldn't be able to distinguish between a genuine HSBC call and a fraudulent one. In fact it would appear to me that HSBC is ending up encouraging the wrong practices using this model, albeit it may not be intended.