Skip to main content
Every account-verification flow asks the same lopsided question: prove you are who you say you are. Only the customer is ever asked. The agent, a voice on a phone claiming to be your support team, is taken on trust. Custral asks both sides. One exchange, two halves: Words are spoken by you, digits are spoken by them. An agent glancing at their screen mid-sentence can tell which way the exchange is running without reading a label.

Running a handshake

Open the conversation for the call and find the Identity panel in the Overview tab.
1

Start the handshake

Press Start handshake. Custral emails the contact both halves at once, your agent’s two words first.
2

Say your two words

Read the words on screen aloud. The customer checks them against the email. If they do not match, the person who phoned them is not from your company, and they press the reject option in the email.
3

Take the six digits back

Ask the customer to read the six-digit code from the same email. Type it in. The panel flips to Verified.
Both halves are in the same email, agent’s words first, on purpose. A customer reading down the page checks the caller before giving anything away, so a stranger who has phoned them never reaches the digits.
The panel never shows you the customer’s digits. If it did, an agent could type them without anyone saying a word, and the exercise would be theatre.

What verification unlocks

A verification holds on that conversation for 30 minutes. While a call is in progress with a contact, these three actions need that caller verified: Everything else stays available. You can take notes, set a stage, change an owner and log an outcome on a call without verifying anybody, because blocking that would stop agents doing their job.
The gate only applies while a call is genuinely in progress with that contact. Ordinary CRM work outside a call is never affected, so a colleague editing a contact on a quiet Tuesday afternoon meets nothing.

When the customer cannot pass

Somebody whose phone was stolen, with their mailbox on it, cannot pass any of this, and your team still has to help them. Override skips the proof on a named person’s say so. It is available to workspace admins only, it requires a written reason, and it is the loudest entry in the audit log. Use it when you have satisfied yourself another way, and say how in the reason. Three wrong read-backs locks the contact for 15 minutes. Codes themselves expire after 10 minutes, so a call that has gone long just needs a fresh handshake.

The audit log

Every attempt is recorded: started, verified, mismatch, locked, expired, rejected and overridden. A log of only the attempts that worked answers no useful question. The entries worth having are three misreads on one account in an afternoon, and the override at 11pm. Contact addresses are masked before they are stored, because the log is read by people who were not on the call.
A rejected entry means a customer told you somebody phoned them pretending to be your company. That is a security incident arriving as a support event, and it is worth treating as one.

Limits

  • Codes are sent by email. SMS delivery is not built yet.
  • A contact with no email address on file cannot be verified this way. Custral says so before sending anything, rather than leaving an agent waiting for a code that never arrives.
  • The gate is a control on your agents’ workflow. It stops a stranger talking an honest agent into acting for them. It is not a restriction on what your own staff can reach through the API.

Troubleshooting