The moment an agent connects to your own systems, a new question appears: who is this? "My customer number is 10482, what do I owe?" is a reasonable question from the customer and a very bad one from anybody else who happens to know the number. Typing a number into a chat proves nothing.
SuperCognit agents can now prove it. The platform sends a 6-digit code to a phone or an email address, the person types it into a code box in the chat, and from then on the conversation knows that phone, that address or that customer is real. The AI never sees the code, and the tools that need proof refuse to run until it is there.
Three checks, for three kinds of tool
Identity verification lives on the agent's Tools tab. It has three checks, and you turn on only the ones your tools need:
The customer check is the strongest of the three, because the code never goes to a contact the person typed. Your lookup tool finds the customer's record, and the code goes to the phone or email already on it. Someone who only knows a customer number gets nowhere.
What it looks like in the chat
The visitor asks for something private
"Send me the link to my account." The tool behind it needs a verified phone, so the agent asks for the mobile number instead of guessing.
A code goes out
The platform sends the code and the chat shows a code box with the masked contact, so the person knows where to look. The box takes focus, ready to type.
The person types it
A wrong code is refused; the right one shows "✓ Verified". If they reload the page in the meantime, the code box comes back where it was.
The tool runs with the proven value
Your tool receives the verified number, not whatever the visitor typed later. Asking for "the link for this other number" does not work.
WhatsApp, SMS or email
At the top of the card, "How codes are sent" sets the delivery for the whole agent. Phone codes go either by WhatsApp or by SMS, and the choice covers both the mobile check and codes sent to the phone on file.
- WhatsApp codes come from your agent's own WhatsApp number, using an authentication template that Meta has approved. "Check with Meta", next to the template fields, asks Meta whether the template exists, is an authentication template in that language and is approved, before a customer ever waits for a code.
- SMS codes come from SuperCognit's SMS number, for businesses that do not want to run WhatsApp templates. Each SMS is billed to your usage balance. If the option shows as not available, ask SuperCognit support.
- Email codes are a plain email with the code, in the language of the conversation.
When no code is needed
Codes are friction, so the platform skips them when it already knows. On WhatsApp, Meta already vouches for the sender's number, so the mobile check is not offered there. And if a conversation has already proved a phone — the person writes on WhatsApp, or typed a WhatsApp code on the web — and that number matches the one on the customer's record, the customer is verified without a second code.
The opposite case matters just as much. If the proven phone is a different number from the one on file, the check is refused and no code goes to anyone: that is someone else's account. The agent says nothing about the record and offers a person instead, which is also the right path for a customer whose phone on file is out of date.
Limits that protect other people
A code box can be abused to flood someone else's phone or inbox, so each check has daily limits: codes a day for the whole agent, and codes a day per number or per address, three by default. A proof lasts 12 hours in the conversation.
Set it up
See which tools need proof
Tools that need a verified mobile, email or customer are tagged in the agent's tool list and on the workspace Tools page. Each check on the card lists the tools that use it under "Used by", in red if a tool needs a check that is off.
Choose how codes are sent
Pick WhatsApp or SMS for phone codes. For WhatsApp, add the template name and language and press "Check with Meta".
Turn on the checks
For the customer check, choose your lookup tool, the input that receives the identifier, and where the phone or email sits in its reply.
Save
Saving is refused, with a red line under the exact field, while a check you turned on cannot work yet: a missing template, no lookup tool, no path.
Whether a tool needs a verified caller is also returned by the API and the platform MCP tools. If verification still is not enough for a request, hand it to a person: your team can take over from the AI agent. The October roundup has the rest of this month's changes.
Frequently asked questions
How do I verify a customer's identity in a chatbot?
Send a one-time code to a contact you trust and ask the person to type it back. In SuperCognit the platform sends a 6-digit code by WhatsApp, SMS or email, checks it, and only then lets tools that need a verified phone, email or customer run. The AI never sees the code.
Do WhatsApp users need to verify their phone number?
No. On WhatsApp the sender's number is already known, so the mobile check is not offered there. If that number matches the phone on the customer's record, the customer check passes without a code too.
Can I send verification codes by SMS instead of WhatsApp?
Yes. Under "How codes are sent", choose SMS for phone codes. They come from SuperCognit's SMS number and each one is billed to your usage balance. If SMS shows as not available, ask SuperCognit support.
What happens if someone types another person's customer number?
The code goes to the phone or email on that customer's record, never to a contact the person typed, so they cannot read it. If the conversation already proved a different phone, the check is refused, nothing is sent and the agent offers a person.
How long does a verification last?
12 hours within the same conversation. Each proof — phone, email, customer — keeps its own clock.
