Getting Contact Center Authentication Right in 2021
Dan Miller of Opus Research and Matt Smallman of SymNex Consulting discuss the continued challenges of Authentication in the contact centre.
Matt Smallman, Dan Millerupdated
Dan Miller of Opus Research and I got the opportunity to sit down virtually and discuss the continued challenges of Authentication in the contact centre. This was the first of what I hope will be many conversations as part of our joint Business of Intelligent Authentication series. Dan has so much experience in how this market has evolved it was great to hear his perspective, and it got me thinking as well.
We covered a wide range of topics, including
- Big challenges facing enterprises in improving the experience and Security of their call centers - Usability, Efficiency, and Security needs still reign supreme, but the balance may need to change.
- Intelligent Authentication in practical terms - A phrase coined by Opus Research, but that rings true with lots of the clients I work with.
- The most promising technologies that will help address these issues?
As this is our first attempt, please bear with any minor production issues and feel free to let Dan or I know if you have any suggestions for improvement or topics you'd like covered.
Transcript
Matt Smallman0:00
Hi, and thanks for joining us. At the moment I'm head of consulting at SymNex Consulting, where we help organisations apply new technologies to customer experience problems.
Dan Miller0:11
Wow. And I'm Dan Miller, lead analyst at Opus Research. And we do analysis of technologies that we call conversational, and we've been covering this area of authentication and intelligent authentication
Matt Smallman0:26
And today we're going to be talking about the challenges, identification authentication and the contact centre, and what you can do to address them as we move into 2020.
Dan Miller0:35
Right. But the overarching theme, that the way we're doing it now has certain deficiencies that, in many ways, drive customers away, or at least slow them down from completing the tasks that they're after, and may also be deleterious to building trust with your best customers. But I'll let Matt go into some of the details there.
Matt Smallman0:57
For me, the main challenge
everything else seems to stem from is this continued dependence on knowledge-based authentication. That's when we depend on something that caller knows in order to confirm their identity. This is your typical social security number, date of birth, mother's maiden name type challenge. And knowledge-based authentication isn't, in its own right,
a bad thing. It's mostly that we've just found ourselves dependent, with varied intentionality, and the consequences of it are real but often overlooked. It impacts security, initially. First off, it's obviously hard to make particularly secure, because the same details are used everywhere. The more secure we tend to make it, such as biting passwords, the more expensive and potentially less usable.
So, some interesting numbers: recently Forrester Research that 57% of 259 global fraud prevention decision-makers reports an increase in contact centre fraud in the last year. And the majority of that would have been against knowledge-based authentication. Secondarily, it impacts usability. As Dan says, regardless of method we use, it's really frustrating, because customers, consumers across the world hate it.
BT's latest survey, where they've been going out every year or so looking at what they call the autonomous customer, in the last year says that 60% of customers say the ID and V takes long, and 50% say they would like to spend more if they trusted the security, the contact centre. So we can see it's other hearts.
It's either too hard to get right, or it's not secure enough. And I think many posters we see today are actually really security theatre that exists to be seen to do something, even if we all know they're not actually achieving very much. And then, finally, for me, it really impacts efficiency.
There's a bottom-line impact beyond fraud. Many knowledge-based authentication processes are very hard to automate. And if we fail to automate things at the start of the call, we miss the opportunity to do more things for the customer in self-service. Sometimes we choose really obscure questions in the name of security and have to wait for callers to rifle through their filing cabinets.
Other times we ask lots of questions, taking up time that could be better served resolving the caller's query. And then, finally, when it all goes wrong, we often tell callers to call back, wait for a letter, or go and visit us and an even more expensive physical.
Read the full transcript (16 min read)
Dan Miller3:04
And I'll go a little bit further. This is not news.
There shouldn't be news to many people in our audience. I remember something like the FIDO Alliance, which was organised, I think, going on 12 years ago, and declaring the password dead at that point, or at least that their objective was to kill the password. And then there was solid reason for that.
And got into the nuts and bolts of it, that it's expensive, it's ineffective and it turns off customers. Gee. But it's compounded now, as Matt also mentioned, is that we redefined self-service in such a way. So much of the business we carry out over our smartphones and other devices.
It can be a smartphones, it'd be a smart speaker, could be a regular phone, website; just go down the list. It's a continuous process. We call it conversational commerce because it's something that takes place over time. And then there's these moments, which might be urgent in many cases, when you reach out through a voice channel or try to reach a contact centre.
You want results quickly. But you also want it to be trusted and personalised. So there's these advantages to authenticating continuously and to making it part of this ongoing conversation.
Matt Smallman4:21
I think that really not neatly leads us on to the phrase that Dan and team at Opus have coined, which is intelligent authentication.
The time really is right for intelligent authentication now. So, Dan, do you want to tell us a bit more about what that means?
Dan Miller4:32
Right. And I don't think just doesn't sound insulting, like, "Oh, it's authentication. Do it intelligently." We've broken it down into, like, five different elements, and continuity is the overarching theme about this, that, when you think about it, it's really good for
companies, banks, healthcare providers, telecommunications companies or whomever to already have some element of confidence that a person calling the contact centre is whom he or she claims to be. So, in a way, we're working towards a point where you're just looking for those tells or anomalies that might raise a flag.
So what are the elements here? First of all, these conversations are happening in real time. So there's a lot of discussions about support, digital commerce, all sorts of things happening asynchronously, but one thing's for sure: when you pick up and you want to talk to somebody, hey, you don't want to be put on hold. But once you're talking, you don't want to be stopped to try to answer questions or have or remember your password and that sort of thing.
So this notion of doing something with awareness that it has to take place in real time. We also think, according to this notion of continuity and personalisation and that sort of thing, that a system of authentication be risk aware. So that you don't, if you do have high confidence that an individual is whom they claim to be, for instance, it's Dan using Dan's phone and there's evidence that he is located where Dan originates those calls,
there's really not a lot of reason to lay it on thick and look for very strong authentication if you're already pretty confident. And that speaks to what you can provide, but it also speaks to a requirement that there is such a thing as a risk engine that is taking into account information about that call, about that caller, so that they can assign some level of risk that deals with how much an agent or an automated system is comfortable providing to that individual before using,
you're asking for more information or that sort of. The third issue is that it'd be adaptive. And I think I've talked to that, that you assign a risk profile both to the individual and what that individual is trying to do, and you adapt in real time. So we're working a hierarchy here,
the approach to authentication and personalisation, I would add, that's most appropriate to both of those: who it is, what they're trying to do. Multifactor should be a given. I would argue that there's no such thing as single factor, 'cause by the time you are aware of where the device, something, originated from,
that's like something the person has. You're adding something they know. We've counselled towards biometrics as the something you are, and something that can be gauged in the midst of a conversation, or more quickly than using knowledge-based, though. It also means you can use knowledge-based in order to get a stronger level of confidence that the individual is whom he or she claims to be, and that they're entitled to do the sorts of things
Andrew can pull up information at the individual. And the third is multilayer, which I think, that's one of the more problematic terms. Matt might have a better idea of what this means, but one thing to think about is, to me, it maps to this notion that the infrastructure, the hardware, the software that supports authentication is secure by design.
And that there's an awareness that these conversations take on a... Wait, should we stop? 'Cause Derek saying that he lost me. But did you lose me?
Matt Smallman8:44
Huh.
Dan Miller8:45
Okay. Well, you have to edit this one out, but,
Matt Smallman8:48
That's fine. It records in your local browser and then sends the file afterwards, so you don't have to worry about connectivity.
We do lose it. It should still keep going, but I can cut it.
Dan Miller9:00
That's good to know. So Derek says okay. But anyway, so let me see where it was.
Matt Smallman9:04
Yeah, so,
Dan Miller9:07
Yeah, exactly. So multilayered is the final attribute of intelligent authentication, and it's a little squishier, but to my mind it maps to this concept that all of the infrastructure, hardware, software, communications networks and that sort of thing be secure
by design from the beginning. So, I mean, there'll always be some point of weakness, or an attack surface, if you will. But eventually you have to be thinking about end-to-end encryption, about, if there's data being transferred over the voice channel or whatever, that it, that
be diverted or victim of a person-in-the-middle sort of approach, that there is some design principles that put security as well as convenience up front, that it's a matter of design.
Matt Smallman10:01
Wow. So a lot of things for people to get right. I guess if you take a step back from that, you don't
all of that. I think that's what you would define as your vision for intelligent authentication. I think even just taking one or two steps to being more intelligent in authentication is better than we are today. And from my perspective, some of those first steps need to really be about
balancing usability with risk. You called it some risk aware, but I think we need to make the effort that the customer goes through proportional to their perceived risk of the thing that they're doing. For me, the best kind of usability is when there is nothing to use: the caller and all the agent doesn't need to do anything.
And there are a range of technologies out there contribute to intelligent authentication, and its passive, friction-free and effortless mechanisms. So they have to be top of the list of things you'd look at. And you talked about biometrics in a second grade. And if users struggle to use those technologies, then we're going to impact some other element of the experience.
No one calls a contact centre to prove that they are who they claim to be. They call to get stuff done. So the more we can get our processes out the way, the better. And I also like to think about balancing two sides of the same coin. The first is authentication, which is about increasing our confidence about the caller is who they say they are.
And the second is really fraud detection or anomaly detection, like reducing the risk that the call is fraudulent or there's something suspicious going on. For me, ultimately, authentication has the greatest long-term benefit. Like, if we can be really sure everyone who's calling is who they claim to be,
then there isn't a lot of need for fraud detection. But that can be a long and hard journey. And so we can see some really dramatic impacts just from combining fraud detection with authentication approaches. So we've talked about some of these things. What would you tell us about this kind of concepts?
What do you see as some of the most promising technologies in this space?
Dan Miller11:46
Yeah. And bear in mind, I'm going to recite these as a very interested third-party analyst. I think we can bounce ideas back and forth about their likelihood and appropriateness and readiness for easy deployment. But I spoke to the fact that no single authentication or technology is existing in a background.
What Opus homed in on and has seen evolve was initially using voice biometrics as a factor for strong authentication. And now it maps to, hey, using your. As part of a multifactor security or authentication methodology, and there's been advancements there that are very, very interesting to me.
You spoke about stuff that doesn't require a specific action, either by the agent or caller. And that speaks to looking at what can be done passively and in the background. And that speaks to passive authentication, or text-independent voice authentication, turns out to be really, really interesting.
Also on the horizon, and this is just a slight departure from that, just methodologies that are behavioural in nature. And I say it's only a slightly different, is the neat thing about voice from the beginning had been that there's a physical element to it, very much like a fingerprint, that doesn't ever change: that the nature of your voice reflects the shape of your vocal
passages and that sort of thing. But it's also a behavioural factor, because the way you speak, your cadences, the words you use and that sort of thing, are starting to be recognised as a behavioural factor, like so many others. And that interest into this. So many others that we're hearing about, with which there's, it uses me, like keystroke analytics or something like that, but how people are keying things into their phone, how they're holding their phone, there's a number of other behavioural issues
that are behavioural tells, if you will, that lead to strong and quick and passive authentication. And I think we're seeing, with cameras being everywhere, of course, the combination of face ID, not just for device activation, but for providing some level of confidence that the individual is whom he or she claims to be.
So it's this move to behavioural, the addition of more factors being taken into account to inform that risk engine. That's where I think that there's a lot of action. But I want to hear what you're seeing among your clients in terms of the uptake or the readiness to incorporate these new things into the mix.
Matt Smallman14:47
Yeah. And I think that's a really interesting mix of technologies in there, and certainly some of those were my to watch list as well. I think I've seen, certainly, as I transitioned over the last few years, when voice biometrics being the golden answer to every problem,
when in fact it's probably, we've asked you have seen some great examples in financial services where it's been intelligently applied, drives huge improvements in security and usability, simply won't be right for everyone. And even for those for whom it is right, it's just one tool in the toolbox.
And what we really need to be thinking about doing is filling our toolbox with appropriate tools and then choosing the most appropriate tool depending on the context of the customer and their enquiry and the risk. And that is intelligent authentication. So whilst we have voice biometrics, we even have some really simple stuff that we're still not making the best use of.
So in some low-risk scenarios, simple ANI matching, matching the inbound phone number with the recognised for the customer's records, is, could be a loan, could be good enough for the majority of customer interactions in low-risk environments. And then there's a range of anti-spoofing and fraud detection tools that can give increased confidence
that that number really is the number that called you. So I think there's some really easy wins there. There's still a big missed opportunity, I think, for combining device-based security from the digital channel. A lot of organisations have done a great job with apps and with their digital channel,
but they really haven't. Talk to the telephone channel. And a lot of those users are coming from one to the other, except we have no transfer of context and we have no transfer of security. So I think there's some really easy opportunities, and we've seen some really technically simple stuff to do, like click-to-call with a bit of authentication tacked on the end from inside your app.
And I'm sure the same is feasible from another number of other digital channels. And then, like Dan said, these aren't necessarily fully proven in the authentication context, but I know they're already proving their worth in the fraud detection space as these behavioural tools.
So not necessarily looking, how the customer's doing the same thing each time, but looking at what are those telltale behaviours that fraudsters do all of the time. And if we can identify those with a high degree of confidence, that we don't need to put everyone else through such huge hurdles in order to get them in.
And I think there's some really, really useful work coming out from a variety of different vendors in that space, and I'm looking forward to how that even gets extended in terms of authentication as well. So it's pretty clear that, for me, I think it's not gonna be any simpler in the future; there isn't a one-size-fits-all solution that will wipe away everything that went before.
And I think that then comes back to thinking about intelligent authentication as a whole. And the missing component I see for many companies is this orchestration layer. So let's face up to the reality that we're going to have many ways in which we may want to authenticate and increase our confidence and reduce the risk of fraud in a call.
But what we need to do is to be able to tie those all together and be able to present both the caller, and often the agents or our automated systems, with appropriate decisions for that. So I think before you can start doing, everyone would need to take a step back and be more intentional, as I said up front, about exactly how we want to authenticate callers in the future.
Dan Miller17:55
Yeah. And this lays the foundation for a number of future conversations we're going to have, Matt, when you think about it. You pointed to specific gaps in solutions. This one that does relate to continuity, to having the confidence that an individual that's been to the website, that's doing or been in the mobile app, hits click, the call should not have to reauthenticate if they've done it already.
So this notion of repetitive authentication. We didn't pay enough attention to the other. It's just the exposure to false negatives. It's like, and you've been in internal discussions at your clients where the person from security will say something like, "I cannot tolerate a
positive. I can't have an imposter come in here." But I think from a customer's point of view, and we are doing more than paying lip service to customer experience, it's the false negatives that drive you nuts. And not a day goes by for me where I haven't failed to authenticate with my finger on my phone to activate it and end up putting in my password.
I think I'm 50-50 with some of the technologies that are supposed to be vital, in addition, not remembering passwords or failing these quads, challenge questions. Yeah, we just have to be aware that we're in this multi-authentication for the purpose of personalisation and convenience world.
And we have the technologies available to fill in the gaps, and we'll talk about some of the specifics of those in our future chats here.
Matt Smallman19:40
Thanks, Dan. Yeah, I think, in terms of some actionable steps that people can take away from today's conversation, the most important thing to do, and hopefully you've made this point, is to take a step back, that there is no right or wrong way to do this.
And very few people have a blank sheet of paper. So a lot depends on the context, organisation you work in, where we've come from and what your priorities are. And we always start by benchmarking this current state. And it's always surprising to me how few organisations have a good handle on exactly how these processes performed today against those things we talked about at the start.
I mean, how usable is it? How secure is it? And how much does it contribute to the efficiency of your operation? So take a step back and evaluate yourself in those ways. And we've actually built a scorecard that captured our best practice on our website. So if you want a bit more structure to start with, and you're welcome to give that a go.
And
Dan Miller20:30
I think there's a lot to talk about, not just between the two of us, but among a community of interested individuals, both on the security side or the digital commerce side. And I recommend bookmarking or visiting opusresearch.net to keep in a thread of discussions of what's going on in, quote, intelligent authentication, unquote. And also I'm on Twitter and trying to just highlight some of the developments here.
I'm DNM54, from back in the day when Twitter really wasn't just a text messaging system and they told you to have short handles.
Matt Smallman21:09
And you can email me at matt.smallman@symnexconsulting.com. That's S-Y-M-N-E-X consulting.com. And you can learn more about us on our website, symnexconsulting.com, and that's where you find our scorecards as well as more information about contacting us.
And we are hopefully back in a few weeks' time, Dan, to talk in more detail about the bottom-line benefit case for getting some of this stuff, dig into a little bit more detail about exactly what we mean by efficiency and the real financial impact of getting some of this stuff. Exactly.
Dan Miller21:39
Building the business case.
Where, yeah, I mean, this is very real, and you wanna bring it down to business terms.
Matt Smallman21:46
So thanks so much for joining us. Everyone have a great day, and goodbye.