enable telephone verification for users

[mack]

One of my websites is a business directory. As our traffic grows we are seeing a huge increase in the number of businesses wishing to make edits.

As it stands every request needs to be manualy verified either by calling the company to ensure the request has came from them, or requesting they write to us. We then manualy make sure their details are correct and make changes.

We are looking to automate this. We currently have a PBX for our phone system (asterisk) and are looking to incorporate our "claim a listing" feature into this...

User clicks on a claim a listing link from their company listing page. They are prompted to create an account. Once they have finished the registration process they will be taken back to the "claim a listing" page. They will be provided with a 4 digit pin number. They will be prompted to write down the pin and call a phone number from the number we have for their listing.

When they call in they will be prompted to key in the pin...

Our system will know the number the call is coming from. It will also know the pin that has been issued. If the two details match we can update the owner ID for the listing being claimed.

Does this sound like a plausible way of doing this? And is it something that could be done using Asterisk or any other PBX?

Any more ideas how I could achieve this?

Mack.

[LifeinAsia]

Is the call-in number an 800 number? Although I am guessing that a lot of people have free long-distance included on their phone service these days, a lot of companies may not have it on the incoming number.

For others, the outgoing number may be different from the public (inbound) number.

But I think this would probably work for the majority of businesses.

Our system will know the number the call is coming from.

Can this check if the caller is spoofing his number?

[mack]

Can this check if the caller is spoofing his number?

Good point and something I only looked into last night. It is something I hadn't even thought about, time for more reading lol.

The Number is a UK non geographical number (0845) and is fairly common for UK business. It's a fixed rate regardless of distance. All calls will be from within the UK.

Thanks for your tips.

Mack.

[LifeinAsia]

Ah, forgot you are "over there." :)

Not sure how different the phone system/callerID is over there, so not sure if spoofing is widespread there or even possible.

[Howzitza]

How about mobile sms system?
If you have a record that includes mobile phone numbers, will you be able to setup an automated sms verification system.

[mack]

Thanks Howzita,

I am also looking into this as a possible solution, but currently only around 5% of the data we have uses mobile numbers. It is something that may well be more effective for users who do have a mobile listed.

In effect all I need to do is text a pin number and have them enter the pin within a web form to confirm their identity.

Another problem is the outbound messages would incur a financial hit to us.

Mack.

[brotherhood of LAN]

I've worked a bit with inbound messages, including verifying accounts by responding with 10 wmv's to imitate numbers being pressed... phone integration with the web is an interesting beast.

You might want to look into something similar that recognises the tone of the digits pressed, alternatively there are some services that'll transcribe voice calls into text. Given the way Scottish accents and software work, the dial tones are probably more user-friendly.

I was using a UK provider that gives you local numbers for a couple of quid a month... they can forward incoming calls/texts to your own scripts.

[mack]

Thanks BOL. Curently we have a number through a provider. We use asterisk pbx to manage an automated IVR (press 1 for this 2 for that) its not easy to have the pbx interact with existing data. Specificaly php Mysql :-)

Mack.

[brotherhood of LAN]

Had to google IVR, not too familiar with the lingo!

Since you prefer to receive the calls than make them, is it perhaps possible that they can enter their 4 digit pin as an extension number? If that were possible I'd ask them to include their submitted phone number in the extension too if possible, I often use my UK mobile when creating accounts which I have here in Canada, but it's almost always switched off. Someone might fill in details from home but use their work number.

If that approach is workable you'd just have to have 3 messages, intro and pass/fail, and maybe a 'please retry'

// added
I suppose adding the phone number in doesn't exactly help in the verification, but maybe the pin # as an extension might simplify the process.

[Howzitza]

Mack, had no time to look into IVR. But how bout the following...
Surely you can get them to send the the number to a short sms number system and they will get a "pin" for verification on your site?
This will also automate the system?

[mack]

What we are setting up will be automated. The user will get a r digit pin from the site. They then call through, select option 2 to claim a listing. Our system will know what pin they have been allocated. It will also know the number we have on record for their business. The phone system will ask them to key in their pin. If the pin and the number they call from matches our records then we assign the listing to them.

There are issues, for example we may have the phone number incorrect. We have a few solutions in place for this. Most involve manual processing...

The problem with getting the user to text the code to us is many of the numbers are landline numbers.

BOL, The extensions idea is something I had looked into. The problem being we have over a million listings. It would also be fairly easy to circumnavigate.

What I am trying to avoid is a user being able to claim another companies listing and make edits. The solution needs to be able to reliably determine that the person trying to claim the listing is able to call us from the companies phone number.

Mack.