Why does the customer-service system even reveal the sensitive info before the agent inputs the code? It could be sent out-of-loop so it wouldn't even be possib

Why does the customer-service system even reveal the sensitive info before the agent inputs the code? It could be sent out-of-loop so it wouldn't even be possible for them to bypass. Related question: What should happen to a customer who legitimately encounters this problem?