The phone

A ticket can be reread before you answer it. A chat message can be rewritten before you send it. A call happens once, at the speed of the person talking, and everything you say is heard as you say it.

The rest of this part is a small set of moves. Drill them until they run without attention and they still come out when somebody is shouting at you.

Open the same way every single time, so the opening runs itself and your attention stays on the listening. It starts with where they have landed, then your own name: "IT service desk, this is Sam."

Say what you can do as well as who you are. "IT service desk, this is Sam, I can reset accounts and get remote onto your machine" tells the caller in one breath whether they have reached the right place, and heads off the ten-minute story that ends in a transfer.

Ask for the number they are sitting next to right now, and read it back before you ask anything else. Calls drop. Phones die mid-sentence. People call from a meeting room, a car, a corridor. If the line drops before you have a number, the fault is still there and you have no way to reach them.

The rest of what you must get before you hang up, and the four questions that separate the report from the fault, are in Voicemails.

Active listening is a training term for two unglamorous habits. The first is letting the person finish. An upset caller has a speech prepared and they will deliver it whether or not you interrupt, and interrupting only makes them start again. Thirty seconds of quiet usually hands you the symptom, the scope and the deadline without you asking for any of them.

The second is the read-back. When you have it, say it back in your own words, compressed: "So since the update last night, the finance application opens and then closes, it is only on your machine, and you need it working before the payroll run at noon. Have I got that right?"

The callback number is one of many. Read back every number and every name: extensions, asset tags, error codes, the spelling of a surname. A digit you guessed wrong means ringing back to ask for it again.

In September 2023 an attacker group called the MGM Resorts help desk and talked a technician into resetting multi-factor authentication on a privileged account. Ten minutes on the phone, by the attackers' own account as relayed by the researchers at vx-underground, and then days of outage across Las Vegas properties and a hit MGM itself put at around a hundred million dollars. The ALPHV group claimed to have deployed ransomware; MGM has never publicly confirmed that part. Caesars Entertainment went the same way weeks earlier, through an outsourced IT provider. Both breaches started with a phone call to somebody doing the job you are learning.

"Before I can do that, I am sending a code to the contact on your directory record. Read it back to me." Send the code to the number on the record and wait for them to read it back. It works because it swaps a knowledge check for a possession check: anyone can recite facts about an employee, but holding what arrives at the number on file is harder to fake. A caller who is who they say they are reads the code straight back; an impostor reads something that does not match, or argues about why they cannot get to it. Calling back on the number in the directory proves the same thing the same way, and is the right move when there is no code to send.

A code or a callback reaches whoever is holding that number. A SIM swap, where an attacker talks a mobile carrier into moving a victim's number onto a SIM they control, puts an attacker in that position. High-risk asks, an MFA reset, a new registered device, anything privileged, need a second check off the phone line: approval from somebody who is not the caller, a video call against photo ID, or a Temporary Access Pass, a short-lived one-time code IT issues so someone can register a new sign-in method without their password or phone, sent through a channel you already trust.

The mechanics, codes and what a directory record can actually prove, are in Directory.

Somebody shouting at you at 9am is carrying something that happened before the call. They lost work, missed a deadline, got passed around, or were told three times it was fixed. You are the first person who picked up.

Then work your own end. Drop your voice below theirs and slow down: people match the tempo they are answered in, almost involuntarily. Use their name. Then run the two listening habits, worth more here than anywhere: let them finish, then say it back.

When it does not work, separate anger from abuse. Anger you absorb. Abuse you name once, calmly, with a consequence: "I want to help you with this, but I am not able to continue if the profanity carries on. If it does, I will end the call." Say it level and without sarcasm, because the sentence only works if it sounds like a boundary.

If it continues, end the call, write down what was said while it is fresh, and tell your team lead. You can also hand the call up before that point: asking a manager to take a caller who is being disrespectful is a normal escalation. Every desk with a functioning manager has that policy, and it covers you from your first week.

Talking somebody through a fix blind is slow, so the temptation is to batch the instructions. That is what turns a five-minute call into twenty: when it goes wrong you cannot tell which of the four steps went wrong. Give one instruction, then ask what they see, then give the next. It is hardest to hold to in writing, so it is drilled in Company Chat.

A four-minute silence in a thread is just a gap between two messages. On a line you can hear somebody hunting for a menu several seconds before they will admit they are lost. So stop talking after each step and listen to what the quiet is doing.

You are working somebody else's screen from the far end of a line, and their focus is wherever they last clicked, so say where to look before you say what to press: "bottom left of the screen, is there a magnifying glass?" Ask them to read the error back word for word. The exact string is the thing you can search, and on a call you can hold them there until they read you the line itself.

There are two honest ways to finish, and you pick between them out loud. The first is to solve it while they are on the line. That is the better outcome nearly every time, and it is what first contact resolution measures. The second is for work that is plainly going to take a while: raise the ticket, give them the number, say when you will ring back, and then ring back. Either way the caller comes off the line with a ticket number and knows what happens next.

The close is four sentences, and it is the part most calls skip. Confirm the fix in their words, which means having them open the broken thing and use it while you are still on the line. Then give the ticket number slowly enough to be written down.

Hold and transfer are the two moves callers complain about most, and both are easy to get right.

Before any transfer, tell the caller where they are going and why, and give them the ticket reference. Put the facts in the ticket before you brief the other team, so the next person picks it up from the record rather than from your description of it.

Around all of it sits a phone system: an automatic call distributor queues calls and hands the next to whoever is free, usually through a softphone on the computer. When a call ends you get wrap-up time before the queue hands you another, commonly tens of seconds to a couple of minutes. Use it for the notes, while the call is still in your head.

Average handle time is the number most desks watch: talk time, hold time and wrap-up added together. Chase it on its own and it rewards getting people off the phone before the fault is fixed.

Press Voice Call in the header and a call arrives. A free account gets one a day, then the control reads Call Used until midnight. On Pro, calls also arrive unprompted while you work the queue.

Ticket Info sits beside the conversation from the moment the call connects, in the three sections a real intake form uses: Requester, Incident classification, Description. It opens blank. The caller's identity sits in the header, and you copy it into the form by hand while they talk.

The footer reads Awaiting required fields until a name, a Category, a Priority and a description are in, then flips to Ready to submit. Submit files the ticket mid-call. Collapse is a second Minimize: it drops the whole call to the bar. Hang up without submitting and there is no ticket and no points.

It feeds the same ticket a voicemail's Create Ticket does, scored the same way, but the two start you in opposite places. A voicemail opens an editable draft already filled in from the transcript, the caller's words sitting in the description for you to correct and add your own reading to before you file. A call opens this form blank and hands you a live voice instead. Voicemails works the other half.

The identity fields

Name, Ext, Employee ID, Department: five points each against the caller's real record. Twenty points, all of them readable on the incoming-call card.

Category

Ten points, level with the description and ahead of everything else. The coarse drawer is matched against the issue's finer one, so a print server fault scores as printing.

Priority

Five points, matched against what the issue is, not how loud the caller was. Forty-five in total.

Description

Ten points once it passes fifty characters, so a one-line description scores nothing.

Calling out is its own control. Start voice call at the top of a chat thread rings that employee, and a lockout ticket holding a temporary password carries a control that calls that user back. Both do the thing the verification page argued for: you reach the person on the number their record already holds.