AI Contact Centres Are Now the Softest Path Into Your Accounts

The AI voice agent that replaced tier-one support did what it was bought to do: it cut handling time and it never puts anyone on hold. It also inherited the one thing tier-one support was worst at — deciding whether the caller is who they claim to be — and it does that decision thousands of times an hour, consistently, without hesitation.

What the attack looks like

• The caller has name, address and the last four digits of a card, all of which are breach data rather than secrets.
• The bot asks its scripted knowledge questions and the caller answers them, because the answers were also in the breach.
• The caller reports a lost phone, and the bot triggers the recovery flow it was designed to trigger.
• Multi-factor authentication is reset through a channel the attacker now controls, and no login attempt ever looked suspicious.

Why human agents caught more of this

Experienced agents escalate on feel: the pause before an answer, a story that shifts, an unusual request combined with an unusual hour. That signal is not in a script, so it is not in the bot. Worse, the bot is consistent — an attacker can probe it repeatedly, learn exactly which phrasing passes, and then run the same script at scale.

Controls that work

1. Separate identification from authorisation

Answering questions identifies a caller. It must not authorise a high-impact action. Any credential reset, payout change or address change needs a second factor bound to something the account already holds.

2. Add friction where the money is

Ninety percent of calls deserve instant service. The ten percent that change payment details or recovery contacts deserve a hold, a callback to the number of record, or a human review. Route by consequence, not by queue length.

3. Treat voice as unverified by default

Voice biometrics fail against 2026 cloning quality. If you still run them, treat a match as one weak signal among several, never as proof.

4. Detect probing, not just fraud

Repeated failed verification against the same account, or the same caller pattern across many accounts, is the reconnaissance phase. Alerting there is far cheaper than reversing a takeover.

5. Log what the bot decided and why

Fraud review needs the transcript, the checks performed, and the reason the flow proceeded. Without it, every case investigation starts from nothing.

An AI agent that can reset a credential is a privileged account. Give it the controls a privileged account gets.