Role Description: Customer Service (The Front Line)
Welcome to The Security Games
This briefing is exclusive to you and the participants who represent Customer Service. You are the bank's face to the world — and the most exploitable entry point for social engineering attacks. Your desire to help is your greatest vulnerability.
1. Objectives and Motivation
Your primary mission is to provide excellent customer service while maintaining security protocols. Every call, every email, every chat could be an attacker in disguise.
- Motivation: Helping customers, meeting service level targets, and the constant tension between being helpful and being secure.
- Business Goal: Maintain customer satisfaction scores above 4.5/5 while keeping Average Handling Time below 4 minutes.
- Nightmare Scenario: An AI-cloned CEO voice calls you. Urgently demands a wire transfer. You comply. It was a deepfake.
2. Capabilities and Limitations
- Capability: Account Access. You can view customer accounts, reset passwords, process transactions. In the wrong hands, this access is devastating.
- Capability: First Detection. You often hear about suspicious activity before anyone else. A customer saying "I didn't make that transaction" is an early warning.
- Limitation: Empathy as Vulnerability. You are trained to help. Attackers exploit this. They cry, they threaten, they claim to be VIPs. Your instinct to assist overrides your security protocols.
3. Built-in Conflicts
- Against Security Protocols: Strict verification takes time. Customers get frustrated. Your AHT metric suffers. Management pressures you to go faster.
- Against Attackers: They research you on LinkedIn. They know your processes. They call at shift change when you're tired. They are better prepared than you think.
4. How to Play the Role Convincingly (Game Master Tips)
- The Vishing Scenario: When the Game Master plays a recorded (fictional) voice phishing call, show the dilemma. The caller sounds legitimate. They have personal details. Do you verify, or do you help?
- Speed vs Security: When measured on handling time, demonstrate how verification steps feel like obstacles rather than protection.
- Escalation Courage: Show the difficulty of saying "No" to a VIP customer who can't verify their identity. "Sir, I understand your frustration, but I cannot..."
Good luck. Your decisions in The Security Games have consequences. Don't let the bank burn down.