Agent WranglersSupport and staff access Required
Check who is asking before support changes an account
Never change an email, phone number, factor or owner because someone asks by phone, chat or email. Send them to the in-app flow or the recovery process instead.
How to do it
Attackers call support as the customer, and a helpful agent hands the account over. Give the support tool no button that changes sign-in details. Let support start the recovery process, which has its own wait and notices. For other requests, ask the caller to read out a code shown in their signed-in app. Never ask for a password or a sign-in code.
How to check
List the actions in the support tool. None changes an email, phone, factor or owner directly. A test request for an email change by chat ends in the recovery process.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/support-and-staff-access/support-identity-check.