What is an appropriate approach if you cannot verify a caller's identity before discussing sensitive information?

• A. Discuss only non-sensitive information and offer to verify identity before discussing sensitive details.
• B. Discuss all details to be helpful.
• C. Transfer the call to any available staff without verification.
• D. End the call without assistance.

Answer: (A)

Protecting privacy means sharing sensitive information only after you’ve verified who you’re talking to. When you can’t verify a caller’s identity, the safest and most appropriate approach is to discuss only non-sensitive information and offer to verify identity before discussing anything sensitive. This protects personal data from exposure and helps prevent social engineering while still providing helpful service by guiding the caller toward the verification process.

Use approved verification methods you have on file, such as asking questions you can confirm, cross-checking known details, or arranging a callback to a verified contact number. If verification can’t be completed, pause sharing sensitive details and determine the next step—like scheduling a secure follow-up or guiding the caller to use verified channels. Sharing sensitive information, transferring without verification, or ending the call without assistance would not meet security and service standards.