Setting up client verification via a 1C-Bitrix call-reset

Customer Verification Setup via Missed Call in 1C-Bitrix

Missed call verification is an alternative to SMS codes. The user enters their phone number, the system calls them and immediately hangs up: the last 4 digits of the incoming number become the confirmation code. This costs 5–10 times less than SMS and works where SMS delivery is unstable.

Operating Principle and Providers

Technically, the scheme works like this: your server sends a command to a telephony platform to make a call from one of the numbers in the pool. The user sees an incoming call, remembers (or copies) the last 4 digits and enters them in the form. You don't need to accept the call.

Providers supporting this method:

• Exolve (MTS) — Flash Call API, outgoing number pool
• Zadarma — "flash call" function in API-enabled plans
• Novofon — support via REST API
• Zvonok.ru — specialized verification service

Key requirement: the provider must supply a pool of numbers with different last 4 digits and the ability to select a specific number for an outgoing call.

Implementation in Bitrix

The architecture is similar to SMS verification, but instead of a text code, the system generates a 4-digit suffix and selects a phone number from the pool with that suffix.

Table for storing verification sessions:

CREATE TABLE custom_flashcall_verification (
    id INT AUTO_INCREMENT PRIMARY KEY,
    phone VARCHAR(20) NOT NULL,
    caller_number VARCHAR(20) NOT NULL,
    code VARCHAR(4) NOT NULL,
    created_at DATETIME NOT NULL,
    attempts INT DEFAULT 0,
    verified TINYINT DEFAULT 0
);

Generation logic:

function initiateFlashCall(string $targetPhone): array {
    // Generate 4-digit code (0001–9999)
    $code = str_pad(random_int(1, 9999), 4, '0', STR_PAD_LEFT);

    // Select number from pool ending with this code
    $callerNumber = FlashCallPool::getNumberByCode($code);

    if (!$callerNumber) {
        throw new \Exception('No available number for code: ' . $code);
    }

    // Initiate call via provider API
    $provider = new ExolveFlashCallProvider();
    $provider->call($callerNumber, $targetPhone);

    // Save to DB
    FlashCallVerificationTable::add([
        'PHONE' => $targetPhone,
        'CALLER_NUMBER' => $callerNumber,
        'CODE' => $code,
        'CREATED_AT' => new \Bitrix\Main\Type\DateTime(),
    ]);

    return ['success' => true, 'hint' => 'Awaiting incoming call'];
}

Managing the Number Pool

The number pool is a critical part of the system. For codes 0000–9999, you need at least a few hundred numbers, otherwise collisions are inevitable under high load.

Pool table:

CREATE TABLE custom_flashcall_pool (
    id INT AUTO_INCREMENT PRIMARY KEY,
    phone_number VARCHAR(20) NOT NULL,
    code_suffix VARCHAR(4) NOT NULL,
    in_use TINYINT DEFAULT 0,
    last_used DATETIME,
    INDEX idx_code (code_suffix),
    INDEX idx_available (in_use, last_used)
);

When selecting a number from the pool, the first available one with the required suffix that hasn't been used in the last 30 seconds is taken. After verification is complete, the number is returned to the pool.

User Interface

The missed call verification form differs from SMS:

1. User enters phone number
2. A message appears: "You will receive a call; remember the last 4 digits"
3. Input field with mask _ _ _ _
4. Countdown timer (usually 30–60 seconds)
5. "Call again" button after timer expires

It's important to tell users that they don't need to accept the call — this is non-standard and confuses users without guidance.

Integration with Bitrix

Verification is embedded via an AJAX controller (\Bitrix\Main\Engine\Controller) and connected to the registration form or checkout form via JavaScript. In the bitrix:sale.order.ajax component, a verification step is added between entering contact information and order confirmation.

Fallback option: if the call doesn't arrive within 90 seconds, the user is offered to switch to SMS verification.

Execution Timeline

For high-load stores with 1000+ verifications per day, pool reservation and provider availability monitoring should be considered.