Words are spoken by you, digits are spoken by them. An agent glancing at their
screen mid-sentence can tell which way the exchange is running without reading a
label.
Running a handshake
Open the conversation for the call and find the Identity panel in the Overview tab.1
Start the handshake
Press Start handshake. Custral emails the contact both halves at once,
your agent’s two words first.
2
Say your two words
Read the words on screen aloud. The customer checks them against the email.
If they do not match, the person who phoned them is not from your company,
and they press the reject option in the email.
3
Take the six digits back
Ask the customer to read the six-digit code from the same email. Type it in.
The panel flips to Verified.
Both halves are in the same email, agent’s words first, on purpose. A customer
reading down the page checks the caller before giving anything away, so a
stranger who has phoned them never reaches the digits.
What verification unlocks
A verification holds on that conversation for 30 minutes. While a call is in progress with a contact, these three actions need that caller verified:
Everything else stays available. You can take notes, set a stage, change an
owner and log an outcome on a call without verifying anybody, because blocking
that would stop agents doing their job.
The gate only applies while a call is genuinely in progress with that contact.
Ordinary CRM work outside a call is never affected, so a colleague editing a
contact on a quiet Tuesday afternoon meets nothing.
When the customer cannot pass
Somebody whose phone was stolen, with their mailbox on it, cannot pass any of this, and your team still has to help them. Override skips the proof on a named person’s say so. It is available to workspace admins only, it requires a written reason, and it is the loudest entry in the audit log. Use it when you have satisfied yourself another way, and say how in the reason. Three wrong read-backs locks the contact for 15 minutes. Codes themselves expire after 10 minutes, so a call that has gone long just needs a fresh handshake.The audit log
Every attempt is recorded: started, verified, mismatch, locked, expired, rejected and overridden. A log of only the attempts that worked answers no useful question. The entries worth having are three misreads on one account in an afternoon, and the override at 11pm. Contact addresses are masked before they are stored, because the log is read by people who were not on the call.Limits
- Codes are sent by email. SMS delivery is not built yet.
- A contact with no email address on file cannot be verified this way. Custral says so before sending anything, rather than leaving an agent waiting for a code that never arrives.
- The gate is a control on your agents’ workflow. It stops a stranger talking an honest agent into acting for them. It is not a restriction on what your own staff can reach through the API.