I have seen great articles that document the best practices, patterns and anti-patterns for authentication within an application or storing passwords etc. But w

I have seen great articles that document the best practices, patterns and anti-patterns for authentication within an application or storing passwords etc. But where is the gold standard for authenticating people over the phone? Good Developers understand how critical it is to handle authentication and password storage well. It can be complicated thing and is very easy to screw up. But all that goes out the window when somebody calls the support line. There needs to be just as much scrutiny placed on over the phone authentication as there is within an application. The problem is likely that those over the phone patterns/anti-patterns are not well documented and available.