How to Verify a Caller's Identity Securely

Before discussing an account, making changes, or sharing personal information, call center staff usually need to confirm they're speaking to the right person. This process, known as identity verification, protects customers from fraud and protects businesses from disclosing information to the wrong person.

But verification also needs to be practical. If it's too weak, fraudsters can get through. If it's too complicated, genuine customers become frustrated. This guide explains how to verify callers' identities securely while keeping the experience reasonable for customers.

Why Identity Verification Matters

Preventing fraud. Criminals often call businesses pretending to be customers, attempting to access accounts, change contact details, or redirect payments. This is sometimes called account takeover.

Protecting privacy. Data protection laws in many countries require businesses to keep personal information secure and only share it with the right people.

Maintaining trust. Customers expect their accounts to be protected.

Avoiding costly mistakes. Sharing information or making changes for the wrong person can lead to financial loss, complaints, and regulatory consequences.

Principles of Good Verification

Match the checks to the risk

Not every request needs the same level of verification. Checking opening hours needs none. Discussing an account balance needs some. Changing contact details, adding a new payee, or making large transactions needs stronger checks. This is often called a risk-based approach.

Be consistent

Follow the same verification process for every caller, regardless of how convincing, friendly, urgent, or senior they seem. Fraudsters often rely on staff making exceptions.

Use more than one factor where needed

Stronger verification combines different types of evidence, such as something the customer knows, something they have, or something they are.

Don't share information during verification

Ask the caller to provide information, rather than reading it out and asking them to confirm. For example, ask "Can you confirm your postcode?" rather than "Is your postcode AB1 2CD?"

Common Verification Methods

Knowledge-based questions

The caller answers questions about information on their account, such as date of birth, address, or recent transactions.

Strengths: Simple and widely used.

Weaknesses: Static information like dates of birth and addresses can often be found online or stolen in data breaches. Questions about recent activity, such as the amount of the last payment, are usually harder for fraudsters to answer.

One-time passcodes

The business sends a unique code to the customer's registered phone number or email, and the customer reads it back.

Strengths: Confirms the caller has access to a registered device or account.

Weaknesses: Fraudsters sometimes trick customers into sharing codes, or take control of phone numbers through scams such as SIM swapping, where a criminal persuades a mobile provider to transfer a victim's number to a new SIM card.

Phone number matching

The system checks whether the call is coming from the number registered on the account.

Strengths: Quick and invisible to the customer.

Weaknesses: Caller ID can be faked, so this should never be the only check for sensitive actions.

PINs and passcodes

The customer enters a PIN using their keypad, often in the phone menu before reaching an agent.

Strengths: Fast and doesn't require saying information aloud.

Weaknesses: Can be forgotten or stolen. Staff should never ask customers to read out their full PIN or password. Some businesses ask for selected characters only.

App-based authentication

The customer confirms their identity through the business's mobile app, for example by approving a notification.

Strengths: Strong security when the app itself is well protected.

Weaknesses: Only works for customers who use the app.

Voice biometrics

The system analyzes the caller's voice and compares it with a stored voiceprint.

Strengths: Convenient, with no questions to answer.

Weaknesses: Voiceprints are biometric data, which carry specific legal requirements in many places, often including explicit consent. Advances in AI voice cloning also mean voice biometrics should be combined with other checks for sensitive actions.

Callback to a registered number

For high-risk requests, staff end the call and call the customer back on the number registered on the account.

Strengths: Confirms the request is coming from the genuine customer's phone.

Weaknesses: Takes more time and depends on the registered number being correct and not compromised.

A Step-by-Step Verification Process

1. Understand the request, so you know what level of verification is needed.
2. Explain why verification is needed: "Before we discuss your account, I just need to confirm a few details for security."
3. Ask for information, rather than offering it.
4. Use the required number of checks for the type of request.
5. Record that verification was completed, and how.
6. Apply extra checks for high-risk actions, such as changing contact details or payment information.
7. Don't proceed if verification fails.

When Verification Fails

If a caller can't pass verification:

• Stay polite and calm. Genuine customers sometimes forget details.
• Explain that you can't proceed without verification, for their protection.
• Offer alternatives, such as verifying through the app, visiting a branch, or receiving a callback on the registered number.
• Don't give hints about the correct answers.
• Follow your workplace's process for suspected fraud, if the call raises concerns.

Example:

"I'm sorry, I'm not able to verify the account with the details provided, so I can't discuss it today. This is to protect your account. If you'd like, I can send a security code to your registered number, or you can access your account through our app."

Warning Signs of Fraud

Be alert to callers who:

• Pressure you to skip security checks.
• Claim urgency, such as an emergency requiring immediate changes.
• Know some details but not others, or guess answers.
• Request changes to contact details followed quickly by other requests.
• Ask what details are on file.
• Become angry or emotional when asked for verification.
• Claim authority, such as being a senior manager, police officer, or official.

None of these proves fraud on its own, but they're reasons to follow the process carefully and escalate if needed.

Third Parties and Representatives

Sometimes a person calls on behalf of someone else, such as a family member, carer, or legal representative. Only share information or act on instructions if the person is properly authorized, for example through documented consent from the customer or legal authority such as a power of attorney. Follow your workplace's process for verifying and recording authorized representatives.

When You're the One Calling

When businesses call customers, the customer has no way of knowing whether the caller is genuine. Asking customers to provide security details on a call they didn't initiate can make them vulnerable to scammers using the same approach.

Good practice includes:

• Explaining why you're calling before asking for anything.
• Offering the customer the option to hang up and call back using the official number on the business's website or documents.
• Never asking for full passwords, PINs, or one-time codes on outbound calls.

Supporting Vulnerable Customers

Some customers may find verification difficult, for example due to memory problems, disabilities, or stressful circumstances. Businesses should consider alternative verification methods for these customers, while maintaining security, and record agreed adjustments in line with their policies.

Security and Convenience in Balance

Identity verification protects customers and businesses from fraud, but it works best when it's proportionate, consistent, and explained clearly. By matching checks to the level of risk, asking rather than telling, combining methods for sensitive actions, staying alert to warning signs, and never making exceptions under pressure, call center staff can keep accounts secure while treating genuine customers with patience and respect.

Related articles

• STIR/SHAKEN and Caller ID Verification Explained