Government Call Centers Need a New Approach to Emerging Fraud Threats

Scoop News Group, Executive Insights: How a multi-layered defense helps agencies see fraudster interaction.

Hosted by Wyatt Kash, in conversation with Greg Schlichter, Director, Research & Consulting, TransUnion

Wyatt Kash: Welcome to our series on building trust in government communications. In our last discussion, we examined why phone transactions have proven especially difficult for verifying callers’ identities and have become a weak point for hackers to exploit and a source of inefficiency for agencies. With social security numbers and passport information and digital footprints widely available on the dark web, the challenge has moved beyond simple identity verification to a complex risk management scenario.

Today we're diving into how a multi-layered defense leveraging authoritative data sources and FedRAMP ready tools allows agencies to look past the static data of fraudster might hold to see the true risk of the interaction.

I'm Wyatt Kash with Scoop News Group and here to unpack some of the ramifications of those challenges and how federal agencies are working to improve the level of trust with inbound and outbound phone calls is Greg Schlickter, Director Research and Consulting at TransUnion. Greg, thanks so much for joining us.

Greg Schlichter: Thanks for having me.
 

Why account protection is the next battlefield

Wyatt: One of the places I'd like to start with is in our recent interviews with your colleague Scott Straub, we discussed the challenge agencies are facing in getting citizens to answer the phone. And but tell me why does protecting the account after the call connects become really the next major battlefield?

Greg: As agencies make the considerable investment to, we'll say, retake control of the phone channel and get people picking up their phones again, that starts to normalize major portions of the customer journey happening over the phone. And when that happens, as we've seen when things started to move online and in other forms, fraud tends to follow. And so agencies need to make sure that they're essentially protecting the investment that they've made by making sure that nobody gets too lax, right? Technology changes, fraud schemes change, even the vectors fraudsters are exploiting evolves with the time and adapts. And we need to make sure that agencies again after having made considerable effort to reach people over the phone and again get that two-way communication going for legitimate business is protected moving forward.
 

How fraudsters exploit leaked PII and AI

Wyatt: And then next I think you know with social security numbers and personal addresses and phone numbers so commonly linked in data you know how do fraudsters actually use this information to manipulate contact center agents and interactive voice response systems?

Greg: It's I wouldn't want to be in a call center right now. It's a tough time. You know, when we're thinking about something like social security numbers, dates of birth, general PII, that's very different than something like a password or an email address being leaked because those are persistent credentials. I can change my email address. It's a bit of a pain, but I can do it. I can change my passwords. I can't really change my social security number. And what that creates is once PII has been exposed and it's out there, that is a durable source of information, a persistent attack surface that bad actors can and do exploit.

When you factor in, you know, we're talking about phone interactions, live interaction has always been the weak point in remote interactions, right? and fraud tends to follow the path of least resistance. So, it's no surprise hackers are or not hackers, fraudsters, we'll say, are beginning to exploit call centers. Now, what is what they can do to impersonate and trick an IVR or scripted controls or call center agent? They can certainly defeat naive identity verification schemes, right? They know the right combination of name and social security number and date of birth. They can even probably bypass, you know, KBA, knowledge-based authentication. It gets particularly scary now when you start to factor in AI and what a motivated bad actor can do.

You know, it's not just having an AI agent listening in on the call and prompt you for how to respond to different challenges or guide a conversation in a way that helps you socially engineer a call center agent. You can also have real-time AI that if you're doing like a video chat can change your appearance and look very realistic. You can have AI that either masks or amplifies an accent. So maybe I'm calling from overseas, but I'm pretending to be John from Iowa. I can have that neutralize my accent and the person on the other end is going to be none the wiser.

Wyatt: Well, it sounds like it really gives the con artist even more tools to be a supreme con artist, right?

Greg: It certainly does.
 

Real-time corroboration versus static identity data

Wyatt: Well, I know that TransUnion emphasizes data that is continuously corroborated. And I'm curious, how does that differ from traditional identity management systems? And how does this platform really help an agency distinguish between a real person and a hacker who happens to have all the right PII?

Greg: Traditional identity management systems tend to be built on the assumption that many of these identity elements don't change over time because they're built to handle, you know, they're built to map a social security number to a name to a date of birth maybe to an address and those things don't tend to change all that often. What we have is a network of hundreds of authoritative data providers who do provide real-time updates beyond just identity information. An example could be phone number information. So was the phone number calling into a call center? Was this recently disconnected or reassigned? What carrier is it coming across? Does it have the hallmarks of being spoofed or not? You can use all this information, you know, they tend to be weak signals on their own, but you can combine them into a strong signal and use that to, you know, I don't want to say 100% accurate, 100% accurately identify all of the risky traffic coming into a call center, but you can certainly use it to apply different step up workflows to offer more friction where things seem to be misaligned.

And what's important is you're doing that in real time because think about it. I could call my carrier today and have my phone number reassigned, right? Or I could use a VOIP service and just keep using a new number over and over again until you know, I finally get hold of the right person in a call center and I'm able to exploit them.
 

Where phone fraud is headed

Wyatt: Interesting and then as you look at TransUnion and other fraud data that's out there and the growing use of AI in general to enhance and scale impersonation, what sticks out to you about the phone fraud and where it seems to be headed as a method of attack?

Greg: Sure. I think again as agencies really begin to invest in phone as part of their digital transformations and we see that normalization happen where more business is being conducted over the phone. Fraud will follow. I think we're going to see an increase in government impersonation scams. people calling you may be using a spoofed agency number, spoofed agency name, those sorts of things to target people because they'll be predisposed to believing it's legitimate. I believe though the nature of those fraud schemes, kind of what they're after is going to change where a lot of times you hear about impersonation scams and they are designed to essentially financially impact people, right? They are designed to scare you into paying bail for your son in the form of Target gift cards or something like that. And what I believe we're going to see begin to emerge, and we're starting to see signs of this in our internal data, is fraud is going to be targeting getting just additional PII, maybe specific information about somebody's government benefits to further facilitate either account takeover or benefits redirection.

Which I think is an important thing for agencies to start to consider because right now many times they are insulated from a lot of the fraud that's happening a government impostor fraud I should specify. Again, if I call you and say I need you to pay off these back taxes that don't exist and I'm using the IRS's name and phone number you empty your bank account and pay me the IRS really isn't impacted. There's certainly some brand deterioration and erosion of trust, but they're not on the hook for that.

Now, we're seeing these scams targeting consumers as a steppingstone to then scam the agency, right? I'm going to target you. I'm going to get your Medicare information and then I'm going to use that to maybe start submitting false claims against Medicare. And that's where it really becomes a problem.

And so I think a slight reorientation towards that that I wouldn't even say over the horizon but you know future form of fraud and how it will begin to directly impact agencies is something that needs to be seriously considered and I don't think it quite is yet.

Wyatt: I'll just add that I know there was a documented case of a help desk where a doctor or someone pretending to be a doctor working at a medical institution happened to call in and say I need my credentials changed. And the help desk if a person wasn't on the ball could have not only provided that information but then allowed that actor or fraudster to escalate additional credential information to really exploit the whole system. Right. And you know thinking how easy that has become is a scary thought, right?

Greg: And you think about certainly there's exposure to fraudulent claims and things like that, but you also have to think about if this person has medical credentials, can they start prescribing medicine to people? I mean there there's consumer harm like actual health harm that could happen because of help desk targeted fraud, right?
 

The role of device intelligence

Wyatt: Absolutely. Well, talk to me a little bit more about so why it’s important that agencies have not only the necessary tools to validate users’ credentials, but you know, also to have access to device intelligence to establish trust in transaction. I don't think we talked quite enough about that.

Greg: Devices give off a lot of what I think of as digital exhaust, right? Every device more or less can be uniquely fingerprinted in a way that is difficult for a bad actor to obfuscate. And so when you begin to think about the ways you can incorporate device intelligence into a call center flow, you know, you begin to factor in risk signals like this, you know, how many transactions has this device initiated in the past couple of minutes or past couple of hours? How many accounts is it associated with? How many different IP addresses has it used? Where's the device located and where should it be located based on who we think is calling. Right?

If the device is pinging a tower in Virginia and the person claims to live in California, maybe that you know people travel, maybe that's a legitimate thing, maybe it's not. The real I think benefit though of using device risk comes in when you consider the network effects of using a third-party provider who can establish a consortium of users who begin to share information. Right?

Any agency, any call center, can start to log these, you know, per device interactions and certainly improve their risk positioning now. But imagine the risk signal you would get if, for example, if somebody you get a slightly suspicious call from a caller and you have a fraud signal that says some retailer previously reported this device as being used to facilitate credit card fraud or fraudulent purchases. That's a huge game changer when it comes to again how you begin to think about what signals are available and how you're able to design step-up flows in a way that you know provides targeted friction.

Right. You don't you don't want to make everyone go through the gauntlet. You need to find ways to segment high risk from low risk and you need ways to further segment high risk, right? Because that will that should determine how you treat those calls based on the specific risk indicators that they're presenting. And a lot of those can be found again from the from the device. Those are hard to hide. Certainly, possible and I'm sure people are working on that but for right now they are they are very unique corroborating sources that need to be that I believe should be implemented in call centers.

Wyatt: Well, and it certainly sounds like gives you access to additional clues without adding friction to what's supposed to be a fluid customer service experience. Right. So, how do you keep that in the background or get the early indicators while still, you know, if it's a legitimate call, not interfering with what you're trying to get done, right?

Greg: Exactly. We want this to be as invisible to the end users as possible because these are government services. These are critical programs many people rely on. It's for their health care, their rental assistance, their food, and we don't want to impose cumbersome identity verification challenges if we don't need to.
 

Meeting FedRAMP and NIST standards without added friction

Wyatt: Well, lastly, Greg, not to get overly technical here, but let's talk a little bit about the FedRAMP capability here because and why that's also important for agencies. So how should agencies use FedRAMP ready tools like I think one is called true validate to meet these strict NIST IAL2 guidelines that are out there without again creating unnecessary friction for honest constituents?

Greg: Right so I'll take that in two parts the first is generally about FedRAMP now is table stakes if an agency is dealing with this problem or is thinking about making investments to improve the security within their call centers. If they're not considering a FedRAMP ready platform, they are just facing considerable barriers to getting a system up and operational and efficiency efficiently implemented.

The second part of your question, you know, targeted inducement of friction while still meeting IAL2, you could you can meet IAL2 guidelines without grilling your constituents to verify PII that fraudsters probably already have access to. We're providing real- time identity corroborating signals from you know authoritative data sources that again individually is going to be a weak signal but when combined can create a very strong signal for identity verification purposes. And so it's important when you're, you know, making that decision to procure some system or build some system. Not only is it something you can implement without all the undue headache and heartache of dealing with an unvetted system, but it's one that is built and allows for the flexibility to meet 2 guidelines, you know, in a variety of different ways, a variety of different contexts that allows you to build a system, build workflows, not from the perspective of friction first, but from experience first and I like to think that's what we provide.

Wyatt: Absolutely. Well, Greg Schlichter, thank you so much for taking a few minutes to kind of share your perspective on why the phone experience is not only a weak link, but offers a lot of fresh opportunity as well to defeat a lot of the con artists that are out there that are trying to get to all of our information. So, thanks so much for sharing that.

Greg: Yeah, no problem. Thank you so much.