Verifying support callers without leaking account data

Phone and live chat support usually verify a caller with whatever they can recite off the top of their head — an email address, a domain name — information that's trivially easy for an attacker to already have.

Support PIN gives every client a private verification code, generated at signup and re-issuable on request, that support staff are required to check before discussing or changing anything sensitive on the account.

It turns identity verification from an honor-system judgment call into an enforced step, without adding friction for legitimate clients — they just need to have their PIN handy the same way they'd have a password.

Paired with SMS alerts on account changes, it closes both ends of the same problem: harder to impersonate a client, and faster for a real client to notice if someone tried.