Fraud report triage for a Filipino customer support assistant

Give the assistant one clear job

A Filipino customer support assistant can receive a report, record the customer's words, protect the ticket, and alert a named manager. That is useful work, but it is not an investigation and it does not give the assistant authority to decide whether fraud occurred.

Write the finish line before the first ticket arrives: a complete intake note, the right risk label, and a manager alert through an approved channel. Refunds, account ownership changes, evidence requests, legal notices, and contact with banks or police stay with the owner or another approved specialist.

Define what belongs in the queue

Useful triggers include an order the customer did not place, a login the customer does not know, a message asking for a new payment destination, or a caller pretending to be company staff. A customer who says an invoice is wrong may have a normal billing question, but a customer who says somebody changed bank details needs the fraud path.

Give the Filipino assistant a short list of labels such as suspicious message, unknown account activity, identity claim, and payment-change request. Labels help route the work, but they must not read like a verdict. The ticket should say "customer reports" rather than stating that a named person committed a crime.

Capture facts without collecting everything

Record the customer's name, safe contact method, account or order reference, time noticed, channel used, and a plain description of the event. Ask what the customer already did, such as changing a password or contacting a card issuer, but do not ask the customer to send a full card number, password, government ID, or secret code in a normal ticket.

Keep the original message or screenshot only in the approved support system, and follow the company's retention rule. The FTC tells businesses to keep only personal information they need and to protect what they keep. That is a practical reason to avoid copying sensitive details into chat, email, and several task boards.

Stop account and money actions

Do not let a new report become a reason to reset every login, change an account owner, send money, approve a refund, or edit bank details. A scammer may use the support queue itself to create urgency. The Filipino assistant should lock the ticket from routine handling and ask the named manager to decide the next action.

The FTC said on March 10, 2025 that consumers reported more than $12.5 billion in fraud loss during 2024. The same release said 38% of people who reported fraud said they lost money, up from 27% in 2023. Those figures describe reports received by the FTC, not the expected result for one company or customer.

Verify the channel, not the customer story

Use a contact method already stored on the account when the manager asks for a second check. Do not use a phone number, link, or email address supplied inside the suspicious message. If no safe contact method exists, the assistant should mark that gap and wait for the manager rather than inventing a workaround.

CISA tells people to resist pressure to act immediately and to use a known address or number when checking a suspicious message. In a support lane, that means the assistant pauses, preserves the request, and switches to the company's trusted contact record. The assistant does not call a supposed bank, vendor, or family member found through the message.

Plan the Philippine shift handoff

Set one urgent route that works during Philippine Time, such as an on-call manager queue with a backup contact. Give examples of urgent events: active account takeover, a payment-change request due the same day, exposed customer records, or a threat that appears credible. Normal disputes and incomplete reports can wait in the review queue.

The end-of-shift note should list the ticket number, risk label, time received, safe contact status, evidence location, and manager notified. It should not repeat full personal details in a general team chat. The next Filipino assistant can see that the case is already owned without reopening the story or asking the customer to send the same material again.

Give the manager a usable record

Put each event in order with a time zone: customer report received, account note checked, safe contact attempted, ticket restricted, and manager alerted. Separate the customer's statement from facts visible in company systems. This keeps the note honest and helps the manager see what still needs proof.

NIST published Incident Response Recommendations and Considerations for Cybersecurity Risk Management in April 2025. The guide treats incident response as part of wider risk management, which fits a small support lane: prepare the route, detect a concern, respond through named owners, and learn from the record. A customer support assistant can support those steps without becoming the incident lead.

Train with samples and review the lane

Run three samples with the Filipino assistant: an unknown order, a fake payment-change email, and a normal billing correction. Ask the assistant to label each case, write the intake note, choose the safe contact path, and name the manager. Correct the checklist when the assistant has to guess, because that is a process gap.

Review the lane each month using a small sample of closed tickets. Check whether sensitive data was copied, urgent cases reached the right person, ordinary support work was not over-escalated, and managers left a final note. Keep the rule that the assistant reports and routes the concern while approved staff decide what the business does next.

Questions people ask