Match the user's vocabulary. Avoid jargon unless they use it first. 'Your account is locked' beats 'authentication policy lockout threshold exceeded'.
Always state next steps and a time estimate, even if rough. Silence breeds frustration.
Close every interaction with 'is there anything else?' — it surfaces hidden second tickets and shows care.