EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.
How EY can help
-
Forensic Investigations & Crisis Management Services team provides complete crisis and incident response solutions. Team of former law enforcement, forensic accountants.
Read more
As call center agents are the gatekeepers to various critical organization assets (e.g., confidential data, network systems and customer account information), they are a key vulnerability to the organization. Fraudsters specifically target call center agents that may be experiencing financial pressures and/or are not well-versed in the latest fraud trends leading to a continued increase in recruiting schemes and abnormal behavior:
- Bad actors recruiting agents through social media to participate in scams or provide non-public information (e.g., standard operating procedures, customer information) for monetary “bonuses”
- Agents assigning specific cases to themselves to circumvent authorization policies and/or avoid others from detecting their misconduct
- Agents reflecting higher than average call times and/or accessing more customer profiles than expected (e.g., Receiving calls from fraudster to coordinate and/or share information)
- Agents with higher throughput and higher fraud/error rates indicating a lack of training or skipping steps in procedures
Organizations continue to enable hybrid work environments which limits oversight and fosters a need for programs that incorporate insider risk management and enhanced mitigation, detection, and investigation processes. Outdated controls, like one-time passwords and knowledge-based authentication that can be bypassed by bad actors and insiders, no longer provide substantial security to customer accounts, furthering the need for more advanced authentication tactics, such as multifactor and in-app authentication.
Key points for fraud risk mitigation to consider
- Identify high-risk personnel within the organization that have access to sensitive information and may be susceptible to insider threat risk.
- Provide clear guidance on how to identify and report insider threats, keeping employees current on emerging fraud risks or other related company policies.
- Establish robust active monitoring technology to detect insider threats and emerging risks including abnormal agent behaviors or performance shifts that may indicate increased vulnerability to fraud.
- Monitor social media and collaborate with peers to quickly identify, communicate, and respond to targeted fraud campaigns.
- Train agents to identify suspicious patterns, such as repeated failed authentication attempts or unusual call behavior, reinforcing that successful authentication doesn’t prove legitimacy.
- Implement protocols for agents to escalate and report suspected fraud, enabling rapid response including all relevant key stakeholders.