My question is about customer verification when they come to customer service( by call or chat). The customer service agents always do the verification by asking 2 or 3 questions (email, home address etc) in order to avoid fraud. This is useful. But I dont think it must be done every time. When a customer asks about their order status by giving the order ID verification is not necessary since the orderID is enough to verify them. I think, do the 2-3 questions (or more) verification if only it is related to financial issue or more serious matters. Am I right? or is there any better idea for customer verification system ? Thank you
This is a double issue, which should not be taken lightly: user experience versus security. A trade-off should be found. The constraint is that a minimal standard of security has to be met.
The method to find the best balance requires that you step back and make a little risk assessment.
What is the nature of the threat? Clearly, you want to avoid fraudulent impersonation, but what is the context? (This is not the same if you are within a corporate firewall or outside. I suppose your service is accessible from everywhere with chat or phone. But if you have a small circle of users your staff can get to know personally, this is different from a large one; also it depends how your framework is already protected from wiretapping, hacking, etc. Also, could you be targeted by hackers for particular reasons?).
What is the frequency (volumes per day, etc.)? The question is not the same if you have 5 users a day or 10'000. On a similar line, can we assume the interaction should be as short as possible, from 5 to 30 minutes? Or are sessions allowed to be long, up to 1 hour or more? Also, is it expected that the users call you often, or should it be an exceptional circumstance?
What is the impact if the threat (fraudulent impersonation) materializes? Try to evaluate it in terms of (as applicable):
- Financial: Direct financial loss
- Operational: Wasted time and resources
- Legal: payout to client, fines, court cases, etc.
- Reputational: Public image (is your brand already very popular, etc.?)
What are your resources to defend against the threat? In particular what data or indicia do you already have concerning the caller's identity? (Phone caller id can be useful, but as long as you use it as a weak indicia, not a strong one, etc.). What do you have in your toolkit (e.g. double authentication with a mobile phone, ), etc.? What is your company willing to spend (next to nothing, or do you have a budget)?
That may sound complicated but it could take ten minutes. Hopefully, the issue should become crystal clear after that and -- within your resources -- you might find your bright idea to make the user experience better.
(Plus, if you have taken notes of this an put it in a good place, you may able to defend your company and yourself against accusations of negligence, should something bad happen).