Published October 22, 2026.

Tier the change by risk

A password reset, an address change, and a payment-method change carry different risks. Define which changes require a second factor and which can be handled in the normal flow.

Do not use one script for every request. Customers notice when a low-risk request is treated like a fraud investigation.

Use evidence the customer can provide

Verify with information the customer should know and the agent can check, such as an order identifier, a registered contact method, or a recent interaction. Record what was used.

Never ask for a full password or a one-time code in chat. If a code is part of the flow, direct the customer to the approved screen.

Record the decision and the exception

If verification fails, record the reason and the next step. Do not simply refuse. Offer a documented alternative such as a callback to the registered number.

Review failed verifications for patterns. A spike may mean the process is too strict or a fraud attempt is underway.

Source: reference.

Related guides: this workflow and this workflow.