Failure to recognise vulnerable customers

What it is

A customer in vulnerable circumstances is one who, because of health, a life event, low resilience or limited capability, is especially open to harm when an organisation does not take appropriate care. Trained staff pick up the signs: a mention of bereavement, confusion, distress, a third party prompting answers. They slow down, check understanding and change what they offer. An automated channel that has not been designed for this continues with its script. The risk concerns failure to notice and adapt. Deliberate targeting of vulnerability is a prohibited practice, covered in exploitation of vulnerable groups by AI.

How it happens

• The system was built to complete transactions and has no concept of vulnerability.
• Disclosures made in free text are not recognised or recorded.
• A flag on the customer's record is not passed to the AI channel.
• Detection exists, and nothing different happens when it fires.

Why it matters

Harm to vulnerable customers is the harm conduct regulators treat most seriously. A sale completed, a debt pursued or a claim closed with someone who did not understand can be unfair even if every step was correct in form.

Warning signs

• The design documents do not mention vulnerability.
• Conversations containing clear disclosures end with no referral.
• Outcomes for customers flagged as vulnerable are not reported separately.
• Staff say they would have handled a case differently.

Who owns it

The business owner of the journey is accountable. The vulnerability lead sets the standard. Engineering builds detection and referral. Operations receive those referred.

In practice

A customer tells a collections chatbot that their husband has just died and they cannot think about money. The bot acknowledges the message and repeats the payment options. The same pattern generalises to any automated channel that hears what a customer says only as input to its own task.