My question is about customer verification when they come to customer service( by call or chat). The customer service agents always do the verification by asking 2 or 3 questions (email, home address etc) in order to avoid fraud. This is useful. But I dont think it must be done every time. When a customer asks about their order status by giving the order ID verification is not necessary since the orderID is enough to verify them. I think, do the 2-3 questions (or more) verification if only it is related to financial issue or more serious matters. Am I right? or is there any better idea for customer verification system ? Thank you
-
4Well, if make a guess at an order number and ring up and ask "Do you have my address right? Where are you going to deliver it?" what happens? The agent tells me and I know where to burgle.– Andrew LeachOct 13, 2015 at 9:50
-
If your system requires verification for most parts then it's probably a very bad idea to drop verification in any area - once the caller has bypassed verification at one of your "low security" entrances what will stop them from being transferred through to a "high security" area without further verification?– Roux MartinOct 13, 2015 at 10:35
-
@Leach. Once I have the orderID, I have their address and an agreement to deliver the product to that address. Customer often calls to find out the status ; whether it is on delivery process or still in warehouse– ShierynOct 13, 2015 at 10:53
-
@Martin okay I got it. Are we talking about making a level of security? higher level needs more verification. Just say the customer ask for general info of product, then verification is not necessary, but when he/she ask more, and entering "high security" level, then we do the verification.. is that it?– ShierynOct 13, 2015 at 11:03
-
1@Shieryn No, once you have the orderID, you have the address of the person who ordered it. You don't have my address, and I don't think it would be difficult to get the service agent to divulge the orderer's address, which I don't know. "Is it still in the warehouse? Oh: you already delivered it? Where to? I never got it!" (Which is true; I never got it, the orderer did. I want to know where he is.)– Andrew LeachOct 13, 2015 at 11:35
|
Show 1 more comment
2 Answers
This is a double issue, which should not be taken lightly: user experience versus security. A trade-off should be found. The constraint is that a minimal standard of security has to be met.
The method to find the best balance requires that you step back and make a little risk assessment.
What is the nature of the threat? Clearly, you want to avoid fraudulent impersonation, but what is the context? (This is not the same if you are within a corporate firewall or outside. I suppose your service is accessible from everywhere with chat or phone. But if you have a small circle of users your staff can get to know personally, this is different from a large one; also it depends how your framework is already protected from wiretapping, hacking, etc. Also, could you be targeted by hackers for particular reasons?).
What is the frequency (volumes per day, etc.)? The question is not the same if you have 5 users a day or 10'000. On a similar line, can we assume the interaction should be as short as possible, from 5 to 30 minutes? Or are sessions allowed to be long, up to 1 hour or more? Also, is it expected that the users call you often, or should it be an exceptional circumstance?
What is the impact if the threat (fraudulent impersonation) materializes? Try to evaluate it in terms of (as applicable):
- Financial: Direct financial loss
- Operational: Wasted time and resources
- Legal: payout to client, fines, court cases, etc.
- Reputational: Public image (is your brand already very popular, etc.?)
- Others?
What are your resources to defend against the threat? In particular what data or indicia do you already have concerning the caller's identity? (Phone caller id can be useful, but as long as you use it as a weak indicia, not a strong one, etc.). What do you have in your toolkit (e.g. double authentication with a mobile phone, ), etc.? What is your company willing to spend (next to nothing, or do you have a budget)?
That may sound complicated but it could take ten minutes. Hopefully, the issue should become crystal clear after that and -- within your resources -- you might find your bright idea to make the user experience better.
(Plus, if you have taken notes of this an put it in a good place, you may able to defend your company and yourself against accusations of negligence, should something bad happen).
How about verifying the user based on the phone number they're using? Ideally, the call center brings up the caller's data when the call center agent answers the phone.
This should cut down on the questions needed to avoid fraud.
answered Oct 13, 2015 at 14:25
-
1I would hazard against this. It is possible (and not terribly hard) to spoof a phone number. See this article by the FCC. It's certainly illegal, but that doesn't mean a social hacker won't use it to "prove" who they are. Oct 13, 2015 at 17:16
-
@nobi : We do this also. we verify by : phone number, home address , email address etc. but we feel that verification is not always necessary. You dont need to be verified if only ask a general info of product– ShierynOct 15, 2015 at 1:47
-
Maybe I was too lazy in my explanation - when a call arrives, the system can detect the incoming phone number and look up this number in the database, to already present this customer's data when the agent takes the call. And yes, @Daniel, it can be spoofed, but it's one indicator about who's calling. Depending on the value you talk about (i.e., product information vs. bank details), you may need additional indicators. Oct 15, 2015 at 5:27