Hacker News new | ask | show | jobs
by iamleppert 1386 days ago
It’s called CTI in industry — computer telephony integration. Normally well run firms will have CTI setup properly to transfer IVR data to an agent.

Sometimes however agents are trained to distrust this information as there are ways to spoof or attack the system. One easy way is to call a victim and pretend to be the company, then “3 way” them in with the IVR of the real company, have them verify, then disconnect them and take over, ask to transfer to an agent and you have full access to do whatever you want to their account (if the agent doesn’t re-verify). For this reason, 99% of the time financial institutions already have CTI data but will always do re-verification.

2 comments

If they don't trust it, why have the automated system ask for it in the first place?
Don't think about it as not trusting, it's "Trust but verify".

Try to imagine such a scam being pulled and now the company has to answer questions on "why weren't further verifications done? So anyone with a benign number can just do whatever with my account?"

I'm sympathetic to the annoyance of long phone queues but this extends to the support teams that can do everything "right" and still end up raked over the coals because they got social engineered by a scammer or a customer shared what should have been a secret a bit too publicly.

I've dealt with both sides of the concerns in previous jobs in Support orgs, and there is rarely middle ground between "Why do I need to enter the information repeatedly?" and "Why did you work with this person just because they gave a correct number? Our private information may have been exfiltrated!" The latter is better to optimize for IMO as the worst result of failing on the former is that you get complaints. Failing on the latter means a potential data breach incident.

Scam-detection training is done typically for support teams, but it's not perfect, and often a few sanity checks are enough to catch or stop most scams and ensure you're talking to someone actually authorized to be contacting regarding the information.

For analytics, reducing load on call centers by servicing common requests via IVR, call routing, improving call readiness times —- it takes time to find/lookup accounts.

The most critical metric for customer service focused call centers is first call resolution. Customers who call in for the same issue or department on the same day are tracked via the IVR and those metrics are used to decide what the IVR should actually do.

They're probably optimizing your initial rank in the queue depending on perceived customer value/risk of churn. It's OK for this to be wrong occasionally, so the quality of implementation probably matches this requirement. ;-)

But I agree wholeheartedly. It should work and make things smoother. Instead it makes an already painful customer care experience worse.

I used to build such system.

Programmers aren’t always very good. And may not know how to carry information end to end during a call.

Their could be multiple systems involved that make it harder.

Their may be significant delays of when info pops up for the agent. So it’s faster to ask.

The ordering software may not be properly integrated.