Why do KBA-based contact-centre checks create refund and gift-card fraud risk?

Why KBA turns a contact centre into a fraud channel

KBA-based verification depends on facts that are supposed to be private, but in practice those facts are often available through breaches, data brokers, public records, social media, or purchase histories. In a contact-centre setting, that means the gate is not testing possession of a real credential, only recall of information an attacker may already know or can cheaply assemble.

For refunds and gift cards, that weakness matters because the contact centre is usually trusted to make account changes, reverse payments, or issue value quickly. A successful KBA pass can therefore unlock actions that have immediate monetary impact, especially when the caller sounds plausible, knows recent transaction details, or presents partial account data.

How attackers convert weak caller verification into loss

The fraud path is straightforward: obtain enough personal data, pass the static questions, then persuade an agent to perform a high-value action. The attacker does not need to defeat the entire account, only the human process that authorises refunds, balance transfers, address changes, or gift-card issuance.

This is why KBA is especially dangerous in environments where the same verification step is used for both routine service and exception handling. Once the caller is treated as authenticated, the agent may skip deeper scrutiny, and the fraudster can use urgency, confusion, or partial legitimacy to push the transaction through before checks catch up.

Modern verification guidance increasingly treats digital identity assurance as stronger than knowledge-based challenge questions because shared facts are no longer a reliable proof of the caller’s identity. For higher-risk service actions, the right control is a verifier that depends on a separate factor, not information the attacker can collect offline.

Why refunds, gift cards and recovery workflows are the highest-risk targets

Refunds and gift-card issuance are attractive because they are fast, reversible only in theory, and often processed by staff under service-pressure conditions. Account recovery is equally sensitive, because once an attacker controls the recovery path they can reset credentials, redirect notifications, and widen access to payment or loyalty value.

Where contact-centre flows still rely on static data, the organisation is effectively accepting that possession of leaked personal facts is enough to trigger trust. That creates a predictable fraud pattern: the more a process can move value, restore access, or override an existing restriction, the more valuable it becomes to an attacker who can pass KBA.

The issue is not limited to one control failure. Contact-centre fraud often combines social engineering, breached data, and weak escalation rules, so the verification method, agent script, and approval threshold all need to be assessed together. FinCEN guidance on fraud and money movement is useful context where refund abuse intersects with broader financial-crime monitoring and suspicious-activity review.

Risk and Threat Considerations

KBA creates a material exposure because its challenge material is commonly obtainable at scale, which means the fraud barrier fails before the caller ever reaches the agent. Once one question set is compromised, the attacker can reuse that knowledge across multiple calls, multiple brands, or multiple recovery attempts until the process accepts them.

Failure mechanism: Static questions rely on secret-like facts that are no longer secret, so the contact-centre verifier confuses data availability with caller legitimacy. Attackers then use the trusted channel to obtain refunds, gift cards, or recovery actions that should have required stronger proof.

Impact: Organisations face direct financial loss, account takeover risk, customer support abuse, and a higher chance that legitimate dispute handling is overwhelmed by fraudulent claims. The broader consequence is loss of trust in the service desk as a safe authorising channel.

Practitioner Guidance

What to prioritise: Treat any contact-centre path that can move money, change delivery details, or reset access as a high-risk authorisation flow, not a routine support interaction. The verification bar should rise with the value of the action, not stay fixed because the caller reached a human.

What to verify: If you still use KBA anywhere, verify whether the answers can be sourced from public, breached, or brokered data in under a few minutes. If they can, assume the control is already compromised for fraud purposes and move those workflows to stronger caller verification and step-up approval.

Decision rule: When a caller is requesting a refund, gift-card issuance, or recovery override, require a process that is independent of static personal facts and that leaves an auditable trail for later dispute review. The key judgement is whether the agent is authenticating a person or merely matching fragments of data.

Practitioner takeaway: KBA fails in contact centres because the attacker does not need to steal the person, only the facts; once those facts are public, every high-trust exception process built on them becomes a fraud opportunity.

Related resources from NHI Mgmt Group

• Why do traditional credential based identity checks create more fraud risk than biometric verification?
• Why do geolocation-based fraud checks create risk for airline and OTA transactions?
• Why do passwords and voice based checks create more risk in deepfake fraud scenarios?
• Why do non-human identities create more risk than many human accounts?