As of now, we're accomplishing this by hashing, salting and storing the first three characters of the customers' passwords in one table and hashing, salting, and storing the full password in another table.
BCrypt is used for hashing and SQL Server for storing.
When a customer calls our customer service, the representative has the option to verify the caller's id by asking for (among other things) the first three characters of her password.
The system used for this is behind all kinds of security measures and in no way exposed via external GUI nor API.
With the desired outcome in mind, verify the caller's id fast and easy, is there a more secure way to gain the same benefits?