IDG32250 - Confidentiality when dealing with the customer: Protecting confidentiality when on the telephone

When using the telephone, contact can come from:

• other parts of the department (for more details see IDG25000);
• customers themselves;
• customers’ agents (for more details see IDG52000)
• other government departments (for more details see IDG44000); and
• other third parties (for more details see IDG50000)

All these have in common that you could be in the position of making disclosures of information over the telephone, whether intentionally or not. Please read this section to ensure that when speaking on the telephone you take every step to ensure that you do not unintentionally disclose confidential information.

Whoever the caller claims to be, you must verify the identity of the person you are speaking to. Do not disclose any HMRC information until you are wholly satisfied that the person you are speaking to is the person they claim to be.

Bogus calls

You must be alert to individuals or organisations attempting to gain confidential information by deception. Read the ‘Bogus Caller’ guidance on the Customer Contact Standards and Procedures site (see IDG90150 for a link to this site).

You should also familiarise yourself with the ‘Caller Verification’ guidance issued on the Customer Contact Standards and Procedures site. It provides detailed advice on how to ensure that confidential information is not unintentionally disclosed during telephone conversations, and provides the procedure to follow to verify the caller’s identity. This guidance must be read by all staff who use the telephone and have access to HMRC information.

If you have any doubt about the identity of the caller having followed the procedures in the BBT guidance you must not disclose any confidential information to the caller.

It is important to evidence that you have undertaken the appropriate checks before you disclose confidential information (see IDG42050). Any record that you keep of the telephone conversation could therefore usefully refer to the fact that you verified the caller’s identity.

If you receive a suspicious call report it immediately to your line manager. Further guidance for reporting bogus calls will appear here shortly.

Information about a customer should never be provided to a third party unless you are sure that there is lawful authority to disclose that information. See IDG40500 for more information about lawful authority.

Further guidance

For further information about handling telephone calls please see the Customer Contact Standards and Procedures intranet pages (link available at IDG90150).