Philippines call center phishing escalation playbook

Make the first response easy to remember

Use three verbs: stop, record, and hand off. The agent stops the requested action without opening a link, downloading a file, sharing a code, or changing an account. The agent then records a small set of facts and sends the case to the on-duty manager.

This rule applies to calls, email, chat, text messages, and internal-looking requests. A caller may claim to be a customer, client executive, tool administrator, courier, or coworker. The claimed identity does not replace the approved verification path.

• Stop the action and keep the customer record unchanged
• Do not open, reply to, forward, or copy a suspicious link
• Record the channel, time, case number, and requested action
• Alert the named manager through the approved incident channel
• Return to the queue only after the case and any exposed account are contained

Recognize pressure without trying to prove intent

Agents do not need to decide whether a person is a criminal. They need to notice when a request conflicts with the normal process. Useful triggers include urgency, secrecy, a new destination for data, a request for a sign-in code, or instructions to move the conversation to a personal account.

CISA advises people to recognize and report phishing, and it highlights urgent or emotional language, requests for personal or financial information, shortened links, and incorrect addresses as common signs.[4] NIST also tells users to be wary of unexpected messages and to verify requests through known contact details rather than the message itself.[5] These signs start a check; one sign alone does not prove an attack.

Use the evidence without blaming a location

Verizon released its 2025 Data Breach Investigations Report findings on April 23, 2025. It reported that 30% of breaches involved a third party, 22% began with credential abuse, and 44% included ransomware.[1] These are global findings from Verizon's incident and breach analysis, not a score for outsourced teams or workers in the Philippines.

The FBI released its 2024 IC3 Annual Report on the same date. The report lists 859,532 total US complaints, including 193,407 phishing or spoofing complaints, 64,882 personal-data-breach complaints, and 36,002 tech-support complaints.[2] These are complaints submitted in the United States, not confirmed incidents and not observations of Filipino agents.

The figures justify rehearsing common control failures. They do not estimate the chance that one agent, vendor, or center will face an attack. A local playbook should be shaped by the actual queue, systems, customer checks, and manager coverage.

Give the manager a bounded handoff

The first manager should confirm that the agent stopped and should move the conversation away from the suspicious contact. The manager checks the message or call through a trusted channel, alerts the client security contact, and follows the client incident plan. The agent should not investigate with personal tools.

Use a named account and the smallest role needed for the queue. NIST's zero-trust guidance says that network location or ownership alone does not create trust.[3] An internal-looking message, office network, or company device therefore cannot be the only reason to approve a sensitive action.

Record enough facts for the next decision

Keep the incident card short enough to finish while details are fresh. Record the local time and time zone, channel, case number, displayed sender or caller details, requested action, verification result, and what the agent actually did. Mark unknown facts as unknown rather than filling gaps.

Do not paste passwords, one-time codes, full payment details, identity documents, or unnecessary customer data into the handoff. Preserve the original item in the approved system when policy allows, and point the manager to its record. The client incident owner decides whether a separate evidence-preservation step is needed.

1. Write the time, time zone, channel, and case number
2. Describe the request and the exact step that raised concern
3. State whether anything was opened, entered, changed, or disclosed
4. Name the manager and client contact who received the handoff
5. Track containment instructions and the case owner without editing the original facts

Use words that let the agent pause safely

A pause line protects the process without accusing a legitimate caller. It should say what the agent cannot do, what happens next, and where the request will go. Avoid explaining the hidden details of customer checks, because that can teach a caller how to answer them.

For a suspicious message, the agent should avoid replying to the sender for confirmation. Verification should use a known directory entry, client portal, or established manager channel. If a manager sends an unusual request, the agent can still verify it outside the original thread.

Drill the playbook and fix the handoff gaps

Run short drills with redacted examples from the channels agents actually use. Include an urgent caller seeking an account change, an unexpected file in chat, and a manager-looking message asking for customer records. Tell participants which exercises are simulations so no one mistakes them for live incidents.

Score observable actions: the agent stopped, avoided the link or disclosure, created an accurate record, used the right channel, and reached the correct manager. Also time the manager acknowledgment. A weak result may point to an unclear contact path or missing overnight coverage rather than an agent knowledge problem.

• Run one voice scenario and one message scenario
• Include the Philippine shift's primary and backup managers
• Check the incident record for facts, unknowns, and unnecessary data
• Confirm the client security path works during the actual shift
• Retest the revised step in the next scheduled drill