What are the best practices for verifying the identity of callers in contact centers?

There are two tasks that need to be achieved: - Identification - locating the caller in your systems of record - the caller typically claims an identity using an account number or other reference number but the best practice is to use the phone number the customer is calling from or something they personally identify themselves with like a name or address. - Authentication - confirming the caller is who they claim to be - the caller typically answers knowledge based questions about themselves such as mothers maiden name or date of birth, their relationship with the organisation such as recent transactions or secrets like passwords.

You can also ask them the nest street to the registered address they provided on account. Real account holder will give you answer immediately without using Google to search. You can also use mother's maiden name as a security question Ask caller to tell you the position of the alphabets in the security password.

Customer verification is a delicate area that requires navigation through a blend of automated and manual processes. While automated verifications can approve 95% of customers, we must be prepared to accommodate the remaining 5% who require manual verification. This may arise from various factors, such as customers legitimately forgetting their verification information, or automated systems failing to recognize customer pronunciations, among others. Viewing this process as a funnel, once the 95% are successfully approved through automated verification, those requiring manual verification can be directed to a specialized group of call centre advisers who are trained to manage exceptions in user verification, ensuring a successful outcome.

No one enjoys the id verification process. Simplify it, at account creation, setup the paths the customer wants to use for verification, email, text security numbers, 'Enter the code from the text/email' simple and effective. Then the security questions, most people know that Mother's Maide Name (MMN) is not really secure, but it can be reinvigorated by having the suggestion "Instead of MMN, use a name from your past, a teacher, neighbor, grandparents, etc., it will eliminate one of the easiest for a bad actor from knowing and taking over an account

Technology such as CallerVerify.com can be used to leverage your existing identity providers such as Okta's MFA factors as a means of securely verifying callers are who they say they are.

Identifying and authenticating callers using automated systems saves agent handle time and allows callers to access voice assisted self service features that may avoid the need to speak to an agent altogether. Care must be taken to maximise usability for the caller so they but also prevent imposters from gaining insight from the process. The most usable systems require minimal customer effort using data such as incoming phone number to identify callers and technologies such as voice biometrics to authenticate them while they state their intentions to the system. Not every organisation will need such high security processes so technologies like network authentication can be used to confirm possession of their phone.

You can also use location via Google too. The frequency of calls to the organisation could be built into the the technology delpoyed

Leverage your existing ITSM system as a pane of glass offering your call center agents a means of confirming the identity of a caller. For example CallerVerify.com can be embedded in common ITSM systems including: ServiceNow, Zendesk, FreshService and more. This keeps things simple for the help desk agent and allows the verification to be logged as part of the help desk ticket for auditing purposes.

You must remember that the vast majority of agent interactions will be with genuine customers so whilst they can provide some defence. Even in retail financial services a typical agent may go weeks without a fraudulent call. You absolutely can not depend on agents as your only line of defence. Organisations must ensure their systems and processes provide the tools that enable agents to do their ultimate job which is meeting the customers need. As far as possible you should remove the identification and authentication process from being an agents responsibility and where this isn’t possible provide clear processes and tools including escalation paths.

You can also add notification for triggers when certain words are used during conversation. The notification could be sent to a senior person to join in the conversation and could speak to the agent on a live call without disrupting the call. This will help the agent and reduce risk.

Coach agents on active listening skills to recognize caller nuances and verify identity through conversation contextual cues. Implementing structured questioning techniques can subtly gather necessary information while maintaining a natural interaction flow and using readily available information without overly probing for sensitive information unless required.

Communicate clearly and empathetically the importance of verification during customer interactions. Highlight examples of how identity verification protects against fraud and safeguards personal information. Use simple language to illustrate the process and reassure customers that these measures are in place to protect them.

Also request customers to give feedback on their view about the security putnon place. Most times they have good suggestions that work. They may even preinform the organisation some questions to ask them too.

Consider implementing a biometric solution which authenticates voice signatures. Nuance for example has an integration with Genesys which is capable of matching contact records with voice signatures to add an extra layer of security prior to call delivery.

In this article the focus is on external call centers. We have the same need to verify users at the internal service centers like the IT help desks. One might think the same principles for verification should be used. The big difference is however, that we already know a lot about the caller! We have information in Active Directory and other systems –even from self-service password reset systems. The consequence of a failed verification is an identity theft like it happened for MGM. The answer is a forced and intelligent IT-workflow where the workflow makes the decisions based on the user’s availability of MFA’s and answers to questions. Don’t let the supporters control the process – they might become victims of a social engineering attack.