Contact center fraud prevention: the agent who resets the password

Contact center fraud prevention, in a bank, is mostly about one moment: a caller who is not the customer asks an agent to reset a password, change a phone number or add a device, and the agent has a few minutes and a script to decide. The FFIEC's 2021 authentication guidance names that moment directly, and the FBI's November 2025 warning describes criminals working both sides of it, posing as the bank to customers and as customers to the bank. It is hard because the agent sees a polite caller who answers every question, and nothing on the agent's screen shows the login from a new device 38 minutes later. Botminds' Account Takeover Fraud Prevention exists to join those pieces: its agents tie the contact-center reset to the online session that used it, so the fraud team can stop the transfer and reach the real customer before the money leaves.

The worked example on this page is sample data on fictional people at a fictional bank, Corvane National Bank, as it runs through the solution. The research comes from regulators and federal agencies, linked where it appears.

What is contact center fraud? The call that resets someone else's password

Contact center fraud is any attempt to use a bank's phone channel to take money or control: a caller impersonates the customer to reset credentials, change contact details, add a payee or move funds, or a criminal impersonates the bank to talk a customer out of a code. In account takeover, the first kind is the one that makes the agent part of the scheme without knowing it. The FFIEC put it in one sentence in the section of its guidance devoted to call centers and help desks.

"Threat actors frequently have used social engineering and other techniques to deceive customer call center and IT help desk representatives into resetting passwords and other credentials, thereby granting threat actors access to information systems, user and customer accounts, or confidential information."

FFIEC, Authentication and Access to Financial Institution Services and Systems, Section 8, 2021

The reset is the prize because it converts a phone conversation into durable access. A caller who talks an agent into a temporary password does not need malware, a phished session or a stolen device; the bank issues the credential. Every control after it, from device checks to new-payee limits, then sees a login with a valid password. That is why the guidance asks banks to treat the call center as an access channel with its own risk assessment, not as customer service that happens to touch accounts.

How do fraudsters use bank call centers? From both ends of the line

Fraudsters use bank call centers in two directions at once: they call the bank pretending to be the customer, and they call the customer pretending to be the bank. The FBI's public service announcement of November 25, 2025 describes the second direction in detail, and the two often meet in the same takeover.

"A cyber criminal manipulates the account owner into giving away their login credentials, including multi-factor authentication (MFA) code or One-Time Passcode (OTP), by impersonating a financial institution employee, customer support, or technical support personnel," the FBI wrote, adding that the criminal then uses the credentials to log in and "initiate a password reset" (FBI IC3, I-112525-PSA). The code the customer reads out was often sent because the criminal was, at that moment, resetting the password or adding a payee.

Treasury heard the same pattern from the industry. Respondents to its 2024 request for information on AI in financial services warned of "social engineering customer service agents to gain illicit access to legitimate customer accounts or scam customers themselves" (U.S. Treasury, Artificial Intelligence in Financial Services, December 2024). The agent is exposed from the inbound side; the customer from the outbound side. A defence that covers only one of them leaves the other open.

One call, step by step: where the reset becomes a takeover

The clearest way to see the agent's position is to follow one call. At 1:12 PM on a Thursday, a caller reaches Corvane's contact center about Gloria Henshaw's online banking. The call comes from a voice-over-internet number that has never been on her profile. The caller passes three of three knowledge questions, and the agent, Tyler Brandt, issues a temporary password. Nothing he saw was wrong by the script.

Read the steps for what the first agent could not know. The reset looked like hundreds of others that day. What made it a takeover appeared later and elsewhere: a device first seen in Las Vegas, a password changed 28 seconds after login, a mobile number swapped three minutes after that, a payee whose bank account had been opened eleven days earlier. The contact center owns the first step and none of the evidence for it.

The reset, the login and the transfer on one strip

Why knowledge-based questions fail the agent

Knowledge-based questions fail because the answers are no longer secret. Dates of birth, former addresses, mothers' maiden names and the last four digits of a card are the stock of data breaches, and the FFIEC's threat section says breaches at financial institutions, service providers and "nonbanks, such as credit bureaus, have exposed information and credentials of customers and employees" (FFIEC 2021). A caller who passes three of three questions has shown that they did their research, not who they are.

The guidance makes the same point about identity checks in general: "Reliable verification methods generally do not depend solely on knowledge-based questions to verify identity." NIST's 2025 digital identity guidelines, written for federal systems but widely read by banks, go further on the account-recovery side: a provider may offer recovery through "interaction with a CSP agent", with a condition attached: "The use of alternative methods SHALL be based on a risk analysis and documented by the CSP" (NIST SP 800-63B-4). In bank terms, a phone reset is an alternative recovery path, and it should carry a documented risk decision rather than a habit.

In the sample bank's last 90 days, the pattern shows up in the numbers. Of 452 confirmed takeovers, 185, or 41%, began with a phone reset passed on knowledge questions. These are sample figures from the solution's own reporting, not an industry rate, but they illustrate why a contact center that relies on questions alone becomes the cheapest entry point in the bank.

How do you authenticate callers at a bank? Rank the methods by what an impostor needs

Authenticate callers with something the impostor cannot get from a breach or from the caller's own phone: a one-time code sent to a device that was on file before the call, an authenticator application, or a call back to a number the bank already trusts. The FFIEC's appendix lists the options for credential resets: "sending an OTP to a pre-established communication device; using an authenticator application to provide an OTP; biometric voice recognition; enabling secure video chat features to confirm identity; and call-backs to a pre-established phone number."

Every row has a way to fail, so the useful question is how the failures combine. A code to a phone that has been on file for five years, followed by a check that the number was not ported in the last day, is much harder to beat than either alone. Voice deserves a specific warning. Federal Reserve Governor Michael Barr put it this way in April 2025: "Identity verification standards at banks often use voice detection, which may become vulnerable to Gen AI tools" (Barr, Deepfakes and the AI Arms Race in Bank Cybersecurity). A bank that adds voice recognition should treat it as one layer, not as the reason to drop another.

The date on a contact detail is the most underused signal in the contact center. The FFIEC lists a control that identifies "deviations from a customer's or user's usual geographic location or method of communication for the account, such as an Internet-based communication application or an unidentifiable phone number". A caller on a VoIP number the customer has never used is that deviation, and it is visible before the first question is asked.

What should agents do when a caller fails verification, or passes it too easily?

When a caller fails verification, the agent should end the request, not the relationship: decline the reset, offer a path the impostor cannot use, such as a code to the phone on file or a branch visit, and leave a note the fraud team will see. The harder case is the caller who passes. If the call carries a deviation, such as a new number, an unusual hour or urgency about a payment, passing the questions is not enough to reset the password.

Three rules make the agent's job easier and safer. First, never read out an amount, a payee or an account detail before the caller says it; the solution's call script carries that line for the outbound side too. Second, never ask for a password, passcode or full card number, and say so at the start of the call, which is also what the FBI tells customers to expect from a real bank. Third, move risky changes off the call: a reset can be completed by a code to the phone on file, and a phone number change can wait until a code reaches the old number.

The FBI's advice to customers is the mirror of the agent's: "Be suspicious of unknown "banking" or "company" employees who call you; don't trust caller ID. Hang up, verify the correct number, and call it yourself" (FBI IC3, 2025). A contact center that tells customers it will never ask for a code, and then never does, makes the impostor's opening line easy to spot.

Contact center fraud prevention after a takeover: step up that customer's calls

After a confirmed takeover, the customer's own phone channel is the most likely next target, because the criminal already holds their personal data and knows the questions worked. The solution's restore plan therefore adds a step-up to the customer's contact-center profile: in the sample bank's settings, a passcode to the phone on file plus a callback for 90 days, applied as a restore step after a supervisor's check.

The same idea scales to a rule. The strategy agent drafted one from Gloria Henshaw's case: a phone reset requested by a caller on a number not on file needs a passcode to the phone that has been on file for 30 days or more. Back-tested on the sample bank's last 90 days, it would have stepped up 171 of the 185 phone-reset takeovers, 92%, at a cost of about 2,300 more step-ups a month, 4.1% of 56,000 phone resets. The cost line is the solution's estimate on sample data; the point is that the trade-off is shown before anyone approves the rule, and the approval sits with the strategy manager and model risk.

Where the sample bank's takeovers began, and the step-up rule drafted from them

What training do contact center agents need?

Contact-center agents need training on the reset process itself, on how impostors behave on the phone and on what to do with a call that feels wrong, and they need it tested, not just delivered. The FFIEC's appendix asks for it plainly: "Call center personnel are trained on verification and authentication processes for password resets." It also suggests testing staff with simulated social engineering campaigns and adjusting the training to the results.

Training also has a limit that leaders should say out loud. A well-trained agent still sees one call. The tell in the sample case, a temporary password used from Las Vegas by a customer whose 1,412 logins over six years all came from Ohio, was never going to be on the agent's screen. Training lowers the number of resets that go wrong; it cannot find the ones that already have.

Who sees what in Account Takeover Fraud Prevention: the agent, the analyst, the customer

Contact center fraud prevention works when the people around the call see the same story at the same time. Today, each sees a slice. With Account Takeover Fraud Prevention, the reset is joined to the session that followed it, and each role keeps the decision that is theirs.

The outreach call is where the contact center gets its second chance. In the sample case the contact center fraud specialist, Luis Ortega, calls Gloria on the mobile number on file since March 2019, says first that he will never ask for a password or passcode, and asks about her last debit card purchase, a question the criminal cannot answer from breached data. She did not call the bank. She had typed her password into a page a text message sent her to.

The outreach call goes to a number the criminal did not choose

The contact center is not the only place a takeover starts. In the sample bank's 90 days, a third began with a phished password and passcode and one in seven with a mobile number port, the subject of the guide to SIM swap fraud prevention. What the FFIEC expects across all of these channels is set out in the guide to the FFIEC authentication guidance, and how the analyst decides between asking and holding is in the guide to account takeover fraud detection. To see the reset joined to the login on your own past cases, start from Account Takeover Fraud Prevention.

Questions people ask

How do fraudsters use bank call centers?

They call the bank posing as the customer to reset passwords, change phone numbers or add devices, and they call customers posing as the bank to talk them out of one-time codes. The FBI's November 2025 warning describes criminals impersonating "a financial institution employee, customer support, or technical support personnel" to get login credentials and codes. The two often meet in one takeover: the code the customer reads out was sent because the criminal was resetting the password at that moment.

Are knowledge-based questions enough to verify a caller?

No. The answers to most knowledge questions are available from data breaches, and the FFIEC expects reliable verification to rest on more than such questions. In the fictional sample bank, 41% of confirmed takeovers over 90 days began with a phone reset passed on knowledge questions alone.

What is social engineering in a call center?

It is a caller manipulating an agent into doing something the real customer would have to authorise, most often resetting a password, changing contact details or skipping a check because the caller sounds distressed or in a hurry. The FFIEC's 2021 guidance has a section on it, and Treasury's 2024 AI report records industry concern about AI tools making such calls more convincing.

Does the FFIEC guidance cover call centers?

Yes. Section 8 of the 2021 guidance covers call center and IT help desk authentication, and its appendix lists controls including enhanced authentication for credential resets, detection of unusual phone numbers, handling of changed phone numbers or carriers, and training on the password reset process. The guidance gives examples of effective practice; it does not set a checklist of required controls.

How do you prevent call center account takeover?

Put enhanced authentication on resets and contact changes, send codes only to contact details that predate the call, flag calls from numbers never on the profile, and join the reset to what happens online afterwards. The last step is the one a contact center cannot do alone: in the sample case, the proof that the caller was an impostor was a login from Las Vegas 38 minutes after the call.

Can a callback to the number on file be trusted?

Only if the number predates the suspicious activity. Criminals often change the mobile number first, so the "number on file" can be theirs by the time anyone calls. Account Takeover Fraud Prevention dates every contact detail and, in the sample bank's settings, contacts only details on file 30 days or more before the first suspicious step.