I'm always dismayed when it's clear the person on the other line is manually entering the string of digits that I just also entered by hand.
If you let customers type in an account number, for example, people will type in random numbers with a slight preference for numbers beginning with 1. However if all your real account numbers begin with a 400, then you can programmatically exclude all calls with accounts entered that don't match a regex of begins-with-four-zero-zero. That filters out cranks and people who are unqualified to even call. If they enter zero, 9, 1234, just dump them to dialtone. Superficially it sounds like bad security for your seven digit identifier to really be like 4 digits of security because they all begin with 400 but its actually a feature for filtering.
Tangent, but "Compliant Cooperative Customer" totally sounds like a buzzword companies would use.
When it worked, we could get everything based on caller ID without having to ask, yet "security"
Lots of companies outsource their IVRs. And everything is all too often cobbled together in a just-make-it-work-right-now fashion.
It's all held together with painters tape
Part of this is to verify identity and verify nothing went awry pulling up your account.
If the system even pulled up your account at all. The center I worked had people put in their information, but it didn't forward it to the call center worker. The main benefit of keying the information in is to get you to use the automated system first, but also to route you into the correct call que for your area.
You see, different states had different regulations on how fast you needed to answer the calls, some of those had penalties as well. In addition, hours are different in different time zones. Since we serviced coast to coast, this was rather important.
Additionally, there is an element of anger diffusion. Folks will call in screaming, yet will generally calm down a little while verifying everything. This is utterly helpful.
They're as much concerned with a CSR accessing accounts inappropriately as they are with a fraudster gaining access to customer accounts. And that CSR verification happens by the CSR typing in your information.
It's no wonder, then, that spending money and engineering time on something that would cause customers to be something unmeasurable, like being slightly less aggravated, is not prioritized or even cut, as being extravagant. To that end, despite Comcast and airlines low customer satisfaction ratings, they seem to be doing alright.