Topic starter
24/06/2026 8:38 pm
TL;DR: Call center account takeover is increasingly driven by social engineering, and 1Kosmos says TransUnion reports more than half of ATO attempts now originate there, while knowledge-based authentication fails because exposed personal data no longer stays secret. Legacy verification assumptions are collapsing under modern recovery workflows.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “Modernizing Call Center Identity Verification with Biometrics”.
Key questions
Q: What should teams do first when call center KBA is still in use?
A: Start by removing KBA from the highest-risk flows first, especially password resets, account recovery, and any interaction that can change authentication state.
Q: Why does KBA create both security and customer experience problems?
A: KBA fails on both sides because the answers are often exposed or forgotten.
Q: What are the signs that call center identity verification is failing?
A: Common warning signs include rising high-risk calls, more spoofed caller activity, increased abuse of password reset and account change requests, and greater reliance on agent judgment instead of verified factors.
Practitioner guidance
- Replace KBA in recovery flows Remove security questions from password reset, account recovery, and other high-risk call center steps.
- Bind verified identities to future support sessions Create a governed enrollment process that links a high-assurance verification event to a reusable caller identity.
- Minimise agent exposure to personal data Design workflows so agents receive only the verification result they need to proceed.
Bottom line: Call center verification has become a security control because social engineering targets the human support path when digital controls are harder to bypass.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:21 am
KBA is no longer a defensible assurance model for sensitive support workflows: It was built for an era when personal facts were harder to collect and replay. That assumption fails when attackers can buy, scrape, or infer the same data faster than support teams can verify it. The implication is that call center governance has to move from knowledge testing to identity-backed proof.
A few things that frame the scale:
- Gartner predicts that by 2026, 30% of enterprises will consider identity verification solutions unreliable in isolation because of AI-driven attacks.
A question worth separating out:
Q: How should organisations govern reusable identity binding in support channels?
A: Treat the bound identity as a lifecycle-controlled trust object. Define when enrollment is allowed, how long a binding remains valid, what events force re-verification, and how revocation works if compromise is suspected. Without those rules, reusable verification becomes another permanent access path instead of a security control.
👉 Read our full editorial: Call center identity verification is moving past knowledge-based auth