**Security Verification

To help protect our users and our site, every interaction goes through a Security Verification Process.

For All Agents -

Trouble verifying info?

• If user is signed in: walk them to Settings option so they can verify/update details there
• If struggling with verifying their email: offer first 3 characters & domain of email i.e. gmail, outlook, etc.
• If struggling with verifying phone number: offer area code & last 3 digits only
• If struggling with verifying address: offer house/building number
• If a Hiring Manager, ask these questions instead:
  • Approximately what month and year did you join Upwork? (Only 3 months prior or after the actual date is acceptable) &
  • What's the name of the company you're listed as a hiring manager to?

Verification can’t be completed? e.g. user refuses to or is unable to verify OR Upwork tools temporarily down (SS error and include in internal notes)

Only general info can be given:

• Basic web navigation
• Any process outlined on the help pages (e.g. withdrawing funds)
• Questions about Upwork as a company
• General questions about the platform
• How to sign up

Are you going through security verification and you notice someone has *****@privaterelay.appleid.com as their email address on their account?

They most likely have no idea this is the email on their account! This shows up if the customer used Apple SSO and chose to hide their email address from us. The customer does still receive emails to their actual email account and this is just an alias email from Apple for security. This means that if we need to go through the verification process with them, we need to be more mindful of asking for the email address, as they most likely don't know we see this.

To verify:

• Follow the proper verification process below, but verify something aside from the email address OR
• Walk them to Settings option so they can verify the email there

When the user can provide verification details, but are not an authorized user with appropriate permissions:

• Company Account: If evident that the person reaching out is a different person and not the AO on the account... (some examples include, but are not limited to: a person signed in to the AO's account and chatting in and/or person calling from AO's number and/or person can verify all of AO's details yet in all these cases, they make mention or give the impression they aren't the AO) please explain our policy about account sharing being prohibited and advise to recommend the account owner to add that person as admin if it's a company account.
• Freelancer Account: Please explain our policy about account sharing being prohibited and ask user to verify account ownership by providing at least 4 correct answers to the 7 account verification questions before assisting the user further. Check for possible account takeover (ATO). See ATO KB before assisting the user further.
• If the AO is on the phone and was able to pass security verification, and the AO is authorizing another person to handle things for his company, we can assist that authorized person.
• When the customer has a duplicate account and is logged into an account but is inquiring about the other account, have the customer verify the correct account. If unable to verify, send a ticket through the correct account.
• When a customer calls in and has a third party on the line, ask the customer for permission to ask account specific questions with the third party on the line. If the customer doesn't want to grant that permission, request the customer to place the third party on hold, complete verification and then bring that party back to the call.
  • Suggested verbiage:
    
    • Are you ok verifying account details and talking about potential sensitive account info on the phone with XYZ on the line? May I ask you these questions with XYZ party on the line. If the customer says no, the customer should place that other party on hold, complete verification and then bring that party back.
  • If the customer says no, the customer should place that other party on hold, complete verification and then bring that party back.