Call center fraud and social engineering risks in banking: How IAM and SIEM strengthen defenses

Call center fraud has emerged as a critical weak point in banking security, where attackers exploit human trust and procedural gaps more than technology flaws. A recent report found that voice phishing (vishing) attacks surged in late 2024, with the financial sector facing the highest average loss of $12,400 per incident. Coupled with AI-driven impersonation and deepfake voice scams, these tactics are enabling large-scale account takeovers and financial fraud. For CISOs, this escalating threat underscores the need to integrate IAM and SIEM into fraud defense strategies, ensuring layered verification, real-time monitoring, and improved resilience against social engineering.

Why do call centers remain critical touchpoints in BFSI?

The following are the reasons:

• The first line of customer trust: Call centers are often the first point of contact for customers seeking issue resolution, making call center customer authentication vital to protecting sensitive financial information.
• High-value transactions and requests: Customers frequently initiate fund transfers, card blocking, or account changes over calls, making call center identity verification a crucial safeguard against fraud and account takeovers.
• Omni-channel integration hubs: With customers engaging with BFSI across mobile apps, portals, and physical branches, the call center acts as the bridge, requiring robust call center customer authentication to ensure consistent security.
• Targets for social engineering attacks: Fraudsters exploit human interactions to bypass security; strong call center identity verification mechanisms prevent attackers from manipulating agents into granting unauthorized access.
• Regulatory compliance and risk management: Banking regulations mandate secure customer verification; weak call center customer authentication can lead to compliance breaches, fines, and a loss of customer trust.

Why are call centers the prime targets in BFSI?

The following are the reasons:

• The weakest link in omni-channel security: While online and mobile banking use advanced controls, call centers still rely heavily on human interactions, making them easier to exploit.
• Reliance on knowledge-based authentication: Attackers armed with stolen PII can easily bypass outdated call center identity verification questions like the DOB, SSN, or mother’s maiden name.
• High-pressure environments for agents: Agents are trained to resolve issues quickly and prioritize customer satisfaction, which makes them more vulnerable to manipulation and social engineering.
• High-value access points: Call centers can reset passwords, change contact details, or authorize high-value transactions, offering fraudsters a direct path to account takeovers and financial theft.
• Blind spots in monitoring: Many banks lack integrated SIEM visibility into telephony and call center logs, creating more gaps for attackers to exploit when compared to better-monitored digital channels.

What are the vulnerable points of call centers in BFSI?

The following are the vulnerabilities:

• Weak authentication : Reliance on outdated knowledge-based authentication makes it easy for attackers with stolen data to bypass security.
• Social engineering risks : Agents are highly vulnerable to manipulation through urgency, authority, or impersonation tactics.
• Insider threats : Disgruntled or coerced employees can abuse access to customer accounts and sensitive data.
• Escalation gaps : Inconsistent identity verification and weak escalation procedures allow fraudsters to slip through.
• Limited monitoring : A lack of both SIEM integration and real-time visibility leaves voice channel fraud attempts undetected.
• High-pressure environment s: Agents prioritizing KPIs like the call speed may overlook red flags in fraudulent interactions.
• A lack of advanced detection : An absence of voice biometrics and AI-based analytics weakens defenses against impersonation and repeat attacks.

What are the threats related to call centers in BFSI?

The following are the threats and attacks:

• Vishing: Fraudsters impersonate customers, executives, or bank staff over calls to trick agents into revealing or resetting sensitive information.
• Account takeovers: Attackers use stolen PII to bypass call center identity verification and gain unauthorized access to customer accounts.
• Deepfakes and AI-powered impersonation : A synthetic voice or video is used to convincingly mimic a customer or senior executive, pressuring agents into approving fraudulent requests.
• Social engineering: Scammers exploit human trust and urgency, such as by claiming a lost card or urgent transfer to override normal procedures.
• Credential harvesting : Fraudsters trick agents into disclosing or resetting login credentials that are later used for online or mobile banking fraud.
• Insider collusion : Employees are bribed, coerced, or socially engineered to share customer data and OTPs or bypass authentication checks.
• Multi-channel fraud (cross-channel attacks) : Attackers start with call centers to reset security controls (like making phone and email changes) and then exploit those credentials across digital banking channels.
• Denial-of-service attacks: Organized fraud networks inundate call centers with fake calls to overwhelm agents and distract security teams while real fraud is attempted elsewhere.
• Data theft and leakage : Attackers target call recordings, CRM databases, and agent desktops to exfiltrate sensitive customer data for future fraud campaigns.

What is the role of SIEM and IAM in preventing the threats and attacks above?

The following are the ways through which they help:

What are the compliance regulations related to the above?

The following are the related compliance mandates:

• The PCI DSS directs organizations to protect card data in calls through redaction, access controls, and monitoring.
• The GLBA requires safeguarding customer information against social engineering.
• FFIEC requirements stress layered security and MFA for call center customer authentication.
• The GDPR governs the protection of personal data handled by agents and systems.
• The PSD2 mandates step-up verification in financial transactions.
• SOX holds firms accountable for insider fraud and weak access management.
• Local BFSI mandates by institutions like the Reserve Bank of India (RBI), Monetary Authority of Singapore (MAS), and Financial Conduct Authority (FCA ) of the United Kingdom enforce fraud prevention and operational resilience.

What is the role of SIEM and IAM together in preventing the threats and attacks above?

The following is how IAM and SIEM help:

What are the security policies for call center fraud defense?

The following are the security policies for call center fraud defense under the people, processes, and technology model:

People

• Call center customer authentication policy: Mandate multi-factor identity verification (like MFA, voice biometrics, or knowledge-based and contextual checks) for all customer interactions.
• Agent security awareness policy: Enforce periodic training to help employees recognize vishing, social engineering, and deepfake-driven impersonation attempts.
• Access and privileges policy: Grant least privilege access to call center staff and revoke access immediately upon a role change or termination.

Processes

• Call center identity verification procedure: Define step-up verification protocols for high-risk requests (e.g., account resets or large transfers).
• Incident response playbook policy: Establish structured escalation and investigation steps for suspected fraud attempts at call centers.
• Fraud monitoring and escalation policy: Mandate cross-channel correlation of fraud attempts (across calls, online banking, and mobile banking) to spot coordinated attacks.
• Vendors and third parties policy: Require partners handling call center operations to comply with IAM and SIEM monitoring standards.

Technology

• IAM: Enforce IAM-solution-based identity governance, role-based access controls, and adaptive authentication for both agents and customers.
• SIEM : Centralize log collection via a SIEM solution with real-time alerting for anomalies in authentication, insider activity, and call handling.
• Data protection: Ensure the encryption, masking, or redaction of card data and PII in call recordings and CRM systems.
• Resilience and redundancy: Mandate monitoring, failover, and automated responses for call center systems to meet BFSI operational resilience mandates.

Building resilient defenses

Call center fraud is no longer a routine risk; it is a primary vector for account takeovers and financial losses in BFSI. CISOs must recognize that defending these touchpoints requires more than reactive measures; it demands proactive policies across people, processes, and technology.

By strengthening customer and agent identity verification, enforcing disciplined escalation procedures, and deploying IAM and SIEM together, banks can close critical security gaps. IAM and SIEM solutions provide the governance, monitoring, and real-time visibility needed to outpace evolving fraud tactics. A layered defense at call centers not only ensures compliance but also protects customer trust and institutional resilience.

Related solutions