Customer identification
How the AI agent collects contact details and confirms who it is talking to before opening a customer's data.
When a customer asks about something that is theirs — an order, a booking, a delivery, an account — the AI agent needs to know who they are. It collects contact details naturally during the conversation, and confirms them before it opens anything stored about that person.
A customer typing an email address is a claim, never proof. Chatasist treats it that way: a claim alone can never open an existing customer's record.
What the agent does#
It asks in passing, not as a form
When the question needs it, the agent asks for an email or a phone number in one short sentence, in the customer's own language — never a three-field questionnaire.
It matches against your customers
Chatasist checks the details against your existing customer records. Phone numbers are
compared regardless of how they were typed, so +994 (55) 111-22-33 and 994551112233
resolve to the same person.
New contacts flow straight through
If nothing matches, the details are simply saved onto the visitor's own record and the conversation continues. There is no code, no friction, and no interruption.
Existing customers confirm with a code
If the details match somebody already in your CRM, that record stays sealed. The agent offers to send a 6-digit code, and only opens the record once the customer enters it.
Why the code is safe#
The code is always sent to the address already on file — never to the address typed in the chat. Someone who claims a stranger's email therefore causes a code to be sent to the real owner, and learns nothing.
- The agent shows only a masked hint of the destination, like
s•••r@gmail.com. - Codes expire after 10 minutes.
- 5 wrong attempts end the attempt; 3 codes maximum per conversation, with a short wait between sends.
- The agent's reply is the same whether or not the address belongs to a customer, so the chat cannot be used to find out who your customers are.
- Until a chat is confirmed, the agent will never read out a stored name, email, phone or address — even if the visitor insists it is theirs.
If a customer declines to confirm, the agent keeps helping with everything that isn't specific to their account, and offers a ticket for the rest.
WhatsApp usually needs no code#
On WhatsApp the phone number comes from the carrier, not from the person typing, so it already proves who they are. When that number matches an existing customer, the conversation is linked automatically and no code is sent.
There is one exception. WhatsApp lets people message a business by username, without sharing their number. Those chats arrive with an id that is unique to your business and nothing else — it is not a phone number, and it cannot be matched against your customer records. Someone messaging that way confirms with a code like anyone else, and once they have, their WhatsApp identity stays attached to the customer it was confirmed against.
Telegram and Instagram handles prove nothing — a username can be anything — so those channels use the code flow like the web widget does.
Confirming works on every channel#
A confirmed customer can have their orders, bookings and deliveries looked up wherever they are writing from — the website widget, WhatsApp, Facebook, Instagram or Telegram.
This needs your data source to accept a confirmed identity from Chatasist. If it only recognises customers signed in on your own website, the agent will say up front that it cannot check an order on that channel rather than asking for a code it cannot use. See Resources & MCP.
Asking for the right reference#
When a customer raises something about one of your Resources — "where is my order", "I want to change my booking" — what the agent does depends on whether it knows who they are.
A confirmed customer is simply shown their own records as tappable cards: asking somebody to type an order number so you can show them their orders is asking them to do the lookup for you. It only asks for a specific reference when the list comes back empty, or when they are asking about something that is not theirs.
Anyone not confirmed is asked for that dataset's identifier right away, in the first reply, instead of a vague "how can I help?".
What it asks for comes from your own configuration: set an identifier hint on the resource (for example "a tracking code starting with CMX" or "your booking reference"). When no hint is set, the agent falls back to the resource's first required field. Nothing about any particular business is built into the agent — each workspace's wording is its own.
What operators see#
A confirmed conversation is attached to the customer's record in the inbox, so the history, CRM details and previous conversations are all in one place. Conversations that were never confirmed stay on the visitor's own record and can be merged by an operator later.