If you have done business with a company and reach out to their call center, how do they authenticate who you are? Do they ask you for personal information or ask you to verify personal information?
So I called my bank…
When I telephone my bank’s call center they need to verify who I was before they will share any information with me. The bank generally asks information that presumably I would know but would not share with anyone else such as:
- my debit card number,
- my name, and
- my employer tax id (since this was a business account).
I rarely share the last of these items unless for a good business purpose and it would be very unusual for me to share all three pieces of information with any one person.
There are other questions that might be asked such as “how much was a recent deposit”, but in no case does the bank give me personal information and ask for it to be verified. This is a very good practice.
Verifying personal information
Unfortunately, it is not unusual that a call center to ask you to verify personal information. While it may not be an accepted practice at a company, the practice can be the result of an individual contributor or even a manager trying to do “the right thing” to make it easier for a customer. Unfortunately this is one of those things that has just not been thought through.
For example, I called a retailer to get my frequent shopper card number. After explaining what I wanted, I was asked for my name and my zip code. “Do you still live at…” I was asked. What an easy way for someone to get my home address. How easy it would be for someone to have access to coupons or rebates I have earned.
…and then I called Disney World
Earlier this week my wife and I discussed going to Disney World for the weekend so I called the reservations number. When the automated system asked me what I wanted, I responded with “a new resort reservation”.
To make the process easier I was asked how many times I had visited Disney World. After replying I was asked if any of the visits were during the last 5 years. I responded “yes”. I was then asked for my phone number.
Much to my surprise, I was asked to verify my last name (the system spelled it for me) and my address. I was shocked. By simply providing a phone number and saying I had visited the resort in the last five years I obtained personal information from the automated system; a practice that management must have approved.
You can argue that last name, telephone number, and address are public information. I suggest it does not matter. As custodians for personal information provided by their guests, Disney (or any organization for that matter) has a responsibility to verify who the caller is before sharing any information. Besides, I suggest that mobile phone numbers are not generally public information.
Obtaining a telephone number is just not enough to provide personal information to a caller. What if I changed my phone number and didn’t report it to Disney? What if someone acquired my phone number and wanted to track me down? What of they were following my children?
I mentioned my concern to the call center representative I spoke with. She didn’t really seem concerned and was told I may want to send an email to report this.
How can this information be better protected?
Disney could ask one more question based on the information they collect during each guest’s visit. Without knowing all of the information Disney collects about their guests, here are a few suggestions:
- When was your last visit?
- Where did you stay the last time you visited?
- Which parks did you go to the last time you visited?
- How many days was your most recent visit?
- How many people where in your party the last time you visited?
- If you are a annual pass holder, what is the number of your annual pass?
A best practice for call center’s protection of personal information
Every organization has a responsibility to protect the personal information their customers give them. Ensuring that a call center requests information to authenticate that a caller may access personal information before providing the information is a fundamental best practice that all organizations should adopt.
Providing personal information prior to properly authenticating the caller should be considered a data breach.