How Do Bots Know Who They're Talking To?
It depends on the channel. Website visitors are usually anonymous, a phone number is a hint rather than proof, and a signed-in portal user can be identified with confidence. Before a bot shows personal information or changes anything, it needs a reliable way to know who it's talking to, and permission to act for them.
Website Visitors: Anonymous by Default
A public website chatbot usually doesn't know who the visitor is. It can answer general questions, and it can ask for a name or email if the visitor wants to share one. But a visitor typing "I'm Jane Smith" hasn't proven anything, so the bot shouldn't show Jane's account details on that basis.
A visitor's IP address doesn't identify them either. Many people can share one address, like everyone on an office or coffee shop network, and anyone can change theirs with a VPN.
Anonymity Has an Upside
People ask a bot things they'd be embarrassed to ask a person. Letting visitors stay anonymous invites more honest questions, which matters most in fields like HR, wellness, and workplace safety, where nobody wants to look uninformed. The bot still knows its limits: it doesn't give medical advice, and it points people to a doctor or the right person when they need one. But it lets someone start privately and ask what they really want to know.
Phone Callers: A Clue, Not Proof
Phone systems usually pass along the caller's number. That's useful context, but caller ID can be spoofed, and phones are shared. A phone number on its own shouldn't unlock private records or allow account changes.
Signed-In Users: Known Identity
When someone is already signed in to a business's website or app, the bot can rely on that sign-in. The application vouches for who the user is, so the bot can answer from that person's own account.
Verifying Before Sensitive Actions
For sensitive actions, like canceling an appointment or sharing account details, a bot may need an extra check: a sign-in, a code, or details only the real customer would know. The level of check should match the risk.
Authentication vs. Authorization
These are two separate questions:
- Authentication: Who is this person? Can we confirm it?
- Authorization: What is this person allowed to see or do?
A bot can know exactly who someone is and still not let them see a record that isn't theirs. Access to customer records should be limited by the same permissions the business already uses.
How Does Authava Handle Identity?
- Public website bots start anonymous, and contact details are collected only through conversation.
- The Portal Bot recognizes users who are signed in to your application, for example through AWS Cognito, without a second login.
- Identity travels in a signed token when the bot calls your systems, and tools can be limited to signed-in users. See MCP Gateway.
- The Scheduling module is designed to change an appointment only for the person it belongs to.
For security and data handling, see How Is My Data Safe With Authava?
Frequently Asked Questions
Does a chatbot know who I am?
On a public website, usually not, unless you share your details. Inside a site you're signed in to, the bot can recognize you through that sign-in.
Can a phone number prove who's calling?
No. Caller ID is a helpful clue, but it can be spoofed and phones are shared, so it shouldn't unlock private information on its own.
Can a website visitor's IP address prove who they are?
No. An IP address doesn't uniquely identify a person: many people can share one, and anyone can use a VPN to change theirs.
What's the difference between authentication and authorization?
Authentication confirms who someone is. Authorization decides what they're allowed to see or do.