If Your Customer Call Looks Like a Scam, Your Process Is Broken
If a fraudster could copy your customer contact process, spoof your number and ask the same questions, your process is not secure — it is a training manual for scammers.
Brian Walsh
7/3/20264 min read
Are your Process broken?
Why do organisations still think it is acceptable to ask customers for sensitive information during calls the customer did not initiate?
Date of birth.
Email address.
Eircode.
Account details.
Security questions.
All of these can be useful for identity verification. But they can also be useful for social engineering.
That is the problem.
When a company calls a customer unexpectedly and immediately asks them to confirm personal information, it is asking the customer to take a leap of faith. The customer is expected to prove their identity, while the caller has done very little to prove theirs.
From the company’s point of view, this may feel like a standard security process. From the customer’s point of view, it looks uncomfortably similar to a scam call.
And that should worry every business.
Customers are constantly warned not to give personal information to unknown callers. We tell them to be suspicious. We tell them not to trust caller ID. We tell them that phone numbers can be spoofed. We tell them that fraudsters are becoming more convincing, more polished and more persistent.
Then, unbelievably, legitimate companies call those same customers and ask them to confirm sensitive information before explaining the purpose of the call.
That is not good security.
That is not good customer service.
That is bad process design.
It also creates a dangerous inconsistency.
Banks and financial institutions regularly warn customers about impersonation fraud. They tell customers to be cautious. They tell them they will never ask for certain information by email or phone. Then, sometimes, the same institutions send emails asking customers to participate in surveys, click links, verify information or engage with third-party platforms.
The message becomes confused.
And confused customers are easier to manipulate.
If organisations want customers to behave securely, they must design their own communications in a way that reinforces secure behaviour — not undermines it.
The burden of proof is on the caller
When a company initiates contact, the burden of proof should sit with the company.
It is not enough to say, “I’m calling from ABC Company.”
A fraudster can say that too.
It is not enough to call from a recognisable number.
Numbers can be spoofed.
It is not enough to know the customer’s name, email address or partial account information.
Much of that information may already be available through data breaches, marketing databases, previous correspondence or social media.
So why are companies still designing processes that rely on customers trusting an unexpected caller?
A safer approach would be simple:
“Hello Mr Walsh, I’m calling from ABC Company. This is not urgent, and for your security I won’t ask you for personal information on this call. We would like to speak to you about upgrade options on your account. Please call the official customer care number on our website or in your app and quote reference ABC123.”
That immediately changes the dynamic.
The customer is not pressured.
The company is not asking for sensitive data.
The conversation moves to a verified channel.
The customer remains in control.
That is better security and better customer experience.
Think like the attacker
Every customer contact process should be tested with one simple question:
If this call, email or message was sent by a fraudster, would it look almost the same?
If the answer is yes, the process needs to change.
If a scammer could copy the structure of the interaction, spoof the number, claim to be from the company, ask for the same personal details and sound convincing, then the legitimate company has created a playbook for the attacker.
That is not an exaggeration.
Badly designed customer contact processes train customers to accept the very behaviours they are being warned against.
They normalise unexpected calls asking for personal details.
They normalise links in emails.
They normalise vague references to “your account”.
They normalise pressure to verify before understanding the purpose of the contact.
For bad actors, this is a gift.
Consistency matters
This is especially important for banks, telecoms providers, utilities, insurers and any organisation holding sensitive customer data.
You cannot run fraud awareness campaigns telling customers to be vigilant, and then operate outbound call and email processes that look like phishing or impersonation attempts.
You cannot tell customers never to click suspicious links, and then send them survey links from unfamiliar third-party platforms.
You cannot tell customers not to give personal information to unknown callers, and then have your sales or customer care team ask for date of birth and address details during an unsolicited call.
That contradiction weakens trust.
Worse, it weakens the customer’s instincts.
The customer who challenges the caller should not be treated as awkward. They should be treated as someone doing exactly what the company’s own security advice told them to do.
Customer experience is now a security issue
This is where many organisations need to think differently.
Customer experience is no longer just about speed, convenience and satisfaction. It is also about safety.
A poor communication process can expose customers to risk. It can make fraud easier. It can blur the line between legitimate contact and criminal impersonation.
The fix is not complicated. It requires organisations to look at their processes from the customer’s point of view.
Before making an outbound call, ask:
Would I be comfortable receiving this call?
Would I give this information to someone I could not verify?
Could a fraudster copy this process?
Are we reinforcing safe behaviour or undermining it?
Is this conversation necessary, or should we move the customer to a verified channel?
That is the mindset companies need.
Not “how do we get through the script?”
Not “how do we verify the customer quickly?”
Not “how do we maximise offer uptake?”
But:
How do we protect the customer while still delivering good service?
Because if a company cannot prove who it is, it has no right to ask the customer to prove who they are.
That should be the starting point.
The UXY Insight
Many organisations view customer contact, customer service and security as separate disciplines.
Customers don’t.
To the customer, they are all part of the same experience.
Every phone call, email, text message and notification teaches customers what behaviour is normal and what behaviour is expected. When legitimate organisations ask customers to ignore the very security advice they promote elsewhere, they create confusion. And confusion is where fraud thrives.
The most effective customer journeys don’t simply protect company assets. They help customers make safe decisions with confidence. They reinforce good security habits rather than undermine them.
Before introducing any customer contact process, organisations should ask themselves a simple question:
“If a fraudster copied this process exactly, would the customer be able to tell the difference?”
If the answer is no, the process needs to be redesigned.
Good customer experience builds trust. Good security protects trust.