Call centers are under siege from fraudsters who exploit the weakest link in many organizations’ security: the phone channel. Phone calls can be vulnerable to SIM swaps, spoofs, and manipulation, making it difficult to trust who’s really on the line. At the same time, agents are often expected to verify callers using little more than a few personal details or one-time codes.
One high-profile example: in 2021, Coinbase faced an extortion attempt after attackers manipulated support agents through the company’s contact center. Although Coinbase acted swiftly to contain the threat, the incident revealed how even sophisticated companies can be exposed when authentication relies on human judgment and outdated methods.
In this post, we’ll explore the tactics fraudsters now use against contact centers, why traditional defenses like OTPs and knowledge-based questions are no longer sufficient, and what it takes to truly protect your customers, data, and reputation.
Why Fraudsters Target Call Centers
Call centers are attractive to fraudsters because they offer something digital channels often don’t: a human on the other end who can be manipulated. Attackers know that if they can bypass or confuse identity checks, especially under time pressure, they may gain access to sensitive accounts, reset credentials, or authorize high-risk changes.
Some key reasons contact centers are vulnerable:
- Voice is easy to fake: With tools like CLI spoofing, attackers can mask their number to appear as the customer’s. Deepfake audio adds another layer of deception.
- Phone numbers can be hijacked: SIM swap attacks and number porting fraud give criminals control over the victim’s mobile line, often used to receive OTPs.
- Agents rely on static information: Security questions, birthdates, or account details can often be gathered from breached data or social media.
- There’s pressure to deliver fast service: Agents may skip steps to keep handle times low or avoid frustrating customers.
- Legacy systems and fragmented tools: Many centers still use outdated authentication flows that weren’t built to resist today’s threat landscape.
In short, fraudsters target call centers not because they’re weak, but because they rely on trust and people. And that’s where modern attacks thrive.
Evolving Fraud Tactics in Contact Centers
Attackers today don’t just guess passwords, they run coordinated campaigns that blend stolen data, spoofed signals, and social engineering to defeat call center defenses.
Here are the most common and dangerous tactics used today:
SIM Swap Attacks
Fraudsters convince a mobile provider to transfer a victim’s number to a SIM card they control. Once done, they receive all calls and texts, including OTPs used for account access or verification.
CLI (Caller Line Identification) Spoofing
Attackers spoof their phone number to make it appear as though the call is coming from a trusted or known number, tricking agents into trusting the caller’s identity without deeper verification.
Phishing & Pretexting
Using leaked or scraped data, attackers impersonate a customer with convincing backstories. They may combine this with pressure tactics or emotional appeals to bypass verification steps.
Synthetic Identity Fraud
Bad actors create entirely new identities using combinations of real and fake data. These synthetic identities may pass credit checks and basic KYC but are used to open and exploit accounts, sometimes for months, before detection.
Voice Cloning and Deepfakes
With the rise of AI tools, attackers can clone a target’s voice using just a few audio samples. This can be used to pass passive voice biometric systems or to socially engineer agents during live calls.
As these tactics become more advanced, traditional defenses like OTPs, security questions, or even voice biometrics are no longer enough.
Call centers need authentication methods that can’t be guessed, spoofed, or faked, and that’s where modern approaches like verifiable credentials come in.
Where Traditional Fraud Controls Fall Short
Many organizations still rely on legacy fraud controls that were designed for a different era, one where data wasn’t so easily breached, phones couldn’t be spoofed, and social engineering wasn’t automated with AI. Unfortunately, these traditional approaches now offer little resistance against modern attack techniques.
Knowledge-Based Authentication (KBA)
Asking callers to confirm their date of birth, address, or last transaction may feel secure, but this data is often already exposed in public leaks. Attackers can easily script or guess their way through these checks, especially with information sourced from social media or dark web databases.
One-Time Passwords (OTPs)
Sending a code via SMS or email adds a layer of friction, but not necessarily security. If an attacker has taken over the customer’s number (via SIM swap) or email account, they’ll receive the code directly. Worse, OTPs can be phished in real time using fake login pages and automated tools.
Voice Biometrics
Biometric systems can sound cutting-edge, but they’re only as strong as their input signal. Background noise, voice changes, and deepfake audio all undermine the reliability of voiceprint matching. False positives and negatives are still common, and high-stakes decisions can’t afford that ambiguity.
Agent-Driven Trust
When agents are responsible for interpreting signals and making judgment calls under pressure, they become a vulnerability. Social engineering tactics like urgency, impersonation, or emotional manipulation are designed to exploit human error, especially when agents are juggling speed targets and scripted flows.
In short: legacy fraud controls were built to verify information, not people. And in today’s threat landscape, that distinction makes all the difference.
5 Core Principles for Call Center Fraud Prevention
To stop modern fraud without sacrificing customer experience, organizations need to move beyond patchwork defenses and adopt strategies built for real-world threats.
These five principles form the foundation of a modern, effective fraud prevention approach for contact centers:
1. Shift Trust Away from the Agent
Agents shouldn’t be expected to validate identities using scripts, instincts, or shared data. The more verification steps they own, the more fraud risk the organization carries. Instead, delegate authentication to pre-call workflows and systems that verify identity cryptographically or biometrically, not verbally.
2. Use Multi-Signal Authentication
No single factor is enough. Combine something the customer has (e.g. a device or verifiable credential) with something they are (e.g. biometrics) and a secure channel (e.g. your mobile app). This closes common attack paths like phishing and SIM swap, while keeping friction low for legitimate users.
3. Minimize Exposure of PII
Every time a customer has to say their address, ID number, or account detail aloud, you increase risk, for them and for your compliance team. Modern authentication flows should validate identity without requiring personally identifiable information to be spoken, stored, or handled by the agent.
4. Authenticate Before the Call Reaches the Agent
Don't wait until the agent picks up the phone to start verification. Use pre-call workflows, such as sending a push notification to your mobile app via the IVR, to confirm the caller's identity before they’re routed. The caller would have to biometrically unlock your app, providing an assurance that you’re dealing with the right person. This reduces both fraud risk and average handle time.
5. Audit and Monitor Continuously
Even with strong authentication in place, fraudsters probe for gaps. Use real-time analytics and fraud detection tools to monitor for anomalies across call metadata, voice patterns, failed verifications, and device fingerprints. Combine this with post-call forensics to refine your defenses over time.
Solution Landscape: What Works and What Doesn’t in Call Center Fraud Prevention
Many contact centers still rely on outdated methods to verify callers, each with its own security blind spots. Let’s walk through the most common ones and how they measure up in today’s fraud landscape.
Knowledge-Based Authentication (KBA) is one of the weakest defenses. It typically involves asking the caller to recite personal information like a birth date, postcode, or account history. But with so much of this data available through breaches or social media, fraudsters can often guess or script their way through these questions. While easy to implement, KBA offers very low fraud resistance.
One-Time Passwords (OTPs) and basic multi-factor authentication (MFA) are a step up, but still far from secure. Attackers use SIM swap attacks or phishing pages to intercept OTPs in real time. In most cases, these methods only prove that someone has access to a device, not that they are who they claim to be.
Voice biometrics can improve user experience by authenticating passively during the call. However, they’re increasingly undermined by deepfake audio, replay attacks, and environmental noise. Accuracy can suffer across accents, health conditions, and call quality, making it risky for high-assurance use cases.
Verifiable credentials offer the strongest and most secure way to confirm a caller’s identity. With this approach, the caller uses the company’s mobile app (like a bank or telecom app) to quickly prove who they are, just by tapping a push notification and unlocking it with their fingerprint or Face ID. There’s no need to answer security questions or read out codes. The system confirms their identity automatically, so the agent can trust who’s on the line, without ever hearing or seeing personal information. The only requirement is that the customer has the company’s app installed on their phone.
Real-World Example: How Telefónica Tested a Fraud-Resistant Flow
In a pilot led by GSMA, Telefónica Tech, and Dock Labs, a new approach to caller authentication was tested.
Instead of asking customers to answer security questions or read out codes, the system sent a push notification directly to the customer’s mobile app. When the customer tapped the alert and unlocked it with their fingerprint or Face ID, the call center instantly received a verified confirmation of their identity. No passwords, no spoken personal details, and no guesswork for the agent.
The process used verifiable credentials, which are secure digital proofs of identity issued by the company. These credentials can’t be copied, faked, or used by anyone else.
The result? Faster calls, fewer fraud risks, and a better experience for both customers and agents. Even better: the customer didn’t have to download anything new. The wallet can be built right into the company’s existing mobile app.
Building a Modern Call Center Fraud Prevention Framework
Preventing fraud in today’s contact centers takes more than just adding new tools, it requires rethinking how identity is verified from the ground up. Here’s how leading organizations are modernizing their fraud defenses without sacrificing speed or customer experience:
Embed authentication into your mobile app
Make your existing app the trusted gateway for identity verification. By enabling ID wallet-based approvals and biometric confirmation, you can authenticate users securely before the call even begins, no questions or codes required.
Replace knowledge-based checks with verifiable credentials
Move away from asking callers to repeat sensitive information. Verifiable credentials allow you to confirm identity with cryptographic proof, meaning agents never need to see or handle private data.
Add biometric proof of presence
Face ID, fingerprint, or device unlock ensures the person on the other end is physically present, not just in control of a number or account. Combined with credentials, this creates a highly secure flow.
Pre-authenticate before routing the call
Instead of verifying identity mid-conversation, use the IVR (interactive voice response) system to trigger a secure push notification. This keeps fraud from ever reaching the agent while also saving time.
Integrate monitoring and analytics tools
Pair strong authentication with real-time monitoring for anomalies, such as unusual call patterns, mismatched device IDs, or repeated failures. These signals help detect and stop sophisticated fraud attempts before damage is done.
Design for privacy and compliance
Choose call center authentication solutions that avoid exposing or storing personal information. This reduces your attack surface and helps meet regulatory requirements like GDPR, and regional telecom or banking standards.
These kind of layered, privacy-first call center authentication best practices doesn’t just prevent fraud, it also speeds up calls, improves agent confidence, and builds trust with customers.
Key Takeaways
- Call centers are a growing target for fraud, with attackers using tactics like phishing, SIM swaps, and voice spoofing to bypass outdated identity checks.
- Traditional methods, such as security questions and OTPs, can’t keep up with today’s threat landscape. They’re slow, vulnerable, and often put agents in a risky position.
- Preventing fraud requires a shift in approach: verifying identity securely and privately, without relying on shared secrets or human judgment.
- Verifiable credentials and biometric confirmation, delivered through your organization’s mobile app, offer fast, secure, and privacy-preserving caller authentication.
- In a pilot with GSMA and Telefónica Tech, this method was proven to cut fraud risk, reduce handle time, and remove the need for agents to collect sensitive information.
FAQ: Call Center Fraud Prevention
1. Why are call centers targeted by fraudsters?
Because they rely on people. Attackers exploit phone-based support channels using tactics like phishing, SIM swaps, and caller ID spoofing to trick agents into granting access or resetting accounts.
2. Are security questions and OTPs still effective?
Not really. Most personal data used in security questions can be found online or in data breaches, and OTPs can be intercepted through SIM swap or phishing. These methods provide limited protection today.
3. What’s the risk with voice biometrics?
While convenient, voice biometrics are vulnerable to deepfake audio, environmental noise, and spoofing attacks. False positives and negatives make them unreliable for high-assurance situations.
4. How do verifiable credentials prevent fraud?
They let call centers authetication customers by proving who they are using secure digital credentials, confirmed with biometrics via your mobile app. There’s no need for passwords or spoken data, and nothing can be faked or phished.
5. Can this be added to our existing mobile app?
Yes. Solutions like the Truvera Call Center Authentication solution embed directly into your organization’s app using a lightweight SDK and API, allowing you to roll out strong caller verification without disrupting your infrastructure.
