In any kind of user-facing support role, not trusting the user's account of what happened is rule #1.