While banks scramble to tighten security for Web and mobile transactions, there's an emerging vulnerability in phone centers as crooks try to
"Call centers are a big footprint. You have all of this data and ongoing conversations about customers and data," says Julie Conroy McNelley, a research director at Aite.
Companies that offer call center recording and coaching technology, such as CallCopy and NICE, have products that halt recording when a phone dialogue includes information that may tempt crooks. As old as the call center may be, it's still a channel in which crime prevention has some catching up to do.
"Fraud at the contact center has existed for a while, but there's a threat as fraudsters perceive it to be the path of least resistance. Institutions are shoring up their online and mobile channels. And since there's a human on the other end of a call, certain types of attacks such as social engineering can be easier at the call center," McNelley says.
The prevention tools also come with an element of compliance. The Payment Card Security Industry Data Security Standards Council says recordings of personal information, such as Social Security numbers and payment card numbers, that are exchanged during phone payments,
That has call center tech providers pushing recording controls. "We are making a big push around adhering to those PCI requirements," says Patrick Hall, chief marketing officer for CallCopy.
CallCopy recently had Coalfire, a PCI security assessor, audit CallCopy's call center workflow tech for PCI compliance. It found CallCopy's workflow optimization application can be removed from PA-DSS validation scope, which means the application does not expose sensitive information during the payment process.
CallCopy's technology includes a blackout feature that uses start-and-stop triggers that define the beginning and end of the portions of calls that contain sensitive information. It pauses the recording of the voice and screen activity during that segment, so the sensitive data isn't stored. It also uses secure sockets layer encryption during all recording and playback, and includes a tracking system that provides a history of all activity within the application, allowing the bank to determine who accessed any recording for playback or export.
"We monitor the behavior of what's going on at the customer service rep stations. When the agent at a sensitive screen, where they would be taking someone's Social Security number and other sensitive data, we temporarily halt the recording," Hall says. An additional auto archiving tool allows records to be auto-archived or purged in compliance with business rules or government regulations. And user permissions include the ability to deny a user the right to reset his or her own password, which is designed to prevent the creation of overly simple passwords.
Hall says that while CallCopy has voice recognition technology, it relies heavily on screen navigation to trigger the recording pause, since Hall feels tracking screen navigation is a more reliable tool to gauge when a call center session has reached a point in which sensitive data is being exchanged. "We don't feel phrase detection is there yet to be used for this purpose," Hall says.
CallCopy competes with firms such as NICE, which offers desktop analytics that, based on the agent's screen activity, trigger pause-and-resume of call recording; as well as a set of access-control tools that include strong password management.
Becky Cash, director of client contact center for StellarOne Bank in Charlottesville, Va., a CallCopy client, says that "very soon" it's "on our radar" to mask personal information exchange in call center sessions. "It is critical for privacy to protect our clients' information both over voice and screen capture," she says.
StellarOne, which established its contact center around five years ago, is using call monitoring technology from CallCopy to measure general performance and to improve sales and call times. In less than a year, the bank, which has 23 call center representatives, has increased call volume by 17% while maintaining an average call time of about three minutes.
The recording, archiving and service screen capture is used for coaching, to measure cross-selling and inform cross-selling, service, marketing and onboarding of new staff. The bank's service supervisors can view on a screen how well and how fast call center reps are serving consumers and incorporating information from the bank's customer relationship management system into their dialogue with customers.
"We want to improve sales performance and look for soft skills and soft savings that don't have a direct impact on return on investment and help with agent coaching," Cash says.
