Identity and verification
One approval. The highest level of assurance.
Before an agent reaches a customer’s own data, establishes who is asking. A national eID settles that in one approval, in the MitID or BankID app on your customer’s phone. They approve, and the agent answers.
Verify with
Why it matters
An agent that can act has to know who is asking
Someone on your team could recognise a voice or trust a familiar address, and where that judgement went wrong the cost was usually small and slow to surface. An agent that reads your order book, moves a delivery or issues a credit is acting inside the systems that run your business. From that point, being sure who is on the other end matters more than anything else you set up.
So two things have to be true at once. You have to be sure enough for what is being asked, and your customer has to be able to prove it in the few seconds they are willing to spend. A national eID does both.
Without a national eID
Two proofs of different kinds
The top level asks for one proof of each kind, so your customer supplies both.
Questions
Questions you wrote about their own orders and invoices. oHallo checks each answer against your system as it asks.
Email link
A link that works once. oHallo emails it to the address on your record, and your customer opens it.
With a national eID
One approval
MitID and BankID have already proved the person, so one approval reaches the same level on its own.
National eID
An approval appears in MitID or BankID on your customer’s own phone. They accept it, and they are verified.
Approve for
your company
How a customer verifies
Your customer approves on the phone in their hand
Your customer is asked to prove who they are only when the request needs it. Someone checking your opening hours is answered and left alone. Someone asking for their own invoice proves who they are once, and the agent answers straight after.
The approval reaches a named person
Your own record says who the customer is, and the approval goes to that person in their own MitID or BankID app. Proving who you are opens your own orders and nobody else’s.
Your customer stays where they are
The approval opens in the MitID or BankID app itself, so your customer stays on the call, or in the email or chat they started.
Your customer proves who they are once
They prove who they are when the request needs it, and that proof holds for everything that follows. A published price stays open to anyone who asks.
Verifiedwithout
leavingthecall
orthemessage.
Verification
Five ways to prove a customer’s identity
You choose which methods each channel offers, and your customer only meets the ones you have turned on there.
One approval
An approval request appears in MitID or BankID on your customer’s own phone. They accept it, and they are verified. MitID and BankID have already established who that person is, so there is nothing for them to recall and nothing to type. It is the strongest proof of identity a European customer holds.
Assurance
Every action is measured against the level it requires
Identity comes in levels. Your customer reaches a level by proving who they are, and every sensitive action states the level it will accept. The levels mean the same thing on voice, email, chat and WhatsApp. Only the way your customer proves it changes.
Unlocks: The most sensitive data and actions
Unlocks: What that customer is entitled to
Unlocks: Only what is safe for anyone
Each method, by channel and by kind
| Method | Voice | Chat | Kind of proof | ||
|---|---|---|---|---|---|
| National eID | Something they hold | ||||
| Questions | Something they know | ||||
| Email link | Something they hold | ||||
| Caller ID | Caller ID is unavailable on Email | Caller ID is unavailable on Chat | Caller ID is unavailable on WhatsApp | Where the call came from | |
| Email sender address | Email sender address is unavailable on Voice | Email sender address is unavailable on Chat | Email sender address is unavailable on WhatsApp | Where the message came from |
A national eID reaches the top level on its own
Two proofs of different kinds reach the highest level, which is why a question pairs with a link. A national eID is the exception: MitID and BankID have already proved the person, so one approval reaches the top level by itself. That is enough for a refund or a cancellation.
Your questions are identity proofing
The NIST guidance withdrew security questions as an authenticator. Questions here follow its identity-proofing procedure instead: every answer is read live from your own records as the question is asked, every enabled question has to be right, and the strictest reading expects four. Your compliance posture reports the configuration you actually made.
Built on
The frameworks the model rests on
NIST SP 800-63
The reference framework for digital identity. It separates how confident you are that a real person matches the claimed identity from how confident you are that the right person is present in this session. Our three levels sit on those two scales.
eIDAS
The European regulation behind MitID and BankID. It grades how strong each national eID counts as, and oHallo accepts one only at the strength it has formally been granted.
PSD2 Article 97
The origin of the factor-category vocabulary the whole industry uses: knowledge, possession and inherence. We adopt the vocabulary. A payment action stays your payment provider’s to authenticate.
GDPR Article 12
The duty to verify the identity of a person exercising their rights, proportionate to what they are asking for. It is the reason the bar rises with the sensitivity of the request rather than sitting at the front door.
Your rules
You decide how much proof each request needs
Your opening hours are open to anyone who asks. An invoice belongs to the customer it was issued to. A refund is the kind of thing you would want a person to be sure about. Those are your judgements, and you make them once, on each action in each system you connect.
From then on an agent waits until it has what you asked for. It cannot talk its way past your decision, because your decision is checked before the agent runs, in a place no message can reach.
Every action passes this before it runs
Account isolation
A request made for one customer stays inside that customer’s own data. Absolute, and checked first.
Assurance level
Has the customer proved enough for what they are asking?
Guardrails
Your thresholds, your approvals, your masking rules.
It answers in one of four ways
The action runs
Your system is never opened
One of your team confirms it
It runs, and sensitive fields are held back
Your settings page is where you decide the rest. Which methods each channel offers. Whether a recognised number is enough on its own or still needs a question alongside it. The refund figure above which one of your team confirms it first. Which fields an agent never sees.
Your setup is confirmed on every channel
It shows, channel by channel, which of your questions apply there, so you know what a customer will be asked before the first call. If a field changes in one of your own systems, the question that reads it is flagged with the date, ready for you to point somewhere new.
Your settings checked against the standards
Your settings are checked against the NIST identity guidance and against how long the GDPR lets you keep things, from the choices you have actually made. Where a choice lowers the bar, the page names which one.
Your data
The answer is read from your system and kept where the agent cannot see it
When a question is asked, oHallo reads the answer live from your own system and holds it aside. The agent relays what the customer said and is never shown what was expected, so no wording can talk it into passing a caller.
The same rule governs what comes back. Sensitive fields are removed before a result reaches the agent, so it can only say what it was given.
What your system returns
What the agent receives
Your own records answer who a customer is. oHallo stores the customer id your system returns and a record of each verification, and keeps no copy of the answers to your questions.
Watch a customer prove who they are, and see what happens next
Book a demo. Watch a caller prove who they are, then watch the agent answer what they called about.