---
title: "Check who is asking before support changes · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/support-and-staff-access/support-identity-check
updated: 2026-10-20
licence: "All rights reserved"
---

# Check who is asking before support changes an account

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Support and staff access](https://agentwranglers.se/playbook/accounts/support-and-staff-access)
- Rule: Never change an email, phone number, factor or owner because someone asks by phone, chat or email. Send them to the in-app flow or the recovery process instead.
- How: Attackers call support as the customer, and a helpful agent hands the account over. Give the support tool no button that changes sign-in details. Let support start [the recovery process](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/recovery-without-factors), which has its own wait and notices. For other requests, ask the caller to read out a code shown in their signed-in app. Never ask for a password or a sign-in code.
- Check: List the actions in the support tool. None changes an email, phone, factor or owner directly. A test request for an email change by chat ends in the recovery process.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/support-and-staff-access/support-identity-check`.

- Previous: [Use separate staff accounts](https://agentwranglers.se/playbook/accounts/support-and-staff-access/staff-accounts)
- Next: [Impersonate customers only with a reason and a time limit](https://agentwranglers.se/playbook/accounts/support-and-staff-access/impersonation)
- [Support and staff access](https://agentwranglers.se/playbook/accounts/support-and-staff-access)