Question handling
Getting somebody back into an account they can no longer reach
Four quite different problems arrive in the same sentence: a lockout, a mistyped address at signup, an account whose owner has left the company, and a workspace where nobody still employed has administrative rights. Only one of them is about a password. All four end at the same wall, which is that a chat widget cannot establish who anybody is.
What they are really asking
They want somebody with the authority to make an exception, and they are testing whether this channel can produce that person.
- i'm locked out of my account
- i can't log in
- i signed up with the wrong email
- can you change the email address on my account
- the person who set this up has left the company
- we don't have an admin on the account any more
- how many failed attempts before i get locked out
- i'm not receiving the login code
- can you turn off two factor for me
- how do i transfer ownership of the account
The material that answers it
An assistant is only as good as the document behind it, and for this question the document usually exists but is written in the wrong shape. What each one has to contain to be answerable:
| Your lockout rules, stated as rules | How many attempts trigger a lock, how long it lasts, whether it clears on its own, and whether a reset clears it. People assume a lockout is permanent and stop trying, when in many products it expires quietly in a quarter of an hour. |
|---|---|
| The process for changing the address on an account | Whether the account holder can do it themselves, where the setting lives, whether it requires confirming from both addresses, and what happens when the old one is unreachable. That last branch is the one that generates the contact. |
| Roles, permissions and how ownership moves | Who can invite, who can remove, who can be promoted, and the documented route when the only owner has left. Organisations hit this at the worst possible moment, usually the week somebody resigns, and they need a process rather than sympathy. |
| What you require before you will recover an account | Proof of identity, proof of association with a domain, a billing detail, an approval from somebody else on the account. Publishing the list means the assistant can tell people what to gather, which removes an entire round of email. |
| Second factor recovery | Whether recovery codes exist, where they were shown, and what happens when they have been lost along with the device. Write down the honest answer even when the honest answer is that recovery is slow and deliberately awkward. |
How to handle it
Separate the four problems that arrive as one sentence
I cannot get in can mean a forgotten password, a lock, a wrong address, a second factor, a lapsed account or a permission somebody else removed. The assistant should be able to describe each branch briefly and let the visitor say which one they are in, rather than picking one and being wrong.
This is a place where material shaped as a decision list works far better than a set of separate help articles, because it lets one reply cover the fork instead of committing to a guess.
Answer the policy half completely
Lockout duration, whether a reset clears it, whether an admin can restore a removed member, what a lapsed account looks like from the inside. All of that is published information about how your product behaves, it is identical for everybody, and it is genuinely useful.
Answering it well matters because it is the half that resolves without a human. The remainder is not going to.
Say plainly that identity cannot be checked here
The assistant should state the limit rather than dance around it: it cannot see accounts, cannot confirm who anybody is, and nothing typed into the chat counts as proof. Said early, that reads as reassuring rather than obstructive, because it signals that the company treats access seriously.
The wording matters. A refusal that sounds like a shrug reads as incompetence. A refusal that names the safeguard reads as a company that would also refuse somebody trying to get into the visitor's own account.
Collect the things that make the handover useful
The account or organisation name, the address they believe the account uses, an address they can actually receive mail at, and one sentence on what they are trying to do. With those four the person picking it up can start work. Without them the first reply is a request for details, which adds a day.
The widget collects a name, an email and a message when somebody asks for a person, so the assistant should prompt for the rest to go in the message before handing over. That prompt is the difference between a useful enquiry and a two word one.
When it stops being an answer
Every request to change a credential or a permission
Changing an address, disabling a second factor, promoting somebody to owner, removing an account holder. These are exactly the actions an attacker would ask for, phrased exactly the way an attacker would phrase them, and they belong with a person who can verify authority.
An organisation with nobody left who can administer it
This is common in small businesses and it is genuinely hard: the company still owns the subscription, but nobody still employed can prove it from inside the product. It usually resolves through billing records or domain control, and it needs a documented route rather than a decision made case by case.
The assistant's job is to recognise the situation, say that the team handles it, and collect the details that support the claim: the domain, the billing contact, and who is asking on the company's behalf.
Anything urgent enough to be pressuring
Pressure is a signal to slow down, not to speed up. The right handling is a calm handover with a realistic reply time, not an attempt to do more because somebody is upset. Say when a person will respond, and make sure that is true.
How this one goes wrong
The loop that keeps suggesting a password reset
The classic shape here is a visitor who says three times that the address on the account is wrong, and an assistant that answers three times with the reset flow, because the reset flow is the closest thing in the material to the words being typed. Nothing in the reply is inaccurate. It is simply an answer to a question nobody asked.
The cost is trust rather than time. Somebody who has explained their problem clearly and been misunderstood repeatedly does not try a fourth time, they go and write about it. The fix is material that covers the branches, and a caution setting that prefers a refusal with a handover over the nearest weak match.
The same question, trade by trade
The pattern above holds everywhere. The wording, the escalation line and the material behind it do not, so there is a page per trade.
- For a medical practiceParents, carers and adult children ask to reach somebody else's record. Consent, the age review and what a clinician may restrict.
- For a pharmacyThe ordering account, the app a surgery runs and the nomination are three different things, and people ask about them in one sentence.
- For a law firmThe assistant cannot reset a login, confirm anybody is a client or say what is waiting inside. It can describe the route and take a name.
- For a accounting firmPortal sign in, agent authority and a shared login are three different problems. What the assistant can explain and what needs a person.
- For a insurance brokerAccess to a broker's document portal is an authority question first, especially when the named contact on a commercial policy has left.
- For a mortgage brokerExpired upload links, joint applicants sharing one login, and a portal that holds what was sent rather than what the lender has decided.
- For a recruitment agencyA temp who cannot log in on the evening of the cut off has a deadline, not an inconvenience. What an assistant can honestly do about it.
- For a marketing agencyThe seats in question are on the client's own advertising and analytics accounts. Withdrawing them is the client's right, and often an accident.
- For a online storeGuest checkout leaves an email with orders behind it and nothing to sign into. Most access problems on a shop start right there.
- For a fashion retailerThe returns portal sits behind the login and the clock does not pause. Here being unable to sign in genuinely stops something.
- For a electronics retailerThe shop account holds the purchase record. The maker account holds the machine, and losing that can lock hardware nobody here can unlock.
- For a gymThe barrier credential and the booking account fail for different reasons, and only one of them carries a replacement charge.
- For a universityThe applicant portal, the student single sign on and alumni access are separate. Most access questions are really about which one somebody holds.
- For a driving schoolThe lesson record is a card in the instructor's folder. What to say to somebody hunting for a password that does not exist.
- For a online courseWrong email, expired invite, a course bought by an employer. Three access problems with three different answers.
- For a SaaS companyOrphaned admin rights, expired invites and the wrong workspace. Access questions on a team product, and where the assistant has to stop.
- For a developer tools companyMachine identities, organisation membership and credentials shown only once. Access questions where the actor is a process rather than a colleague.
- For a fintech appLocks, reviews and frozen cards are the highest anxiety questions on a financial app. Which parts are publishable and which are not.
- For a healthtech appContact details bound to a verified identity, and a parent account that transfers on a birthday. Access questions where a record sits behind the door.
Questions
- Can it check whether an account exists?
- No, and it should not. It cannot query any live system unless you separately connect a data source, and confirming whether an address has an account is itself a disclosure to whoever happens to be typing.
- What should it do when somebody says the account owner has left?
- Recognise it as a category of its own, explain the route in general terms, and collect the domain, the billing contact and who is asking. That turns a difficult case into one a person can pick up without three clarifying emails.
- Is there any way to make this self service?
- The policy half, yes: lockout behaviour, where the email setting lives, how ownership transfers, what proof you need. The verification half is not a content problem and no assistant configuration fixes it.
Keep reading
- Handling password resetsAn assistant cannot reset anything. It can walk somebody through your real flow and name the step that usually breaks.
- Handling data deletion requestsA deletion request is a request with a clock on it, not a question. The characteristic failure is silence, so it always has to reach a person.
- Handling accessibility requestsTwo different things arrive as one message. A published accessibility statement answers the first. The second is a request, and it needs a person.
- Every question typeHandling patterns for the questions every support inbox gets.
Try it on your own material
Upload a document or point it at your site, paste one line of HTML, then ask it something only your business could answer.