Call centre fraud has grown by 45% in recent years, according to Pindrop's 2016 Call Center Fraud Report. Given the repertoire of information that is constantly churning in and out of call centres, they are likely to be targets of fraudsters fishing for data. A pertinent question arises about the role of call centres in managing the security of this vast amount of customer data and ensuring its privacy.

1. Managing Data Security and Privacy in Call Centres
Call centre fraud has grown by 45% in recent years, according to Pindrop's 2016 Call Center
Fraud Report. Given the repertoire of information that is constantly churning in and out of call
centres, they are likely to be targets of fraudsters fishing for data. A pertinent question arises
about the role of call centres in managing the security of this vast amount of customer data and
ensuring its privacy.
Companies that work on the basis of collecting customer data need to be cautious given that
governments world over have started implementing laws to safeguard citizen data privacy. India
has also embarked on the Personal Data Protection Bill 2018. Some of its salient features
recommended are to keep a copy of all data processed in the country, whether or not of Indian
citizens and make the Act applicable to all. Companies all over that have their centres placed
here will turn cautious.
While big MNCs would already have tight measurements in place, what can and should other
companies do to not only protect the privacy of customers but even toe the line of law?
Infrastructure safety measures
Companies have the responsibility of protecting customer-related data, where some of it could
be confidential and sensitive. Any leak could jeopardise not just your customer but even your
own brand. Guard your server rooms and allow access to limited, authorised and trusted
people. For this, biometric authentication works best for now. Other options include OTPs,
voice-based access, NFC, etc. Create a hierarchy of data access where certain parts are
blocked depending on the person’s role and designation.
If your company deals with highly confidential data, your priority should be to take your own
dedicated server versus a shared one.
Create layers of protection
Call centres contain a wealth of information and can be targets of hackers. Implement multiple
layers of authenticating a user and keep upping the difficulty level. Even if a fraudster finds a
way to breach one or two layers, he cannot get through the entire system.
In executive-customer calls, some call centres have started adding IVR systems or keypad
inputs to block information such as card data from agents. Dual tone multi-frequency (DTMF)
masking blurs the numbers from agents and even adds one single flat tone for any keypad
pressed. However, the executive can still communicate effectively with the caller.
Encryption
Just as WhatsApp stays firm in its resolution to offer end-to-end encryption, call centres must
have strong encryption systems to protect customer information, which is more valuable. They
must go further and even encrypt customer data shared between agents or clients through
email. This ensures the email isn’t:
- Intercepted.
- Read by an unintended recipient.
- Hitting a wrong email id by mistake.
- Falling into the hands of someone with stolen credentials.

2. An automatic frequent key rotation system can encrypt and decrypt data without spilling access
into human hands.
Hiring right people
Don’t be slack when choosing employees. A good company will have tight screening processes
and conduct background checks before offering the job to any employee who is connected to
tons of data. Give them a low down on the company’s IT protocol and add penalties to those
who breach them. If needed, place a ban on any item that can copy data such as mobiles, pen
drives, etc.
HR assessment
Those in manager level positions should be given training to spot the bad apples. Be alert to
any signs of behavioural change that employees may exhibit. Have a continuous training
process for employees to understand and follow security measures. Educate employees on the
need for data privacy and protection as well as the ways cyber attacks can happen. An alert
employee might help you save millions of dollars.
Tracking changes
Add an audit trail to your server to make a log of every change made as well as register details
about each activity that takes place. This will record information like which employee viewed
which customer record and for how long or whether information has been changed or deleted.
The word ‘data’ has evolved over the years, making it imperative for companies to install
sufficient security and protection measures. The right measures taken in time can not only
shield your company from damage worth millions but even keep you safe from the wrong side of
the law.