customer verification Security Questions for customer verification over telephone

[tallship]

I'm interested in using security questions  (available at for customer verification over the phone for account and technical support.

This appears to be implemented in a general way at: "Setup" ==> "Other" ==> "Security Questions", but if that is implemented, it also requires the user to answer their security question everytime they do a password reset for lost/forgotten password or when they want to change their password.

I don't want to implement security questions for password changes or recovery, but I do wish to use them for customer verification when providing support for incoming callers over the telephone.

Is there some way to have them choose a security question during registration but only have it available for the customer support rep to use for verification purposes over the phone?

What would really be nice is to have a one time PIN that they can generate by signing into their account that we can verify over the phone, but I'm not aware of such a feature in WHMCS.

Comments, suggestions?

[string]

27 minutes ago, tallship said:

What would really be nice is to have a one time PIN that they can generate by signing into their account that we can verify over the phone, but I'm not aware of such a feature in WHMCS.

WHMCS does not provide such function. There are addons on the marketplace listed with the possibility to generate PINs: Click the search button to get results

 

27 minutes ago, tallship said:

Is there some way to have them choose a security question during registration but only have it available for the customer support rep to use for verification purposes over the phone?

You could create a custom field.

Edited October 18, 2018 by string

[brian!]

On 18/10/2018 at 01:46, tallship said:

Is there some way to have them choose a security question during registration but only have it available for the customer support rep to use for verification purposes over the phone?

@string is absolutely correct with his suggestion - using a Client Custom Field would be the way to go... the user would be asked to create it during their first order (if they're a new client), or if they are an existing client and logged in, they'll be able to edit the answer to your security question in their client area profile.

On 18/10/2018 at 01:46, tallship said:

What would really be nice is to have a one time PIN that they can generate by signing into their account that we can verify over the phone, but I'm not aware of such a feature in WHMCS.

I replied to a similar question last year with example code...

it's very simple thing to do - you just need to decide where you want to show the PIN to the client... in the above example, it was a homepage panel... but you could equally put it in a sidebar (new/existing and decide which pages to show it on), menu navbar or output it in a template.

it would only require one hook file to display the PIN in both the admin and client areas - to use it, you would create a .php file in /includes/hooks, call it 'phonepin.php' and paste the code below into it...

<?php

# Telephone Security PIN Hook
# Written by brian!

add_hook('ClientAreaHomepagePanels', 1, function($homePagePanels)
{	
	$client = Menu::context('client');
	$length = 8;
	$phonepin = substr(preg_replace("/[^0-9]/", "", md5($client->id)), $length, $length);
	if ($phonepin) {
		$homePagePanels->addChild('Telephone PIN', array(
			'name' => 'Pin',
			'label' => '<strong>Telephone PIN</strong>',
			'icon' => 'fa-life-ring',
			'order' => 99,
			'extras' => array(
				'color' => 'pomegranate',
			),
			'bodyHtml' => '<p>Should you need to telephone Support, your PIN is: <strong>'.$phonepin.'</strong></p>'
		));
	}
});

add_hook('AdminAreaClientSummaryPage', 1, function($vars) {
	
	$length = 8;
	$phonepin = substr(preg_replace("/[^0-9]/", "", md5($vars["userid"])), $length, $length);
	return "<div class='alert alert-success'><strong>PIN: ".$phonepin."</strong></div>";
});

in this example, it's creating a basic PIN unique to each client and displaying it in a Panel on the Client Area homepage (the red box bottom-right)...

ideally, if you're site is multilingual, then you would use a Language Overrides to display both the panel label and the line of text within $bodyhtml in the client's language.

in the Admin Area Client Summary page, it will also output the same PIN for that particular client...

as I said previously, you could output it in a sidebar too (as shown in first image)...

add_hook('ClientAreaPrimarySidebar', 1, function($primarySidebar)
{	
	$client = Menu::context('client');
	$length = 8;
	$phonepin = substr(preg_replace("/[^0-9]/", "", md5($client->id)), $length, $length);
	if ($client && $phonepin) {
		$primarySidebar->addChild('Telephone PIN', array(
			'name' => 'Pin',
			'label' => 'Telephone PIN',
			'icon' => 'fa-life-ring',
			'order' => 10,
			'bodyHtml' => '<div class="text-center"><strong>'.$phonepin.'</strong></div>'
		));
	}
});

... or in the secondary navbar...

add_hook('ClientAreaSecondaryNavbar', 1, function($secondaryNavbar)
{	
	$client = Menu::context('client');
	$length = 8;
	$phonepin = substr(preg_replace("/[^0-9]/", "", md5($client->id)), $length, $length);
	if ($client && $phonepin && !is_null($secondaryNavbar->getChild('Account'))) {
		$secondaryNavbar->getChild('Account')->addChild('Telephone PIN', array(
			'label' => 'Telephone PIN: '.$phonepin,
			'order' => 75
		));
	}
});

as you can see, there are various options - all of which can be expanded to suit your needs.