Despite enterprises investing heavily in securing applications and network infrastructure, call centers often remain a weak link. As the recent wave of Scattered Spider social engineering attacks shows, a simple phone call can bypass even the most robust digital safeguards.
Recent incidents, such as the June hack on Hawaiian airlines, demonstrate how threat actors convincingly impersonate customers or employees to exploit call center procedures.
This article explores why call centers are prime targets for identity-based attacks, how common verification procedures fail, and how enterprises can use identity threat detection and risk mitigation to shore up their defenses.
Why attackers target call centers for identity fraud
Even with the rise of apps and online platforms, enterprises still depend heavily on call centers for customer support and transactions. Call centers are attractive targets because agents typically have access to sensitive customer information and can perform account actions.
Threat actors exploit this by assuming the identity of a customer or employee. By doing so, they convince agents to reset passwords or otherwise circumvent defenses. The combination of high access and human interaction creates fertile ground for social engineering.
Inexperienced agents, especially remote workers without quick access to colleagues for a second opinion, are more vulnerable. Threat actors exploit psychological triggers such as urgency or the desire to be helpful. They pressure agents by posing as angry customers, panicked fraud victims, or even executives within the enterprise.
Historically, businesses have underinvested in voice security compared to IT security. Enterprises may have firewalls and multi-factor authentication (MFA) in place, but call centers often rely on weaker verification. Cyber adversaries exploit this gap. Using cheap caller ID spoofing tools, they can replicate successful attacks at scale while remaining anonymous.
How call center identity verification works and where it falls short
Call centers typically use standard procedures to verify a caller’s identity before making account changes. Agents ask a series of knowledge-based authentication (KBA) questions such as full name, account number, address, recent transactions, or the last four digits of a Social Security number.
In theory, only the true account holder should know these details. In practice, the method is flawed. Personal data is widely available online or through past breaches, giving fraudsters an easy path to the correct answers.
Criminals frequently purchase personal information (PII) from the Dark Web. By the time they call a contact center, they may already know the customer’s date of birth, mother’s maiden name, or other details that KBA relies on. Static questions cannot reliably distinguish a legitimate customer from an identity thief who has done research.
Caller ID offers little help since spoofing is simple. Fraudsters often falsify the phone number displayed to the call center. A SecureLogix report shows that spoofing allows attackers to pose as trusted parties, such as a bank’s own number, which lowers agents’ defenses. Because VoIP tools make fabricating phone numbers easy, caller ID cannot be treated as a trustworthy signal.
Password reset and account recovery processes are another weak point. The MGM Resorts breach of 2023 is a telling example. According to investigators, MGM’s IT help desk reset accounts, including MFA, if the caller could provide only a name, employee ID, and date of birth. Attackers researched employees on LinkedIn, impersonated them on the phone, and used basic details to gain full access.
This shows how attackers can bypass strong authentication controls at the front end by exploiting weak verification procedures at the back end. After the MGM breach, Okta reported a wave of attacks on U.S. companies where callers pretended to be employees who “lost their phone” and needed MFA reset.
If call centers lack identity threat detection technology, they can inadvertently disable a customer’s or employee’s security features at the request of attackers.
Strengthening call center defenses against identity attacks
No organization wants to experience these scenarios. The good news is that a layered approach combining training, processes, and technology can reduce the risk of identity-related call center fraud.
Implement multi-factor verification for sensitive requests
Just as web logins use multi-factor authentication, call centers can apply extra checks for high-risk transactions. For example, if a caller requests a password reset or account unlock, the agent should trigger a second factor such as sending a one-time passcode (OTP) to the customer’s registered email or phone.
Another option is dynamic KBA. Instead of static questions, the caller may be asked to log in to their account and read back a one-time code shown there. These steps add friction but make impersonation much harder.
Leverage voice biometrics and analysis
Voice biometric technologies can create customer voiceprints (with consent) and verify calls in real time. Vendors such as Pindrop analyze dozens of voice and device traits, producing a risk score for each call. These tools detect impostors by spotting mismatches between the caller and past interactions or by flagging VoIP sources often linked to fraud.
Real-time fraud monitoring and analytics
Enterprises should monitor their contact centers for suspicious patterns just as they do with digital channels. Indicators may include repeated failed authentication attempts, multiple calls targeting the same account, unusual call times, or high call volumes from specific regions.
When a call is flagged as high-risk, the system should block or route it for further vetting before it reaches an agent. Automated detection reduces the number of dangerous interactions agents must handle.
Secure the support tools and IVR
Enterprises must secure the tools agents use. CRM, ticketing, and support platforms should enforce strong authentication and audit logs. High-risk actions such as password resets should require an additional approval step.
Interactive Voice Response (IVR) systems should limit guess attempts and restrict sensitive information playback. Some companies now require callers to enter an account-specific PIN via keypad before reaching an agent, adding another layer of protection.
Stricter procedures and training for agents
Technology helps, but well-trained agents remain a vital control. Training should focus on recognizing social engineering and high-risk interactions.
Enterprises must build a culture where agents feel empowered to escalate suspicious calls without fear of punishment for not delivering “perfect service”. Policies should be clear: agents should never disclose OTPs or full credit card numbers, and unusual requests such as “please install this software’ must go through a supervisor. How ID Dataweb secures the call center
ID Dataweb integrates call centers into the same risk-aware framework used for web and application channels. By unifying threat signals across all channels, ID Dataweb prevents risk patterns from hiding in silos.
When a call arrives, ID Dataweb evaluates it in real time by analyzing number reputation, spoofing indicators, and device fingerprints. Low-risk calls proceed with lightweight checks. Higher-risk calls trigger guided step-up challenges such as a one-time link to a trusted device, dynamic knowledge challenge, biometric proofing, or document verification.
Because the process is adaptive, agents do not need to choose controls manually. The system automatically presents the next best action and records each verification step
This creates a verification layer that is seamless for legitimate customers but demanding for attackers. Enterprises benefit from stronger identity-related fraud prevention and centralized policy management.
Questions? Consult with an identity security expert
Conclusion
Call centers are both vital customer touchpoints and potential security liabilities. The Procedures designed to assist customers can be exploited by attackers to bypass defenses.
Identity-related attacks on call centers exploit human nature and procedural weaknesses, but organizations can defend themselves through layered security.
The recent surge in social engineering attacks is a wake-up call. More than 75% of cyberattacks are identity-related, which means any enterprise with a support line is vulnerable. The solution is layered defenses that combine automated controls, trained staff, and an identity-first strategy that anticipates risk while accurately verifying callers.
