Support Team Fraud Training
How to train frontline support on social engineering, account changes, payout-destination requests, scam victims and escalation, with a curriculum, scenario drills, QA and metrics.
Core components
What support must be able to do
| Capability | Why it matters for transaction fraud |
|---|---|
| Verify identity properly for sensitive requests | Contact changes, recovery and payout updates are the doorway to Account Takeover (ATO) and Payout Redirection |
| Recognize social engineering | Urgency, authority, sympathy and pretext stories aimed at bypassing verification |
| Recognize scam victims | Customers being coached to move money; elderly customers being exploited (see Scam Victim Indicators, Elder Financial Exploitation) |
| Handle fraud-action contacts | Explain holds, declines and closures without revealing detection logic |
| Escalate fast | Route suspected ATO, scams, insider requests and threats to fraud |
| Protect themselves | Resist pressure, abuse and bribery approaches (see Insider Fraud) |
High-risk request types
| Request | Risk | Required control |
|---|---|---|
| Change phone or email | Precedes ATO and OTP interception (see SIM Swap and Port-Out Fraud) | Strong verification; notify the old contact; cooling-off on money-out (see Contact Change Cooling-Off Periods) |
| Account recovery / password reset | Direct ATO path (see Account Recovery Abuse) | Recovery protocol; no knowledge-based shortcuts (see Secure Account Recovery Design) |
| Add or change payout destination | Direct cash-out | Step-up; hold on first use |
| Release a hold or raise a limit | Defeats a risk control | Fraud approval or documented criteria only |
| Reverse a fraud decision | Defeats detection | Route to fraud; never at agent discretion |
| Issue credits, refunds or goodwill | Value creation | Limits; second approval above threshold |
| Remove MFA / trusted device | Disables a key control | Strong verification; fraud review |
| Third party calling "on behalf of" | Authority pretext | Documented authorization only (POA, trusted contact) |
| Customer asks to move money urgently "because the bank told me to" | Impersonation or safe-account scam (see Impersonation Scams) | Scam intervention script; escalate |
How to build it
Curriculum
| Module | Content | Format | Who |
|---|---|---|---|
| 1. Why support is targeted | How support fits into the money path; real (anonymized or public) cases | Live session | All agents, at onboarding |
| 2. Verification protocols | Exactly what verification each request type needs; no exceptions (see Customer Support Verification Protocols) | Live + job aid | All agents |
| 3. Social engineering patterns | Pretext types: urgency, authority, sympathy, insider knowledge, technical confusion; how they sound | Recorded examples + role-play | All agents |
| 4. Synthetic voice and impersonation | That voice and video can be synthetic; why verification relies on protocol, not on recognizing a voice (see Generative AI and Deepfake Fraud) | Short module | All agents |
| 5. Scam victim recognition | Signs a customer is being coached; how to slow down without accusing; when to escalate | Role-play | All agents, refreshed quarterly |
| 6. Explaining fraud actions | Approved language for holds, declines and closures; what never to say | Scripts | All agents |
| 7. Escalation | When and how to escalate; what information to capture | Job aid + drill | All agents |
| 8. Insider risk | Recognizing approaches (bribery, coercion); reporting; access rules (see Insider Access Controls) | Short module + annual attestation | All agents |
| 9. Specialist tracks | Recovery desk, payout desk, elder or vulnerable customer desk, brokerage transfers | Extended sessions | Specialist teams |
Scripts and job aids
Refusal script principles (no detection details):
- Acknowledge: "I understand this is frustrating."
- Explain the protection, generally: "For your security, changes like this need additional verification."
- Offer the legitimate path: "You can complete this through [verified channel / in-app flow]."
- Hold firm: don't make exceptions under pressure. Escalate instead.
Scam intervention prompts (when a customer wants to move money urgently):
- Ask open questions about the payment's purpose and who suggested it
- Explain, without blaming, that banks and government agencies don't ask customers to move money to "safe accounts" or pay with gift cards or crypto
- Offer a pause: "Before we send this, can we take a moment?"
- Escalate to the scam intervention team (see Playbook - Scam Intervention Members, Customer Education and Scam Warnings)
What never to say:
- Which signal or rule triggered an action
- That an account is linked to others, or under investigation
- Anything about SAR considerations
- "Just try again from a different device / network"
Scenario drills
Run monthly 15-minute drills built on realistic, anonymized scenarios:
- A caller with correct personal details, urgent travel story, asking to change the phone number and withdraw
- A polite "relative" calling for an elderly customer who "can't come to the phone"
- A customer insisting the "fraud department" told them to move funds to a new account
- A caller claiming to be from an internal team asking an agent to release a hold
- A seller on a marketplace asking support to release a payout early because of "a family emergency"
- A rewards customer asking to merge balances from several accounts "belonging to family members"
Debrief: which cues were present, what the protocol requires, and how to escalate.
Measuring and reinforcing
- QA on sensitive interactions. Sample contact changes, recoveries, payout changes and hold releases for verification adherence. Treat skipped verification as an auto-fail (see Fraud QA Program).
- Mystery shopping / red-team calls. Authorized test calls using social engineering pretexts, run under clear rules of engagement with HR and legal. Use results for coaching only.
- Feedback loop. When fraud confirms an ATO that went through support, review the interaction with the agent and the team (blameless).
- Recognition. Celebrate good catches publicly. Agents who stop a scam or an ATO should hear about it.
Who does what
| Activity | Fraud | Support ops | Training / L&D | QA | Legal / compliance |
|---|---|---|---|---|---|
| Curriculum content | A | C | R | C | C |
| Verification protocols | A | R | I | C | C |
| Scripts and customer language | R | R | C | A | |
| Delivery | C | R | A | ||
| QA of sensitive interactions | C | I | A/R | ||
| Red-team calls | A | C | R | C | |
| Pattern briefings | A/R | R |
Artifacts and templates
Agent quick-reference card
| If the customer asks to... | You must... | Escalate if... |
|---|---|---|
| Change phone/email | Complete [verification level] | Caller can't pass, is pressured, or requests a withdrawal in the same call |
| Reset access / recover account | Follow the recovery protocol | Any mismatch; third-party involvement |
| Add a payout destination | Use the in-app flow with step-up | Customer insists on an agent override |
| Release a hold | Check fraud criteria; don't override | Always, if fraud placed the hold |
| Send money urgently on someone else's instructions | Use the scam script; pause | Any sign of coaching or impersonation |
New pattern briefing template (from fraud to support)
- What we're seeing (conceptual)
- How it sounds on a call / looks in chat
- What to do
- What not to do
- Escalation path
- Effective date
Metrics
| Metric | Why |
|---|---|
| Verification adherence on sensitive requests (QA) | Core control health |
| ATOs with a support touchpoint in the attack path | Outcome; should fall |
| Scam escalations from support, and funds protected | Victim protection |
| Escalation response time (fraud to support) | Partnership health |
| Red-team call pass rate | Training effectiveness |
| Training completion and drill participation | Coverage |
| Agent-reported social engineering attempts | Awareness |
Pitfalls
- Training without protocols. "Use judgment" fails under pressure. Agents need rules.
- Metrics that punish caution. Handle-time and CSAT targets push agents to skip verification. Exempt verified-refusal contacts from these, or weight them.
- Escalations into a void. If fraud doesn't respond quickly, agents stop escalating.
- Teaching detection details. Agents repeat them to customers, including fraudsters.
- Knowledge-based verification. Data breaches make personal details widely available. Prefer in-app, device-bound or phishing-resistant verification (see Passkeys and Phishing-Resistant Authentication).
- Ignoring outsourced teams. BPO agents need the same training, protocols and QA, plus insider-risk controls.
Related
- Fraud Program Overview · Cross-Functional Partnerships · Fraud QA Program
- Customer Support Verification Protocols · Secure Account Recovery Design · Contact Change Cooling-Off Periods · Trusted Contact and Senior Investor Holds
- Playbook - Account Recovery Hardening Members · Playbook - SIM Swap and Contact Change Abuse Members · Playbook - Scam Intervention Members · Playbook - Elder Exploitation Response Members
Sources and further reading
- FinCEN Alert FIN-2024-Alert004 on deepfake media: red flags such as repeated technical glitches and switching communication methods during verification
- FinCEN Alert FIN-2023-Alert005 on pig butchering: customer behaviors (stress, urgency, instructions from a new contact) frontline staff can recognize
- FTC, reported fraud losses jump to $12.5 billion in 2024: imposter scams as the second-largest loss category; phone and text as common contact methods
- FTC Data Spotlight index: spotlights on impersonation scams targeting older adults' savings (2025) and business/government impersonation (2024)