Orders and identity
Email verification
The one-time code that verifies a guest for one order, how long it lasts and how it protects against enumeration.
For actions on an order (cancellation, return request) or when the second factor isn't available, the assistant can send a 6-digit code to the order's email address.
- The shopper gives the order number and email.
- If they match an order, the code is sent to the order's email (the platform's address, which equals the typed one). The email contains the code, your store name and the order number, no link.
- The shopper types the code into the form in the chat. The code never passes through the AI.
The verification lasts 30 minutes from the last use and at most 2 hours. Actions proposed more than 15 minutes after verification ask for a new code.
Protection
- If no order matches, the chat behaves exactly the same (a code form appears) but no email is sent, so the form reveals nothing about which orders exist.
- 3 requests per hour per order and 5 per session; 5 wrong codes lock the verification; resend at most 3 times, once a minute.
- Per-recipient email limits stop the form from being used to spam someone.
Switch it off in Orders & actions → Order status → Email verification.
Last updated on