> ## Documentation Index
> Fetch the complete documentation index at: https://docs.custral.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Caller verification

> Prove who is on the phone before you act for them, and prove your agent is real.

Every account-verification flow asks the same lopsided question: prove you are
who you say you are. Only the customer is ever asked. The agent, a voice on a
phone claiming to be your support team, is taken on trust.

Custral asks both sides. One exchange, two halves:

| Half              | Shape                     | Proves                                | Travels       |
| ----------------- | ------------------------- | ------------------------------------- | ------------- |
| **Agent words**   | two words, `amber falcon` | the caller works for you              | said out loud |
| **Customer code** | six digits, `418 602`     | the person speaking holds the account | read back     |

Words are spoken by you, digits are spoken by them. An agent glancing at their
screen mid-sentence can tell which way the exchange is running without reading a
label.

## Running a handshake

Open the conversation for the call and find the **Identity** panel in the
Overview tab.

<Steps>
  <Step title="Start the handshake">
    Press **Start handshake**. Custral emails the contact both halves at once,
    your agent's two words first.
  </Step>

  <Step title="Say your two words">
    Read the words on screen aloud. The customer checks them against the email.
    If they do not match, the person who phoned them is not from your company,
    and they press the reject option in the email.
  </Step>

  <Step title="Take the six digits back">
    Ask the customer to read the six-digit code from the same email. Type it in.
    The panel flips to **Verified**.
  </Step>
</Steps>

<Note>
  Both halves are in the same email, agent's words first, on purpose. A customer
  reading down the page checks the caller before giving anything away, so a
  stranger who has phoned them never reaches the digits.
</Note>

The panel never shows you the customer's digits. If it did, an agent could type
them without anyone saying a word, and the exercise would be theatre.

## What verification unlocks

A verification holds on that conversation for **30 minutes**. While a call is in
progress with a contact, these three actions need that caller verified:

| Action                                       | Why it is gated                                                       |
| -------------------------------------------- | --------------------------------------------------------------------- |
| Changing their email address or phone number | The classic takeover route: change the email, then reset the password |
| Sharing their record                         | A share link is a public URL to that contact's data                   |
| Deleting their record                        | Destroying the data of somebody who has not been identified           |

Everything else stays available. You can take notes, set a stage, change an
owner and log an outcome on a call without verifying anybody, because blocking
that would stop agents doing their job.

<Note>
  The gate only applies while a call is genuinely in progress with that contact.
  Ordinary CRM work outside a call is never affected, so a colleague editing a
  contact on a quiet Tuesday afternoon meets nothing.
</Note>

## When the customer cannot pass

Somebody whose phone was stolen, with their mailbox on it, cannot pass any of
this, and your team still has to help them.

**Override** skips the proof on a named person's say so. It is available to
workspace admins only, it requires a written reason, and it is the loudest entry
in the audit log. Use it when you have satisfied yourself another way, and say
how in the reason.

Three wrong read-backs locks the contact for 15 minutes. Codes themselves expire
after 10 minutes, so a call that has gone long just needs a fresh handshake.

## The audit log

Every attempt is recorded: started, verified, mismatch, locked, expired,
rejected and overridden. A log of only the attempts that worked answers no
useful question. The entries worth having are three misreads on one account in
an afternoon, and the override at 11pm.

Contact addresses are masked before they are stored, because the log is read by
people who were not on the call.

<Warning>
  A `rejected` entry means a customer told you somebody phoned them pretending to
  be your company. That is a security incident arriving as a support event, and
  it is worth treating as one.
</Warning>

## Limits

* Codes are sent by **email**. SMS delivery is not built yet.
* A contact with no email address on file cannot be verified this way. Custral
  says so before sending anything, rather than leaving an agent waiting for a
  code that never arrives.
* The gate is a control on your agents' workflow. It stops a stranger talking an
  honest agent into acting for them. It is not a restriction on what your own
  staff can reach through the API.

## Troubleshooting

| Symptom                       | Likely cause                             | What to check                                                                                                             |
| ----------------------------- | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| "There's nobody to verify"    | The call is not linked to a contact      | The caller's number does not match any contact's phone property. Add it, or open the handshake from the contact's record. |
| "No email on file"            | The contact has no email property filled | Add an email address to the contact, then start the handshake again.                                                      |
| "Verification is locked"      | Three wrong read-backs                   | Wait 15 minutes, or ask an admin to override with a reason.                                                               |
| Code arrives but is refused   | The handshake expired                    | Codes last 10 minutes. Start a new handshake.                                                                             |
| An action is refused mid-call | The caller is not verified yet           | Run the handshake from the Identity panel, or ask an admin to override.                                                   |


## Related topics

- [Phone & SMS Numbers](/comms/voice/numbers.md)
- [Caller ID](/comms/voice/caller-id.md)
- [Get support](/support.md)
- [Troubleshooting](/comms/voice/troubleshooting.md)
- [Deliverability](/comms/deliverability/overview.md)