WA.cr

Form visitors can verify their phone or email with a code

Ask a visitor to confirm their phone number or email address with a one-time code before they send your form — so a returning customer's response joins the contact you already have.

Released 10 October 2026 — switched on gradually; until it reaches your workspace the setting shows greyed out in the form builder.

A form can now check that a phone number or email address really belongs to the person filling it in.

What's new

  • Verify with a one-time code — a new setting on any Phone or Email question. The visitor presses Send code, types the 6-digit code we send, and sees a tick before the form can be sent.
  • The code goes the way that reaches them — a phone code is sent by WhatsApp first, and by SMS automatically if WhatsApp can't deliver it. If it doesn't arrive, the visitor can resend it by WhatsApp, SMS or a voice call — only the ways available to your workspace are shown. An email question gets its code by email.
  • Returning customers are recognised — a response used to be kept apart from a customer already in your contacts, because anyone can type anyone's details into a public form. A verified response is now linked to that customer and updates their details, and Start an Auto Flow runs for them too. If the form saves both a phone and an email to the contact, both need verifying.
  • Changing the answer means verifying again — edit a verified number or address and the tick clears, so a response can never carry a confirmation for a different answer.

Worth knowing

  • Codes come from your own channels where you have them — from your own WhatsApp number when it has an approved Authentication template, and from your connected mailbox for email. Otherwise they come from WA.cr's own sender. The builder shows exactly where each kind of code will come from, and what it costs, right at the setting.
  • Each code is charged once, for the way it was delivered. A code from your own WhatsApp number is billed as a normal WhatsApp authentication message; a code from WA.cr's sender at WA.cr's rate; an SMS at the per-SMS rate; a voice call as one minute of an outbound call at your outbound call rate. A WhatsApp code that couldn't be delivered and went by SMS is charged as one SMS — never as both. Email codes are free.
  • If your wallet can't cover a code, the visitor is told the code can't be sent right now and nothing is charged.
  • Codes are capped to protect your wallet: a few to the same number or address at a time, and 60 an hour across your workspace's forms.
  • Spam protection carries over — if your form asks visitors to prove they're human, that check also appears next to Send code, so a bot can't make your form send codes.
  • Available on every plan.