Changing a phone number, email or address looks routine and is a common step in account takeover. The agent can validate new details, step up authentication and let customers make the change in their own app session. It holds changes made in conversation for a person, notifies the old contact details, and flags any card or PIN due by post.
What is the process, and who owns it?
Customers move house, change numbers and switch email providers. Keeping these details right matters: statements, notices and one-time codes depend on them. But fraudsters want them changed too. A new phone number lets them receive authentication codes; a new address lets them intercept a replacement card. And some changes carry regulatory weight: a move abroad can affect tax reporting, product eligibility or the due diligence a firm must hold.
Operations owns customer records. Fraud owns the risk rules for detail changes. Compliance owns what a change of country triggers. Support owns the conversation. The agent handles the routine safely and stops at the risky, following our guide to the AI support agent that knows when to say no.
What are the steps, and at what depth?
- Agent, depth 1: identifies what is changing: postal address, phone number, email, or contact preferences.
- Agent, depth 3: steps up authentication to the level your fraud rules set for that change. For phone and email changes, this is usually stronger than for a balance enquiry.
- Agent, depth 3: validates the new details: address lookup against a postal reference, email format, phone number format and country.
- Agent, depth 3: directs to self-service where the customer is in an authenticated app session, so the customer makes the change. This is the safest route and the one most firms prefer.
- Agent, depth 1: checks risk signals: another detail changed shortly before, a card or PIN ordered or due, a new device, an unusual location, urgency.
- Agent, depth 2: drafts the change for changes requested through chat, phone or email, with authentication results and signals attached.
- Person, operations or fraud: approves drafted changes, and any change with risk signals.
- Agent, depth 1: routes moves abroad to the team that assesses eligibility, tax and due diligence. It does not tell the customer their product can continue.
- Agent, depth 3: confirms the change and the notice sent to the old details, and tells the customer when post or codes will start going to the new ones.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Identify | Classifies the change | 1 | Nothing |
| Step up | Runs stronger authentication | 3 | Nothing |
| Validate | Checks format and address | 3 | Nothing |
| Self-service | Directs to app session | 3 | Customer makes change |
| Signals | Checks takeover signs | 1 | Nothing |
| Draft | Prepares conversational changes | 2 | Approving them |
| Abroad | Routes to eligibility team | 1 | Eligibility decision |
| Confirm | Confirms and notifies | 3 | Nothing |
Which controls matter, and what evidence does each leave?
Authentication matched to the change. Evidence: authentication level recorded against each change.
Customer-made where possible. A change the customer makes in an authenticated session is attributable to them. Evidence: the session that made the change.
Old details notified. A fraudster who changes an email cannot stop a notice reaching the real customer's old one. Evidence: notice delivery records. Whether an agent should change a customer's address at all is weighed in can an AI agent change a customer's address?
Card and PIN timing. Cards or PINs due soon after an address change are flagged for fraud review. Evidence: flags and review outcomes.
Moves abroad routed. Evidence: routing records and the eligibility team's decision.
What should you measure?
- Changes completed in self-service, against those drafted for approval.
- Drafted changes rejected for risk, and how many proved fraudulent.
- Takeovers involving a detail change, traced back through the record.
- Changes resolved in one contact. First-contact resolution matters, but not at the cost of the checks.
- Returned mail and bounced emails after changes, a sign of validation failures.
Where does it usually go wrong?
Phone channels are weakest. A convincing caller with a few personal facts can pass basic checks. Phone changes should rely on codes to the existing number or app approval, set up as in connecting an AI agent to your contact centre telephony.
Several changes come at once. New address, new phone and a new card in one call is a pattern, not a coincidence.
Preferences and details are confused. "Stop calling me" is a contact preference, not a request to delete a phone number. Can an AI agent change a customer's contact preferences? covers that separate path, where opting out is usually safe to do at once.
Outage traffic hides fraud. During a service outage, volumes surge and checks get rushed. Keep detail-change rules unchanged under pressure.
Joint accounts are forgotten. One holder changes the address for both. Your rules decide whether each holder must agree.
Validation overrides the customer. An address lookup fails for a new-build home or a rural property, and the agent "corrects" it to the nearest match. Mail then goes to the wrong place. Where the lookup fails, the agent should record the address as given and draft it for a person to confirm.
Business and personal details mix. A sole trader changes their trading address and the personal account address changes with it. Confirm which record the customer means.
Where Pryme fits
In Pryme, the channel and the change type both feed the minimum chain, so a phone-number change requested by chat can be held while the same change made in the customer's app session is allowed. The verdict names the deciding bound, and the notice to the old details is filed with it.
Questions people ask
Can the agent update an address if the customer sends proof?
A photo of a utility bill is external evidence. Where your rules need proof of address, the document should go through your verification flow, not be judged by the agent.
What about a customer who has moved and lost access to their old phone?
That is account recovery as well as a detail change. Treat it under the stricter recovery process first.
Should marketing preferences follow the same checks?
Opt-outs can be accepted at once with basic authentication, because they reduce contact. Opt-ins need a clear, recorded action by the customer.