Auto-refund fraud. The single biggest financial risk in M4. If the refund custom action doesn't cap at the threshold you set in intake, a single bad actor can drain your refund budget in an afternoon. Cap it in three places: the system prompt, the custom action config, and the install doc.
HIPAA + BAA. If you're healthcare-adjacent, do not process PHI before Intercom countersigns the BAA. Not for testing, not for “just one ticket”. Use synthetic test data during the 1–3 day wait. If the BAA blocks past five business days, switch to Crisp Enterprise (HIPAA add-on with a faster BAA workflow).
Escalation tree silence. If a complaint fires escalation and the Slack webhook is broken, the owner finds out from a one-star review three days later. Test the escalation tree every Monday morning for the first month — submit a synthetic legal-trigger ticket, confirm the alert fires.
Migration cost. If you're on Zendesk or Freshdesk and switching to Intercom, the customer history migration takes a full day and needs scheduled downtime. Don't start it on a Monday. Don't start it during a sale. Plan for a Wednesday-Thursday window with the team warned.