Best Buy Incident Raises Call Center Security Question
Written by Evan SchumanThis fascinating Consumerist story about Best Buy raises an interesting security question: What call center verification methods should be used to authenticate customers before allowing them to cancel or change an order?
The story involves a Best Buy manager who supposedly couldn’t honor a buy-online-pick-up-in-store order, so he simply called customer service, pretended to be the customer and canceled the order. Regardless of whether the Best Buy incident happened as described (these kinds of situations are almost impossible to verify), the security issue is a valid one.
To make this work, the authentication details would have to include something that a store manager couldn’t find, such as a password. Given that it would have to be something that customer service could use to verify but that wouldn’t be accessible to other employees, a password is attractive. It couldn’t be identified directly, but if the customer gives it, it could be verified. There’s always the "call center must call back to that customer’s cell phone or home number on file" option, too.
Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code.
-Marc
