How do you choose the best MFA method for your contact center?

?? One size doesn't fit all when it comes to MFA. We always start by looking at our specific business needs and the type of data we're protecting. For example, if we're handling highly sensitive information, we might opt for a more robust method like biometrics but, for less critical interactions, something simpler like an SMS code might be sufficient.

1) Evaluate risk levels and regulatory requirements. 2) Balance security with usability for agents and customers. 3) Choose methods like SMS, authenticator apps, or biometrics based on your criteria.

This is highly dependent on the kind of enquiry that user is calling for. For informational type of information, it won't help to authenticate a customer with MFA. Depending on the type of information customers are calling for, segregate authentication mechanisms so customers can get to a frictionless experience.

Most of the contact center solutions today have their own solutions with third-party integration capability, and despite your risk, it's always advised to protect the information of the clients and stakeholders that engage with your organization. I would suggest making things as simple as possible for agents because, most of the time, security fails due to its complex processors and procedures. If it's simple to make it safe, that would be your best solution!

The key considerations when choosing an MFA for a contact center environment is whether phones are allowed. Typically, call center environments have clean desk policies meaning traditional MFA solutions are out the Window. If this is the case you will find the primary options are hard tokens, behavior or biometric solution. Hard tokens are secure but cumbersome, complex to manage and see high loss / breakage rates. Behavior (I'm biased) based MFA is the most straight forward approach as it requires no interaction from the agent. Biometric (facial, fingerprint, voice) can work well if the computers support the biometric. I would stay away from voice due to it being very vulnerable to attack with AI.

?? Happy agents and customers are key. We try to find MFA solutions that are both secure and user-friendly. We've found that if it's too complicated, people will find ways to work around it, which defeats the whole purpose!

In my journey, I’ve always believed that understanding user preferences in MFA is like tailoring a suit—it must fit the individual perfectly. When I think back to solutions I’ve implemented, it’s clear that technology alone doesn’t define success; the true measure is user trust and comfort. Imagine giving someone a fingerprint scanner who’s unfamiliar with it; it’s like offering a tailored suit to someone who's never worn one. The fit must be precise, yet familiar. Balancing usability, accessibility, and security means adapting technology to the human element, not the other way around.

In call center environment, there are two sides that can use MFA, Customers and Agents. As per my experience the most common kind is OTP (one time password) by SMS, it is preferred in Saudi Arabia by customers and widely used. Setup of authenticator can be difficult for customers. Remote Agents use authenticator application to join company network. Agents are internal employees that can be trained on any technology that company prefers to use.

?? Technology should make life easier, not harder. We always consider how easy a particular MFA method is to implement and maintain. We don't want to bog down our IT team with complex solutions that are difficult to troubleshoot.

Implementing strong MFA doesn't have to be a technical hurdle. Many cloud-based SSO solutions offer pre-built integrations with popular authenticator apps. This simplifies the process for your tech team, minimizing setup time and ongoing maintenance for your contact center's MFA implementation.

In my view it is not a big factor, if you choose an MFA method, vendor can provide PS (professional services) and Engineers can be trained to run the operation. Mainly it should be cost effective and easy to use. For example, if you implement an MFA that needs multiple steps to configure on customer's side. You will need to provide extra support by Call, chat or by any other channel to your customers and it will increase operational cost. Thats why it is better to use simple MFA to configure and to maintain.

Risks are there for each method, but it depends on which risk you can mitigate, and which can be accepted. For example, customer side is using OTP by SMS and mobile phone is compromised, what is the percentage of this kind of incident? If you install stronger or complex method of MFA, is it viable financially? operationally? for contact center. Managment can take these decisions but sometimes it can be a compliance issue, and you have to go ahead with the solution, even if it is not cost effective.

?? Security is paramount, but it's a balancing act. We assess our risk level and choose MFA methods that offer the right level of protection without creating too much friction for our users. It's about finding that sweet spot.

Beyond SMS and phone calls: While familiar, SMS can be intercepted and phone calls vulnerable to social engineering. Consider stronger MFA options like authenticator apps with built-in MFA for enhanced security. SSO with consistent MFA: Implementing SSO with consistent MFA across all enterprise apps simplifies user experience and reduces the risk of falling for phishing scams that mimic login screens.