A support team is answering calls and providing well support. It would be conceivable for someone to impersonate or ask for something which should be authenticated first.
Which are the best methods to authenticate who they are over the phone?
To narrow it down, I have a website with a specific service. They need some support that will affect or modify this service and they need immediate support over the phone. I want to make it so someone can't impersonate another user.
I can collect basically any kind of information about the user. What type of information should I collect that would make it reasonably secure for us to take support calls from them. Like a secret question, phone number, address? I can add most anything, I would probably stop short of credit card information, but wouldn't be too unreasonable.