AWS Builder Center

Builder Center

Ending Knowledge-Based Authentication in the Contact Center with CLEAR1 and Amazon Connect Customer.

Replace knowledge-based authentication in your contact center with CLEAR biometric verification integrated into Amazon Connect Customer. Covers the end-to-end architecture, two caller flows (enrollment via ID + selfie, reverification via selfie only), and implementation patterns using Connect AI agents for agentic self-service and step-by-step guides for representative-assisted workflows.

Ritesh Choudhary

Introduction

Contact centers face a fundamental tension: security measures that frustrate legitimate customers while failing to stop sophisticated fraudsters. Knowledge-based authentication (KBA) — "What's your mother's maiden name?" — creates friction for honest callers and is trivially defeated by bad actors armed with stolen personal data.
This post presents a modern approach: integrating CLEAR1, CLEAR's selfie-based identity verification platform, with Amazon Connect Customer to replace KBA with secure, frictionless authentication. First-time callers complete a one-time identity enrollment (~2-3 minutes), and every subsequent call authenticates them instantly via a selfie (~5-10 seconds).

The Problem with Traditional Caller Authentication

Traditional contact center authentication relies on knowledge-based questions, PINs, or account numbers. These methods suffer from three critical flaws:
  1. Customer friction — Callers forget answers, get locked out, and spend valuable time proving who they are before getting help
  1. Security weakness — Data breaches make personal information readily available to fraudsters; social engineering bypasses KBA entirely
  1. Operational cost — Representatives spend 30-90 seconds per call on authentication, adding up to millions in labor costs at scale
Biometric verification eliminates all three: it's faster for customers, cryptographically secure, and reduces representative handle time.

Solution Overview

The integration connects CLEAR's secure identity platform, CLEAR1, with Amazon Connect Customer so that callers can verify their identity on their mobile phone while on hold. Verification can be automated, representative-assisted, or hybrid depending on the contact-center workflow. CLEAR1 uses biometrics, document validation, device integrity, and trusted-source corroboration to establish identity.
There are two experiences depending on whether the caller has verified before:
First-time caller (Enrollment): The caller receives a text message with a link. They open it on their phone, scan a government-issued ID (driver's license or passport), and take a selfie. CLEAR confirms their identity and returns a unique identifier that gets stored for future calls.
Returning caller (Reverification): The caller receives the same text message link, but this time they only take a selfie. Because their identity was already established on the first call, CLEAR recognizes them instantly. The entire process takes 5-10 seconds.
The key insight: once a caller completes enrollment, every future call uses the faster reverification flow automatically — no representative intervention needed.




How It Works

  1. A caller dials the contact center and is greeted by the contact flow or Connect AI agent
  1. The system checks whether this caller has verified before (by looking up their phone number)
  1. Based on that check, a verification session is created with CLEAR (enrollment or reverification)
  1. The caller receives an SMS with a verification link
  1. The caller completes verification on their phone while on hold
  1. The system detects completion and routes the caller to a representative with verified identity displayed


Caller Experience

First-Time Caller (Enrollment)

Plain text
Caller dials in
    ↓
Greeted by AI agent or contact flow
    ↓
"We need to verify your identity. Check your phone for a text message."
    ↓
Caller receives SMS with link
    ↓
Opens link → enters phone number → receives OTP → takes selfie → scans ID
    ↓
CLEAR confirms identity (~2-3 minutes)
    ↓
"Your identity has been verified. Connecting you now."
    ↓
Representative sees verified name, DOB, and confirmation on screen

Returning Caller (Reverification)

Plain text
Caller dials in
    ↓
Greeted by AI agent or contact flow
    ↓
"We need to verify your identity. Check your phone for a text message."
    ↓
Caller receives SMS with link
    ↓
Opens link → takes selfie (that's it!)
    ↓
CLEAR confirms identity (~5-10 seconds)
    ↓
"Your identity has been verified. Connecting you now."
    ↓
Representative sees verification confirmation on screen



Implementation Patterns

This integration supports three implementation patterns depending on your contact center's needs:

Pattern 1: Agentic Self-Service (Connect AI Agents)

The Connect AI agent handles the entire verification flow conversationally. It determines whether the caller needs enrollment or reverification, collects any needed information, initiates the CLEAR session, sends the verification link, and monitors completion — all without human representative involvement. The AI agent uses MCP tools to invoke backend functions autonomously.
Best for: High call volume, self-service-first strategy, reducing representative handle time.






Pattern 2: Representative-Assisted (Step-by-Step Guides)

The human representative triggers verification through step-by-step guides in the Connect Customer agent workspace. The guide walks the representative through initiating the correct flow, and backend functions handle the CLEAR interaction and SMS delivery.
Best for: Complex scenarios requiring representative judgment, gradual rollout, compliance-sensitive industries.





Pattern 3: Hybrid

The Connect AI agent handles routine reverification (returning callers) autonomously, while escalating first-time enrollment to a human representative who assists via step-by-step guides.
Best for: Balancing automation with human oversight during initial adoption.

How CLEAR Verification Works

CLEAR-Owned Identity Matching

This integration uses CLEAR's standard matching pattern where CLEAR owns all identity matching logic:
  • During enrollment, Amazon Connect Customer passes the caller's name to CLEAR
  • CLEAR matches this against data extracted from the scanned government document
  • If the match succeeds, CLEAR returns a unique  user_id 
  • On reverification, only the  user_id  is needed — CLEAR matches the selfie against the enrolled biometric template
Amazon Connect Customer never handles raw biometric data or performs identity matching — CLEAR manages all of that.

What the Representative Sees

When a verified call arrives, the representative's screen displays:
  • Verification status (Success / Failed / Pending)
  • Verified name from the government document
  • Date of birth
  • Verification type (first-time enrollment or returning caller)
  • Timestamp of verification

Security and Compliance

  • No biometric data in your AWS account — CLEAR handles all biometric processing; Amazon Connect Customer only receives identity metadata
  • Encrypted credentials — CLEAR API keys are stored securely and never exposed in plaintext
  • Least privilege access — Each backend function has only the permissions it needs
  • PII controls — Verified identity data flows through contact attributes; follow your organization's data retention policies
  • Compliance ready — CLEAR is SOC 2 Type II certified; the integration supports PCI and HIPAA-eligible architectures when deployed appropriately

Expected Outcomes

Metric
Before (KBA)
After (CLEAR)
Authentication time (returning caller)
30-90 seconds
5-10 seconds
Authentication time (new caller)
30-90 seconds
2-3 minutes (one-time)
Fraud prevention
Weak (data breach vulnerable)
Strong (biometric)
Customer satisfaction
Low (friction)
High (fast, modern)
Representative handle time reduction
—
30-90 seconds per call

Conclusion

Integrating CLEAR with Amazon Connect Customer replaces the outdated security-vs-experience tradeoff with a solution that improves both simultaneously. The two-flow model (enrollment + reverification) optimizes for returning callers, and the multiple implementation patterns (agentic self-service, representative-assisted, hybrid) let you adopt at your own pace.
The combination of CLEAR's biometric verification with Connect AI agents and step-by-step guides creates a modern authentication experience that callers appreciate and fraudsters can't defeat.
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS


Co-author

 Lewis Brown 
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article