JoyTel's Operational and Security Vulnerabilities

JoyTel's chatbot accepts unverified ID and proof of address, enabling fraudulent customer profiles. Customers are approved before final credit checks, leaving high-risk individuals in the system. Call-center agents can override AI credit decisions and remove deposits, increasing debt and potential losses. The 'Manager approved' option lacks real checks, allowing staff to misuse it for unauthorized approvals. Multiple agents can modify sensitive customer data, including banking details and rental limits, risking fraud or incorrect changes.

Change logs are poorly maintained, editable in Excel, and only reviewed during complaints, making the audit trail unreliable. Unauthorized changes can be deleted, and errors or fraud may go undetected for extended periods due to the absence of proactive review. There's no tracking of chatbot deals that don't become orders, leading to overlooked lost sales and incomplete transactions. The reliance on chat history instead of formal exception reports means important missed transactions can be ignored, impacting revenue.

Warehouse clerks manually re-dispatch information, leading to human errors in capturing items or addresses. There's no verification of dispatch details before delivery, potentially causing incorrect deliveries, increased costs, and customer dissatisfaction. Couriers do not verify recipients' identities, risking asset loss. Failed payments are imported manually, creating opportunities for data entry errors or omissions. A lack of reconciliation between payment and accounting systems results in incomplete or inaccurate revenue records.

JoyTel's management only performs month-to-month comparisons, preventing the detection of deeper issues or irregular transactions. Customers are expected to self-monitor accounts, which means errors may go unreported and incorrect balances remain unresolved. Agents can issue credits up to R2,000 without approval, creating an avenue for fraudulent credits and revenue reduction. AI automatically approves credits with no human review, leading to incorrect or excessive credits being processed without oversight. The absence of credit reviews means patterns of abuse or frequent crediting are not identified.