Understand who is contacting the team
Published September 9, 2026.
A third party may be trying to help, but a helpful motive does not create authority. Ask for the person's relationship to the customer and the action they want. Agents can often record a concern without confirming account details.
Follow the approved authorization route
Use the organization's documented process for representatives, accessibility support, business accounts, or legal authority. Do not invent verification questions or accept sensitive documents through an unapproved channel. Escalate urgent safety concerns through the defined path.
Explain the boundary respectfully
State what support can do now, what the customer or representative must provide, and which channel to use. Keep notes factual and minimal. Review repeat scenarios so the policy covers real customer needs without weakening privacy controls.
Pair this boundary with support record minimization and customer preference handling. The NIST Privacy Framework provides broader privacy risk guidance.