As long as I trim the input string to 25, that's totally fine: a character match on the first 25 characters of your mother's maiden name is perfectly acceptable, either over the phone or in an automated way, as proof of identity. But it surely isn't going to work with these super long messages that GP was trying to fit into the DB.