Customer Contact Signals
What happens in support channels (who calls, what they ask, how they authenticate and what changes follow) as evidence of social engineering, account takeover and scams in progress.
What it measures
Support is a parallel authentication and transaction channel. Its signals fall into two groups, the contact is the attack and the contact reveals the attack, plus the metadata that ties them together:
| Group | Examples |
|---|---|
| Contact as attack vector (third-party social engineering) | Caller cannot pass standard verification but persists; repeated contacts across channels and agents for the same account; requests for contact, MFA or payout changes; urgency, escalation or authority claims; caller ANI mismatched to the number on file or flagged by telephony risk data; contact shortly after failed online logins or password resets; agent-shopping (hanging up and retrying until a different agent picks up) |
| Contact reveals an attack (customer is the victim) | Customer asks to raise limits, remove holds or speed up a transfer; asks how to buy crypto, wire abroad or buy gift cards; mentions a "fraud department", "government agent", "investment manager" or "tech support"; a third party is audibly coaching; customer reports a suspicious call or text they received; complaint about a transaction they "didn't expect to be held" |
| Contact metadata | Channel, time, duration, verification method used and its outcome, agent ID, actions performed during or after the contact, call-back to number on file or not |
Why it matters
When online controls get stronger, attackers move to the channel where a human can grant exceptions. Support-assisted recovery and contact changes are a well-known ATO path into accounts holding value, and the phone channel is central to scams targeting older adults: in FTC data on business and government impersonation scams with losses of $10,000 or more reported by adults 60+ in 2024, 41% said first contact was a phone call, and scammers explicitly aim to get the victim on the phone where urgency is highest. FinCEN's elder exploitation advisory lists a customer taking direction from someone on a cell phone, appearing nervous or unwilling to hang up, and being unable to answer basic questions about account activity among behavioral red flags. Generative AI makes the channel harder to defend. FinCEN's 2024 deepfake alert (FIN-2024-Alert004) describes synthetic media used to defeat verification, and voice cloning makes caller-voice recognition unreliable.
The pattern varies by industry. In Brokerage and Investing, callers request address changes and then ACATS or withdrawals. In Neobanks and Consumer Fintech, chat-based recovery is followed by P2P. At Cashback, Coupons and Rewards apps, support is asked to "fix" a payout email or re-credit a reversed reward. On Online Marketplaces, sellers' payout accounts are changed via support, and in Retail and Ecommerce, agents are pressured into refunds without returns.
How to collect it
- Integrate the contact platform with the risk platform. Every contact should carry an account ID, verification result, agent ID, reason code and the actions taken, and those actions should flow into the same event log as self-service changes (Account Change Events).
- Buy telephony signals such as ANI validation, spoofing indicators, carrier and line-type data, and recent SIM changes (Phone Risk Signals). Voice biometrics and synthetic-voice detection are available too; use them as risk inputs and never let them authenticate a caller on their own.
- Capture conversation signals as structured agent dispositions ("customer reports scam call", "third party present") and, where lawful and disclosed, speech or text analytics for scam keywords.
- Stitch channels together so online session, IVR, chat and agent contacts sit on one timeline per account.
How to use it
- Contact → change → money: a support contact that results in a contact-point, MFA or payout change should raise risk on the next value-moving action just as a self-service change would, and usually more, because support verification is easier to socially engineer.
- Repeated failed verification across agents or channels for one account → lock sensitive changes, alert the customer through verified channels, route to a specialist queue.
- Scam-in-progress cues from contacts → route to scam intervention rather than standard service, apply friction to the requested payment (Playbook - Scam Intervention Members), and offer a trusted-contact call where available.
- Agent-level analytics: unusual rates of overrides, exceptions or changes performed by one agent help detect social-engineering hotspots and Insider Fraud (Insider Access Controls).
- Feedback to training: share the patterns attackers use against agents in Support Team Fraud Training and enforce Customer Support Verification Protocols.
Strengths and limitations
Strengths: covers a channel that online models miss; human-observed cues (coaching, distress) are uniquely informative for scams; agent actions are high-value audit data.
Limitations: inconsistent data capture (free-text notes and missing dispositions are the norm); caller ID, voice and knowledge-based answers can all be spoofed or obtained, and voice cloning further degrades voice-based verification; analytics on call content raises privacy and consent questions. Compensate with call-back to numbers on file, out-of-band confirmation, and transaction-level holds after support-assisted changes.
False positives and fairness
- Customers who are confused, stressed or elderly struggle with verification for benign reasons.
- People with hearing, speech or cognitive disabilities may fail voice or knowledge checks.
- Non-native speakers and customers needing interpreters.
- Caregivers and family members calling on someone's behalf (legitimately, with or without formal authority).
- Customers who legitimately lost their phone or email and need recovery.
Build accessible alternative verification and avoid treating difficulty as fraud.
Privacy and compliance considerations
Call recording and analytics require disclosures and, in some states, all-party consent. Speech analytics and voice biometrics may be biometric data under state laws with notice and consent requirements. Reg E error claims raised by phone trigger timelines regardless of the channel. Senior Safe Act protections depend on employee training. See Privacy and Data Use in Fraud Prevention and Regulation E and Unauthorized Transfers.
Mechanisms it helps detect
Account Recovery Abuse · Account Takeover (ATO) · SIM Swap and Port-Out Fraud · Payout Redirection · Impersonation Scams · Elder Financial Exploitation · Insider Fraud · Generative AI and Deepfake Fraud
Related signals and controls
Account Change Events · Scam Victim Indicators · Phone Risk Signals · Login Anomalies · Customer Support Verification Protocols · Secure Account Recovery Design · Support Team Fraud Training · Trusted Contact and Senior Investor Holds · Playbook - Account Recovery Hardening Members · Playbook - Insider Fraud Members
Sources and further reading
- FTC Data Spotlight: False alarm, real scam (Aug 2025): phone as first contact in 41% of $10K+ impersonation losses reported by older adults.
- FinCEN Advisory on Elder Financial Exploitation (FIN-2022-A002): behavioral red flags observable in customer interactions.
- FinCEN Alert on Deepfake Media (FIN-2024-Alert004): synthetic media used to defeat verification.
- Interagency Statement on Elder Financial Exploitation (Dec 2024): training, escalation, trusted contacts and Senior Safe Act.