Access Level to OAAM Admin

Part II Part II Customer Service and Forensics This part of the book presents information about the customer service and forensics tools of Oracle Adaptive Access Manager. It contains the following chapters: ■ Chapter 4, Managing and Supporting CSR Cases ■ Chapter 5, Investigation Using Agent Cases ■ Chapter 6, Viewing Additional Details for Investigation 4 Managing and Supporting CSR Cases 4-1 4 Managing and Supporting CSR Cases Oracle Adaptive Access Manager provides a set of tools for creating and supporting Customer Service Representatives CSR cases. This chapter provides information to CSR and CSR Managers for managing cases and contains the following sections: ■ Introduction and Concepts ■ CSR and CSR Manager Role Permissions ■ Getting Started ■ Cases Search Page ■ Case Details Page ■ Viewing Case Activity ■ Viewing Customers Sessions ■ Creating a CSR Case ■ Performing Customer Resets ■ Performing Challenge Question Resets ■ Enabling a Temporary Allow ■ Performing Case Actions ■ Configuring Expiry Behavior for CSR Cases ■ Reporting ■ Multitenancy ■ Use Cases ■ Best Practices and Recommendations

4.1 Introduction and Concepts

This section provides an introduction to CSRs and CSR Managers and a high-level view of how they might use the Oracle Adaptive Access Manager set of tools for creating and supporting cases. It includes the following sections: ■ Case ■ Customer Service Representative CSR ■ CSR Manager ■ Fraud Investigator 4-2 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager ■ Fraud Investigation Manager ■ Locked Status ■ Temporary Allow ■ Case Status ■ Severity Level ■ Expiration Date ■ Customer Resets

4.1.1 Case

A case is a record of all the actions performed by the CSR to assist the customer as well as various account activities of the customer. Each case is allocated a case number, a unique case identification number. The Case Management feature of Oracle Adaptive Access Manager is used in two ways. ■ Users of the enterprise using Oracle Adaptive Access Manager can call up the enterprise asking for assistance with user-facing features of Oracle Adaptive Access Manager such as images, phrases or challenge questions, or any issues with their account. The CSR uses the Case Management feature to create a case which records all the actions performed by the CSR to assist the user as well as various account activities of the user. ■ The Case Management feature is also used by Fraud Investigators to investigate potentially fraudulent activity performed in user accounts.

4.1.1.1 CSR Cases

CSR cases are used in customer service situations associated within the normal course of doing business online and over the phone when providing assistance to customers. A CSR case is created for a specific user.

4.1.1.2 Escalated Cases

CSR escalates a case when he cannot resolve a case and needs further investigation by an investigator or when he determines there is suspicious activity associated with the specific user and he wants further investigation by an investigator. Once escalated the case is treated as an Agent case, which is no longer visible to the CSR. However, any agent can work on the escalated case.

4.1.2 Customer Service Representative CSR

Customer service representatives are employed by many different types of companies to serve as a point of contact for customers who call. They are responsible for ensuring that their companys customers receive an adequate level of service and help for low risk issues originating from customer calls. In handling customers complaints, they must attempt to resolve the problem according to guidelines established by the company. These procedures may involve opening a case, entering notes as they are speaking to customers, asking questions to determine the validity of a complaint, making changes or updates to a customers profile information, and, if required, passing the case on to a CSR Manager who has the appropriate privileges to respond. In a Multitenant deployment, CSRs only have access to cases limited to an Organization. Managing and Supporting CSR Cases 4-3

4.1.3 CSR Manager

The CSR Manager is in charge of overall management of CSR-type cases. A CSR Manager has all the access and responsibilities of a CSR and access to more operations, such as: ■ bulk edit cases ■ temp allow users ■ extend expiration The CSR does not have the permissions to perform these actions. A CSR Manager routinely searches through the CSR cases to check on status and clean up if needed.

4.1.4 Fraud Investigator

A Fraud Investigator investigates a specific fraud scenario or suspicious pattern. The Fraud Investigator works on escalated cases.

4.1.5 Fraud Investigation Manager

A Fraud Investigation Manager has access to actions that the Fraud Investigator does not have.

4.1.6 Locked Status

If the user fails a challenge, he is locked out of the account. The status of the account is Locked . The Locked status is only used if the Knowledge Based Authentication KBA or One Time Password OTP facility is in use. ■ Knowledge Based Authentication KBA: For online challenges, a customer is locked out of the session after the Online Counter reaches the maximum number of failures. For phone challenges, a customer is locked out when the maximum number of failures is reached and no challenge questions are left. ■ One Time Password: OTP sends a single-use password to the user through a configured delivery method, and if the user exceeds the number of retries when attempting to put in his OTP code, his account becomes locked. After the lock out, a CSR must reset the status to Unlocked before the account can be used to enter the system.

4.1.7 Temporary Allow

A temporary allow grants temporary account access to a customer who is being blocked from logging in or performing a transaction. A customer is blocked when a security rule is triggered. For example, a customer may be traveling on business and attempting to log in from a blacklisted country and the system has blocked him or her.

4.1.8 Case Status

Case Status is the current state of a case. Status values used for the case are New, Pending , Escalated, or Closed. When a case is created, the status is set to New by default. CSRs cannot Authentication a closed case. CSR Managers and Investigators can Authentication a closed case. Escalated cases cannot be created.