How to answer customers on messaging apps with an AI agent

A phone number on a messaging app tells you who probably owns the handset, not who is typing. So the agent can answer general questions there at depth 3, but anything touching an account starts with proper authentication, usually a link into your own app. Photos and voice notes are treated as external evidence. A person picks up anything sensitive.

What does messaging app support involve, and who owns it?

Customers increasingly prefer to message a business the way they message friends: short texts, photos, voice notes, replies hours apart. For the business, the channel is cheap and well liked, but it brings risks a website chat does not. The platform is run by a third party. Accounts can be impersonated. Handsets are lost, shared and taken over. Conversations sit in the customer's phone history indefinitely.

Customer support owns the channel. Security owns authentication and impersonation risk. Compliance approves which topics may be handled there at all. The agent works inside those decisions, and our guide to the AI support agent that knows when to say no explains why its scope should be narrower here than in your own app.

What are the steps, and at what depth?

1. Person, support lead and security: set channel scope. Which topics may be discussed on the messaging app, which need authentication, and which are never handled there.
2. Agent, depth 3: opens with disclosure. It states it is an AI, what it can help with on this channel, and how customers can verify they are talking to your official account.
3. Agent, depth 3: answers general questions from approved sources: opening hours, how-to steps, product features, published fees.
4. Agent, depth 1: recognises account-specific requests and checks whether the customer is authenticated to the level the topic needs.
5. Agent, depth 3: sends a secure link into your app or website for authentication or for the action itself, rather than taking details in the chat.
6. Agent, depth 1: reads attachments such as photos of a damaged item or a screenshot of a message. Each is marked as external evidence.
7. Agent, depth 3: handles the asynchronous gap. When a customer returns hours later, it summarises where things stood and re-checks authentication if the session has expired.
8. Agent, depth 2: writes the handover note for anything sensitive, angry or outside scope, and moves the conversation to a person in the same thread where possible.
9. Person, adviser: continues the conversation and handles every decision.

Which controls matter, and what evidence does each leave?

Phone number is not authentication. The number matching your records is a reason to proceed to authentication, nothing more. Evidence: authentication events tied to each account discussion.

Sensitive data stays out of the thread. The agent never asks for card numbers, full passwords or one-time codes in the chat, and warns customers who send them. Evidence: transcript scans and warnings given.

Attachments are external. A screenshot of a bank transfer is a claim, not a payment record. Evidence: provenance class on each attachment.

Channel scope is enforced at the moment of action. A request to change payment details on the messaging app is refused there and redirected. Evidence: refused verdicts naming the channel bound.

Handovers stay in thread. Customers do not have to start again elsewhere. Evidence: thread continuity in the record.

What should you measure?

• Conversations resolved on the channel, against those moved into the app or to a person.
• Secure links sent and completed. Low completion means the link journey is too hard.
• Sensitive data received in the thread, and whether the warning was given.
• Impersonation reports from customers contacted by fake accounts using your name.
• Time to first reply after a customer returns to an old conversation.

Where does it usually go wrong?

The channel feels informal, so the controls relax. Teams answer account questions because the customer seems genuine. Hold the line set by security.

Voice notes are misheard. Transcription errors on names and numbers matter. The agent should confirm critical details in text.

Customers get stuck after a handover. The adviser picks up late and the customer gives up. Set handover response times for this channel, not only for phone.

Frustration builds in the gaps. A customer who waited hours writes angrily. The escalation rules in can an AI agent deal with angry customers? still apply, and the agent should acknowledge the wait, not ignore it.

Bookings are confirmed too easily. "Can I come in tomorrow at ten?" needs a real slot; see can an AI support agent book appointments for customers? before letting the agent commit.

Where Pryme fits

In Pryme, the channel is one of the bounds in the minimum chain: an action allowed in your authenticated app can be refused on a messaging app, and the verdict names the channel as the deciding bound. Attachments arrive through the Pryme Context Protocol marked external, so they cannot authorise a payment.