I'm involved in a project that's building a chat-bot that users can communicate with via SMS from their mobile phones. We'd like the users to be able to use the bot to do some basic account-management tasks over SMS for their accounts with us - changing their base plan, purchasing additional features, etc.
We're wondering if there's any way to (reasonably) securely identify that the user sending the text message is truly the account owner? Options we've considered are 1) ask for the last 4 of the user's credit card and 2) send a one-time-use passcode to the user via email.
Obviously, neither of those provides air-tight security, but the liability involved here is fairly low. If somebody loses their smartphone, the charges that the thief could make using this chat bot would be the least of the person's worries. In the rare event that somebody's phone was compromised, we'd be willing to eat the costs necessary to make the user whole.
However, we'd still like to make this identification process as secure as possible. Problems we see:
With scenario 1, the last 4 of the credit card are potentially left in the SMS history, so anybody who gets the phone (or installs a malicious app) has access to the last 4 of the card and can now authenticate.
With scenario 2, anybody that has access to the phone has access to the email, so it's not really much of an improvement over 1.
Are there any other techniques that we could use to authenticate that might provide more security than those two methods? I'm aware nothing will be air-tight, but I'm looking for good suggestions.
I've considered something like send a salt, have them compute a hash of their last-4, and send it back, but that's prohibitively complex, and still not much of a security improvement.