Contact centres are AI fraud’s new front door

For years, organizations have focused on digital channels for fraud prevention investments. As those channels become more secure, fraudsters are increasingly targeting assisted channels such as contact centres.

AI evolves quickly, which makes fraud attempts more scalable, personalized, and difficult to detect. Call centre employees are usually part-time or in entry-level positions, lack ongoing training on AI tools, and have KPIs oriented toward client satisfaction, not fraud detection.

As a result, contact centres are quickly becoming a critical control point in protecting customers and maintaining trust.

The good news is that these risks can be addressed through a modern trust operating model that combines adaptive identity verification, AI-driven fraud detection, agent enablement, and customer-centric security controls.

The new contact centre trust challenge  

The contact centre is where customer service, authentication, and operational efficiency intersect. As a result, fraud attempts present several distinct business risks:

• Increased fraud and account takeover exposure, creating financial, regulatory, and reputational risk
• Higher operational costs associated with authentication, investigations, and escalations
• Degraded customer experiences caused by excessive friction or ineffective controls

The end of knowledge-based authentication

Legacy authentication is broken. Contact centres still rely on knowledge-based authentication (KBA), but KBA assumes personal information is secret. Customer data is no longer private, and fraudsters often know the answers to the questions agents use to verify identity. Voice alone is also no longer sufficient. In fact, voice recognition tools may now create a false feeling of security as fraudsters increasingly leverage sophisticated tools like deepfake voice technology and advanced identity theft tactics to exploit vulnerabilities in customer service operations.

Static questions are not enough. Identity verification must become adaptive, combining multiple signals to assess risk in real time.

Building the adaptive trust contact centre

Organizations must redesign how trust is established across the customer journey. An adaptive trust contact centre combines identity, fraud prevention, agent enablement, data, governance, and customer experience into a modern operating model.

To build this model, organizations should focus on five connected priorities: modernizing identity, detecting risk in real time, empowering agents, securing the operating environment, and balancing security with customer experience.

Modernizing identity

Knowledge is no longer identity. Modern trust models combine multiple signals to continuously evaluate risk throughout the customer journey. To make this shift, organizations should adopt identity controls that verify customers through a combination of contextual, behavioural, and authentication signals, including:

• Multi-layer authentication
• Multi-factor authentication
• Adaptive authentication, in which access rules are changed based on real-time risk

Empowering agents as the last line of defense

Agents are the last line of defense when fraud reaches the contact centre.

Organizations should strengthen frontline readiness through training, role-playing, and clear escalation protocols that help agents recognize suspicious behaviour and respond consistently. Their training should be consistent and evolve at the same speed as fraudsters’ strategies.

Advanced tools can now help agents identify potential fraud in real time. In fact, before an interaction even reaches an agent, these tools can determine whether the caller is a human or an automated bot.

In this context, a “pause and protect” culture gives agents the empowerment to slow down interactions, challenge unusual requests, and escalate concerns.

Securing the operating environment

As fraudsters use AI to scale attacks, organizations must use AI-driven risk detection to identify suspicious behavior, detect anomalies, and respond in real time. Contact centre security depends on a secure operating environment built around zero trust, least privilege, secure workspaces, and identity governance. These controls help reduce the risk that compromised credentials, excessive access, or unsecured environments can be used to support account takeover or identity theft.

Contact centre outsourcers should also be considered when designing these controls, extending the bounds of the operating environment.

Balancing security and customer experience

Effective fraud prevention should protect customer trust while reducing unnecessary authentication friction. Organizations need to design processes that distinguish between legitimate customers and higher-risk interactions without creating avoidable delays, frustration, or inconsistent service experiences.

This requires strong employee enablement, thoughtful process design, and governance that aligns fraud prevention, operations, and customer experience objectives.

How Deloitte can help

Organizations that continue to rely on legacy authentication and fragmented fraud controls will face increasing pressure as AI lowers the barriers to fraud and identity theft. Traditional cybersecurity controls for contact centres remain essential, but enterprise AI introduces new risks that require a new control layer that combines signals across the full interaction rather than assessing each event in isolation. The most effective response requires redesigning how trust is established across the customer journey.

Deloitte helps organizations create adaptive trust models that protect customers, empower employees, and balance security with world-class customer experiences. Our services include:

• Assessing contact centre fraud exposure. Identify where fraud risk enters the customer journey, evaluate authentication effectiveness, assess assisted-channel vulnerabilities, and quantify fraud, operational, and customer experience impacts.
• Modernizing identity and authentication. Reduce reliance on knowledge-based authentication, design risk-based and adaptive authentication journeys, evaluate voice biometrics and modern identity capabilities, and align security controls with customer experience goals.
• Redesigning the trust operating model. Review agent workflows and escalation paths, define governance, ownership, and fraud response procedures, align KPIs across fraud, service, and operations teams, and embed “pause and protect” decision frameworks.
• Strengthening people and workforce capabilities. Enhance frontline fraud awareness, develop fraud simulation and training programs, improve agent decision support capabilities, and empower employees to identify and escalate suspicious activity.
• Building an adaptive fraud prevention roadmap. Establish a maturity baseline; prioritize investments across people, processes, and technology; integrate AI-driven risk detection capabilities; and create a roadmap from reactive controls to adaptive trust.