6 Business Benefits of Caller Authentication

When interacting with customers, businesses generally want as little friction as possible.

This is especially true for call centers, where increasing customer satisfaction and reducing call duration are often explicit targets.

But eliminating all friction on a call would technically require skipping any form of identity verification. Clearly, that would be a terrible idea on sensitive or high-risk calls.

So the real question is: How do you strike a balance between friction and trust?

Let’s see why eID caller authentication may just be the answer.

Why call centers try to reduce friction

The job of a call center agent is to resolve the customer’s problem as quickly and efficiently as possible.

As such, it’s no surprise that many call center KPIs and metrics focus on reducing handling time and increasing customer satisfaction. Here are just a few examples:

• Average Handling Time (AHT): How long does it take agents to handle a customer call?
• Cost Per Call (CPC): What does an average customer call cost the company?
• Customer Effort Score (CES): How much effort does the call require from the callers themselves?
• Customer Satisfaction (CSAT): How satisfied is the customer with the interaction?

These metrics put understandable pressure on call centers to keep calls short and make them frictionless for customers.

The problem with zero friction

Taken to the extreme, trying to minimize friction may undermine efforts to reduce fraud and keep calls secure.

A call center might be tempted to do only minimal caller identity verification or stop doing it altogether. After all, asking customers security questions or making them check their inbox for a one-time password is bad news for “time-on-call” and “customer effort” metrics.

But identity verification isn’t exactly a nice-to-have step. It’s critical for making sure the caller is who they claim to be. In some cases, robust caller verification is also a regulatory requirement as part of know-your-customer laws.

In short, removing all friction should rarely be your only priority.

So, how much friction is okay, then?

Legible friction = acceptable friction

The truth is, your customers may be perfectly fine with a bit of friction, as long as they can understand its benefits and the reasons behind it.

In fact, callers likely even expect a degree of friction when it comes to identity verification, because they know that the alternative is an impersonator potentially gaining easy access to their accounts, finances, or sensitive personal information.

Seen in this light, friction actually introduces trust into the process.

As this CX Today article puts it:

“The real tradeoff isn’t friction versus experience. It’s harm versus trust.”

That’s why your goal isn’t to remove all friction, but to make it clear why friction exists and how it builds trust on both ends of the call. The article calls this “legible friction” and argues that it’s a much better target than “zero friction.”

With that in mind, you need to find the right balance between security, trust, and friction.

And eID-based caller authentication may just be the way to do exactly that.

eID caller authentication: the best of both worlds

There are many different ways to verify a caller’s identity.

In most cases, there’s a natural trade-off between customer experience, verification speed, and level of security.

For instance, asking someone for their national ID number is easy and quick, but it’s highly insecure. National ID numbers are often leaked and can be overheard or exposed in a myriad of different ways. That’s why national ID numbers are great for identifying a customer but not for verifying them.

One-time passwords, on the other hand, are more secure, but callers have to first wait for a password to show up via SMS or email, hunt for it in their inbox, and then type it in while on call, which doesn’t exactly do wonders for speed or user experience.

Caller authentication via eIDs is different: It lets companies verify customers securely and with little added friction.

That’s because this approach relies on national eID apps that most citizens already regularly use. The process is straightforward:

1. The call center agent triggers the authentication request.
2. The caller receives the request in their eID app and verifies on their device.
3. The agent sees the verified status, and the call continues.

While it’s not completely effortless, eID caller authentication arguably offers the best balance between trust and friction:

Voice biometrics is a close second, but it’s increasingly vulnerable to AI deepfakes and requires more effort to implement.

eID caller authentication is also the only verification method that lets companies verify brand-new callers, because it doesn’t rely on existing customer records.

So if your goal is legible friction instead of zero friction, eID-based caller authentication truly gives you the best of both worlds.

In the future, when Danes call, say, their doctor or insurance company, they may be asked if they want to use MobilePay to verify who they are.

This is possible because Idura is launching a new solution that allows companies to verify a customer's identity directly in MobilePay or MitID during a phone call.

Today, people are often still asked to provide their address, date of birth, previous payments, and so on when they call customer service. But these methods have become more insecure.

Artificial intelligence makes it possible to mimic human voices, and personal information can now be leaked or purchased online. This means fraudsters can call a company and pretend to be a customer.

With the new solution, the company can send the customer a smartphone notification, letting the customer confirm their identity directly in MobilePay. MobilePay is used by around 4.7 million Danes.

"Every day, thousands of Danes use MobilePay because it is a simple and easy way to pay. We have chosen to make MobilePay available for Caller Authentication because it is a safe way to identify yourself. Security is high in MobilePay, and it is impossible for criminals to pretend to be a specific MobilePay user without having control over both the phone and the user. Therefore, it makes sense to use MobilePay to verify your identity when talking to a company," says Jeanette Hertzum, Country Manager at MobilePay.

MitID can also be used
For many Danes, MobilePay will be the easiest way to verify their identity during a call, because the app can send a direct notification to the phone.

But it will also be possible to use MitID. Here, the user will have to manually open the MitID app and approve the request. This can be more difficult for many in the middle of a conversation.

This is because MitID does not use notifications for security reasons. There is a risk that a user gets a notification and approves an identity request without paying attention, even when they're not in a conversation with a customer center.

The Lack of user-friendliness can be a challenge for some Danes. A new survey from DaneAge in February shows that almost a third of Danes, especially the elderly, still experience problems with digital self-service solutions like MitID.

On the other hand, MitID will continue to be used in situations with higher security requirements, such as when a bank customer needs to approve a loan or similar.

Expecting rapid deployment
The solution has already been launched in Norway and builds on experience from Sweden, where digital identification in phone conversations has been widely used by banks, insurance companies, public authorities, and large service organizations.

Idura's CEO expects the solution to roll out quickly in Denmark.

"In Sweden, it's standard in most call centers today. In the Danish business community, there is a real concern about the ability of artificial intelligence to mimic people's voices, so we expect most larger companies with customer service centers to adopt it within a few years," says Niels Flensted-Jensen.

In Denmark, similar solutions have so far required major custom integrations and individual development projects. With Idura's launch, the technology is available as a standardized software solution for the first time.

Call center agents need to know who’s on the other end of the line.

That’s why businesses typically ask callers to identify themselves.

To do this, a person might be asked to provide their national ID number or to answer a security question.

The problem is that while many of these approaches may help identify the person, they are rarely enough to verify their identity.

To understand why that is, let’s take a closer look at the difference between identification and verification.

What is identification?

Identification is all about matching a person to an existing customer.

It answers the question: “Which customer is this?”

In a call center, an agent might ask the caller for any identifier that helps pull up their customer record: an email address, the last four digits of a credit card, a customer ID number, and so on.

This works for quickly finding the right customer, but it does nothing to assure the agent that the person calling is actually that customer. That’s because information needed for identification, including answers to security questions, can be overheard, inadvertently shared, or stolen.

As such, anyone could use something like your national ID number to impersonate you on a call.

That’s exactly how identity fraud often works.

And that’s exactly why verification is so important.

What is verification?

Verification involves confirming that the caller is, in fact, the identified customer.

The process relies on methods that are less susceptible to exposure, such as one-time passwords or voice biometrics.

The caller must prove they are who they claim to be beyond simply knowing the right details about the customer.

One of the most reliable ways to do that is to let the caller authenticate with their national eID via an app on their device.

Compared to other verification methods, eID-based caller authentication provides the best mix of security, fraud resistance, and user experience.

Why are they often confused?

The two terms are often conflated because, historically, knowledge-based authentication was seen as an acceptable way to verify someone’s identity.

That’s why you can still find companies relying on things like security questions or national IDs to verify callers.

But times are changing, and knowledge-based authentication on its own has become unreliable for verification purposes. In practice, it’s often paired with additional verification methods in what’s known as multifactor authentication.

Here’s a useful test: Could someone else easily provide the same information instead of the actual customer? If the answer is yes, you’re dealing with identification. But if the step also requires something the customer has or is, we’re talking about verification.

Why the difference matters

If your organization still treats identification as verification, you risk granting any caller with the right information access to someone else’s account and sensitive data.

Fraud is already at an all-time high, and AI is only making it worse. As such, letting identification stand in for verification is increasingly indefensible.

The solution isn’t to forego national IDs or other customer identifiers altogether. They’re still useful for matching callers to the right customer details.

But you should always supplement identification with an extra verification step.

Not only are such measures often required by regulations, but you owe it to your customers to introduce secure methods of verifying a caller’s identity, such as eID-based caller authentication.

Where does “authentication” fit into the picture?

“Verification” and “authentication” are frequently used interchangeably to describe the step of confirming someone’s identity.

If you want to be pedantic about it, there is a slight difference between the two: Verification is typically a one-off event that happens when a customer first registers an account. Authentication is a recurring step that happens every time a user logs on to access a service.

But in the context of a phone call, that distinction is mostly semantic: The agent will always need to confirm who the caller is, regardless of whether you call it verification or authentication.

The real takeaway is that identifying a customer does not automatically equal verifying (or authenticating) them. Verification requires more robust and secure approaches.