What should fraud teams do when a customer is willing to call in but cannot reliably answer verification questions?

Why this pattern should slow the review down

A customer who can join the call but cannot reliably answer a basic verification question has created a mismatch worth treating as signal, not reassurance. The phone channel adds social pressure and information recovery opportunities for fraudsters, so the key test is not whether the caller sounds plausible, but whether they can stay consistent about the transaction and context without coaching.

That matters because fraud review is often decided by coherence under light pressure. A genuine cardholder may be flustered, but they should usually be able to anchor to the same order, device, merchant, or timing details across the conversation. When the story drifts, the safest assumption is that the caller may be using access to the phone line, not legitimate knowledge of the account.

• Anchor the interaction to one transaction and compare every answer against that same reference point.
• Watch for inconsistency between what the caller says, what the channel already shows, and what they can repeat without prompting.
• Treat repeated deflection, vague answers, or “I do not remember” responses as a reason to pause rather than to simplify the check.

How teams should interpret consistency, not just confidence

The practical mistake is to equate willingness to call with trustworthiness. Fraudsters frequently prefer live contact because they can improvise, exploit uncertainty, and push for exceptions. A strong review process therefore tests for stable recall of transaction-specific facts, not for polite engagement or familiarity with the script.

Consistency should also be read alongside phone-line risk. If the caller reached the team through a number that may be compromised, diverted, or socially engineered, then conversational confidence becomes less useful than independent verification of possession, history, and context. In that setting, a clean-sounding call can still be the wrong signal.

OWASP ASVS is useful here because its authentication and session controls reflect the broader principle that trust should be based on verifiable signals, not the user experience of the interaction alone. For fraud programs that want a transaction-specific control baseline, OWASP API Security Top 10 is also a helpful reminder that weak authorization decisions often begin with over-trusting an apparently valid request.

Practitioner Guidance

What to verify: Ask whether the caller can repeat the same transaction details without prompting and without contradiction. If they can answer only broad account questions but not the specific event under review, that is a meaningful downgrade in confidence.

Decision rule: If the caller cannot reliably anchor to the same order or timeline, keep the hold in place and escalate for secondary review rather than treating the phone call as a sufficient proof point. The phone channel should reduce uncertainty, not replace verification.

Common mistake: Teams sometimes reward cooperative behavior and mistake it for legitimacy. In fraud review, a calm tone, a quick answer, or a willingness to stay on the line is only useful when it is paired with stable, transaction-level consistency.

Practitioner takeaway: Use the call to test coherence, not to generate comfort. The decisive question is whether the caller can hold a single credible story about the transaction when the conversation moves from scripted checks to specific recall.

Related resources from NHI Mgmt Group

• What should security teams do first when they cannot answer AI risk questions confidently?
• What should teams do when a suspicious login is detected but the customer cannot complete the original verification step?
• Should customer identity teams use fraud trends to prioritise controls?
• How should fintech teams embed fraud controls without creating too much customer friction?