Identity Verification by Phone: What It Proves and Where It Stops

How to verify a caller's identity by phone: what a one-time code proves, where it falls short, and a tiered flow for order and refund calls in a WooCommerce store.

Customer entering a phone verification code

Phone verification confirms that someone controls a phone number. It does not, on its own, prove that the person is who they claim to be. For a store taking support calls, that gap decides everything: a caller who passes a code check can be trusted with an order status, but not automatically with a refund or an address change.

This guide is for WooCommerce store owners and support managers who need to verify callers without turning every call into an interrogation. It covers how a code check works, what the standards say, where phone checks fail, and a tiered flow you can apply to order lookups, returns and account changes.

Orphora AI
orphoraai.com
Handle WooCommerce Support Calls Faster
Orphora AI voice agents access real-time order and customer data to answer common inquiries, including order status and returns, around the clock.

Explore Orphora AI

TL;DR

  • Phone verification proves control of a number, not civil identity. Treat it as one factor, not a verdict.
  • A sound code flow uses a random one-time code of at least six digits that expires within 10 minutes and works once, per NIST’s current guidance.
  • Never ask a caller to read a code aloud to an agent. Use keypad entry, a secure SMS link or the customer’s own account.
  • Match the check to the stakes: order status needs little, refunds and address changes need a second factor, and recent SIM changes should block high-impact actions.

Table of Contents

What phone verification actually proves

There are two different jobs that people call “identity verification by phone.”

The first is phone number verification: you send a code to a number and the person enters it back. If it matches, you know that whoever is typing or keying the code can receive messages or calls on that number right now.

The second is identity proofing: establishing that a real, specific person is who they say they are. That usually involves documents, records and sometimes a selfie.

NIST’s authenticator guidance treats SMS and voice as an out-of-band channel, meaning a separate path that the claimant is expected to possess and control. The NIST authentication guidelines describe it as a device that supports private communication over this secondary channel. That is a possession factor. It says the caller holds the phone. It says nothing about whether the caller is the account holder, because phones are lost, shared and cloned.

NIST also notes that people often share devices, such as a family phone that receives one-time codes, in its authenticator requirements. In a store, that means a spouse or teenager might legitimately pass a code check on the account holder’s number. Whether that matters depends on what they are asking for.

What phone verification actually proves — overview diagram

How a one-time code check works

The basic sequence is short:

  1. Collect the customer’s phone number.
  2. Generate a random one-time code and send it by SMS or voice call.
  3. Have the customer enter the code in your website, app or phone menu.
  4. Mark the number verified only if the code matches and has not expired.

NIST’s identity-proofing guidance, SP 800-63A-4, sets the numbers: phone confirmation codes must contain at least six digits, be valid for no more than 10 minutes, and be invalidated after use. The same family of guidance calls for rate limiting on short secrets, so an attacker cannot guess codes in bulk. Build in a retry cap and a lockout.

The guidance also expects an alternative method for customers who cannot use the phone network for codes. Some callers have no SMS, a landline, or a shared line. Give them another route, such as a link emailed to the address on the order, rather than turning them away.

What the same step looks like in a risk-based product

Identity vendors separate these layers clearly. Plaid’s identity verification documentation describes verifying phone numbers, identity documents, name, date of birth, ID numbers and addresses as distinct checks. Its SMS verification confirms possession of a number, while data-source verification compares identity details against available records.

Plaid also documents phone risk checks that look for throwaway or burner numbers, using registration with more than 90 services as a signal. You do not need a vendor to borrow the principle: routine callers go through a quick code flow, and only unusual signals trigger stronger checks.

When a phone check is not enough: the IRS example

It helps to see what a high-stakes organization does. The IRS uses ID.me as its identity-verification technology partner for online accounts. According to the IRS account creation instructions, when identity verification is required you need an SSN or ITIN plus a government-issued photo ID such as a driver’s license, state ID, passport or passport card. Verification is done by an ID photo and selfie, or with a live video-chat agent.

Can you verify with the IRS by phone? Usually not as a general substitute. For tax returns flagged for possible identity theft, the Taxpayer Advocate Service says the IRS letter may offer online and phone options, and the taxpayer must follow that specific letter’s instructions. The same guidance warns against calling an unsolicited number or giving a verification code to an unexpected caller. Use IRS.gov or the number printed on the official notice.

The lesson for retailers is proportion. A false match at the IRS is costly, so the process is heavy. A false match on an order-status call is cheap, so a heavy process would only drive customers away. Your job is to place each request on that scale.

Why caller ID and a matching number are not authorization

Two habits cause most trouble in phone support: trusting caller ID, and trusting that the number on the call matches the number on the account.

The FCC identifies SIM-swap and port-out fraud as ways attackers take over a victim’s number, so they receive that person’s calls and texts. In its November 2023 announcement, the FCC adopted rules to protect cell phone accounts against these scams. The Report and Order requires carriers to use secure authentication and to notify customers of SIM-change or port-out requests.

For a store, the consequence is direct. If an attacker controls the victim’s number, a code sent to that number will pass. So a code alone should never unlock a refund to a new payment method, a changed shipping address, or an account email change.

NIST makes the same point: it recommends considering SIM changes, device swaps and number porting before relying on public phone network authentication. If you can learn that a number was recently ported or its SIM changed, treat that as a reason to block high-impact actions until the customer completes an independent factor.

Never ask the caller to read a code out loud

There is one pattern to avoid completely. A legitimate support system should not pressure a caller to speak a one-time code to a person or a bot. The FTC explains in its consumer alert on verification codes that customers should never share a verification code with someone who contacts them unexpectedly. That is exactly how scammers operate, and teaching customers to recite codes on calls makes your brand look like one.

Safer patterns for support calls:

  • Keypad entry. The customer types the code on the phone keypad, so no one hears it.
  • Secure SMS link. The customer taps a link sent to the number on file and confirms in a browser.
  • Customer-initiated authentication. The customer signs into their account and approves the request there.
  • Customer-initiated calls. The customer calls you. You do not call out and ask them to prove who they are.

The FTC also describes two-factor authentication as an added layer beyond a password, which is the framing to use with customers: the code protects them.

Order verification by phone: a tiered flow

Most store calls are not high risk. People ask where an order is. The right design lets those calls through quickly and applies friction only when the request could do harm. Here is a practical tiering you can adapt. It is our suggested design based on the principles above, not a regulatory requirement.

Request Risk Suggested check
General policy or shipping questions None No verification needed
Order status Low Order number plus the email or ZIP code on the order
Return label request Medium Order number plus a code sent to the number on file, entered by keypad
Refund, address change, email change High Code check plus a second factor from the account, and no recent SIM or number change
Anything flagged unusual Escalate Hand off to a human with context

Tier 1: no personal data, no check

If the answer is the same for everyone, such as your return window or shipping times, there is nothing to verify. Do not put a gate in front of public information.

Tier 2: knowledge of the order

For order status, asking for the order number and something tied to it, such as the billing ZIP or email, is a reasonable bar. Share limited details, such as status and expected delivery, and avoid reading out full addresses or payment information.

Tier 3 and 4: possession plus knowledge

When the action changes money or destinations, combine factors: something the caller knows from the order history, plus possession of the phone via a code. NIST’s framing explains why: phone verification authenticates a separate channel, not the full identity, so the stronger assurance comes from combining it with order-history knowledge and risk signals.

Add a step-up for risk. Duplicate identities, burner-number signals, a new number on an old account, or a recent SIM change should push the request toward an independent factor or a human reviewer.

Verification checks increase with request risk

Escalation without making the customer repeat themselves

When a call needs a person, pass along what was already verified so the customer does not start over. We cover that handoff in our guide to AI to human escalation rules.

Setting up the flow in a WooCommerce store

A workable build, step by step:

  1. List your actions. Write down every request callers make and assign each a tier.
  2. Decide the data you will confirm. For WooCommerce, order number, billing email and billing ZIP are the usual fields.
  3. Choose the code channel. SMS to the number on file, with keypad entry on the call. Offer an email link as the fallback.
  4. Set limits. Six digits or more, 10 minutes or less, single use, and a cap on attempts.
  5. Block high-impact actions after number changes. If you can see a recent change to the phone number on the account, require a second independent factor.
  6. Log and review. Keep transcripts and recordings for disputes, with proper notice. Our call recording compliance plan walks through the steps.
  7. Test with real scripts. Run mistakes through it: wrong order numbers, expired codes, callers who blurt a code aloud. Our piece on voice AI accuracy testing covers how to test orders, returns and codes.

Before going live with any automated phone channel, run through the pre-launch checks for a WooCommerce voice bot.

Our perspective on verifying callers

We build voice agents for WooCommerce stores, so we see this problem from the inside. Our view is that the verification step should follow the action, not the call. An agent that can read order data in real time can answer a status question the moment the caller supplies the order details. It should not treat a refund or a changed address the same way.

That is why we build around guardrail workflows for order actions: the agent can look up an order and explain a return policy freely, while actions that change an order sit behind defined checks you control. We also think a voice agent has an advantage here. A scripted flow asks every caller the same questions in the same order, never gets tired, and never gets talked into skipping a step by a persuasive caller.

The store still owns the policy. Decide your tiers first, then configure the agent to follow them. And when the signals look wrong, the right answer is a handoff to a person, not a cleverer bot.

— Orphora AI

Putting it into practice with Orphora AI

If you run WooCommerce and want phone support that handles order lookups and returns around the clock, our AI voice agents connect to your store data. The AI Voice Agent plan is $9.99 per month per agent, and conversation minutes are $0.10 per minute. An Enterprise plan is available without a published price. You can customize the agent and tie it to your knowledge base, and call analytics plus recordings and transcripts help you review how verification plays out on real calls.

If you plan to feed the agent your policies, keep the knowledge base lean, as we explain in our note on keeping voice bot knowledge bases small.

Common mistakes to avoid

  • Treating the inbound number as proof. Caller ID can be spoofed, and a number can change hands through a SIM swap or port-out.
  • Using one check for everything. A single gate is either too weak for refunds or too heavy for order status.
  • Reading codes aloud. It trains customers into the exact behavior scammers exploit.
  • No fallback. Callers without SMS access should have an alternative path, as NIST’s guidance expects.
  • Endless retries. Unlimited attempts invite guessing. Cap them.
  • Revealing too much after a weak check. Even a verified order-status caller does not need to hear a full card number or complete address.

FAQ

How do you verify a caller’s identity over the phone?

Start by deciding what the caller is asking for. For low-risk requests, ask for details only the customer would have, such as an order number and the billing ZIP. For higher-risk actions, add a one-time code sent to the number on file and entered by keypad, then a second factor from the account.

Is a text code enough to prove who someone is?

No. A code proves the person controls the phone number at that moment. NIST treats this as a possession factor, and the FCC notes that SIM-swap and port-out fraud can put a victim’s number in an attacker’s hands. Pair it with knowledge of the order or account.

Can you verify your identity with the IRS over the phone?

Usually not as a general route. The IRS describes ID.me self-service or a live video-chat agent for account verification. For a flagged tax return, follow the instructions in the official letter and use the number printed on it, not an unsolicited caller’s.

How long should a verification code last?

NIST’s current guidance says phone confirmation codes should have at least six digits, be valid for no more than 10 minutes, and be invalidated after use. Add rate limits so codes cannot be guessed repeatedly.

Sources