The Medium Is the Message. What Voice Authentication Taught Me About It.

The shortest workflow on paper

Authentication looks simple when you write it down. Get the caller's ID number. Send them a one-time password. Have them type it in. Check that it matches. Three steps, maybe four if something goes wrong. In a written AI agent, this is a workflow I could map in an afternoon.

Then I built it for a voice agent, and I ran into an old idea from media theory. The medium is the message. Marshall McLuhan meant that how something is delivered shapes it as much as what is delivered. I did not expect a phone authentication flow to prove him right, but that is exactly what happened.

I work as a Product Implementation Manager at Notch, where we deploy AI agents for insurance workflows. A big part of my job is taking logic that already works in one channel and making it work in another. Voice authentication was the project that taught me how much the channel itself is part of the product.

Same message, different medium

Here is the thing that surprised me most. The core authentication logic barely changed between our written agents and the voice agent.

In both cases, the agent collects an ID, triggers an OTP, and verifies the caller typed it correctly. In both cases, it needs to detect when an ID looks wrong or an OTP fails. The rules are the same. The validation is the same. If you looked only at the logic diagram, you might think the voice version was a copy-paste job.

The message, in other words, was identical. What changed was the medium, and the medium changed everything.

In a text conversation, the structure does a lot of the work for you. The customer sends a message. The agent replies. The customer reads it, thinks, and responds when ready. Everything is controlled and turn-based. One message at a time.

A phone call gives you none of that. There is no pause button. There is no scroll-back. The caller cannot re-read the last instruction. Every step has to be spoken clearly, at the right moment, in the right order, and the agent has to hold the caller's attention through all of it. The real work was never in the logic. It was in how you communicate each step and build the sequence so it unfolds live without losing the person on the other end.

Where the seconds go

The first way the medium made itself felt was time. On a phone call, an extra second of the agent thinking is the moment someone loses patience.

In text, latency is nearly invisible. If an agent takes two seconds to respond to a written message, nobody notices or cares. On a call, two seconds of silence feels broken. The caller starts wondering if the line dropped. They say "hello?" They repeat themselves. Some hang up.

So a voice authentication flow has to be designed around the caller's patience, and their patience is measured in seconds. Every step in the sequence has to move. The agent asks for the ID, the caller types it in using their keypad, and the confirmation needs to come back fast. Then the OTP goes out, and the agent has to guide them to enter it, again through the keypad, without dead air in between.

We chose DTMF, the keypad tones, for both the ID and the OTP entry, precisely because it keeps those steps tight and unambiguous. The caller presses digits, the system reads them directly, and there is no transcription step in the middle that could slow things down or get a digit wrong. For a flow where a single wrong digit means starting over, that reliability matters. My colleagues on the engineering side have written about where the milliseconds actually go in real-time voice AI, and building this flow made me feel every one of those milliseconds from the implementation side.

Humans interrupt. Rooms interrupt more.

The second way the medium showed up was in listening.

People interrupt phone conversations. That is just how humans speak. They talk over the agent, they answer before the question is finished, they say "yeah yeah" while instructions are still playing. A voice agent has to handle that gracefully, because cutting people off or ignoring them makes the whole experience feel robotic.

But there is a subtler problem underneath that one. Interruptions can get registered far more easily than you expect, because of surrounding sounds. A TV in the background. A coworker talking nearby. Traffic through a car window. The agent hears something, decides the caller is speaking, and stops mid-instruction. Now the caller heard half of what they needed, the agent thinks it was interrupted, and the sequence is off the rails.

Text never has this problem. Nobody's WhatsApp message gets garbled because a truck drove past. This failure mode exists purely because of the medium.

So we had to become more rigid about what the agent listens to during the authentication sequence, while keeping it balanced. Too permissive, and every background noise derails a step. Too rigid, and a caller who genuinely needs to interrupt, maybe to say they did not get the OTP, gets ignored. Finding that balance was one of the most delicate parts of the whole build. It turns out turn detection in voice AI is a discipline of its own, and authentication is where it gets stress-tested hardest, because the cost of a derailed step is a failed verification.

The landline problem

Then there are the edge cases that only exist because this is a phone call.

One of them is landlines. The whole flow assumes the caller can receive an OTP, which usually means a text message to a mobile phone. But some callers dial in from a landline. If the agent blindly sends an OTP to the number on the call, it goes nowhere, and the caller is stuck.

So the agent needs to detect that situation and handle it in the moment. When we identify a landline, the agent simply asks the caller for a cell phone number, sends the OTP there, and continues the sequence. It sounds like a small thing, and the fix itself is simple. But it is exactly the kind of case a written agent never has to think about. The medium created the problem, so the medium had to shape the solution.

The same goes for detecting when there is an issue with the ID or the OTP itself. Wrong digits, expired codes, mistyped entries. Each failure needs a recovery path the agent can walk the caller through by voice, without frustration piling up.

The happy flow isn't enough at all

How did we find the right balance on all of this? Testing. A lot of it, including sitting in the office and running calls ourselves.

The biggest thing I took from that process is that the happy flow isn't enough at all. The version of the call where the caller has their ID ready, enters it perfectly, receives the OTP instantly, and types it in correctly on the first try tells you almost nothing about whether your flow works. That call was always going to succeed.

The calls that matter are the messy ones. The caller in a noisy room. The caller on a landline. The caller who mistypes a digit and gets flustered. The caller who interrupts to ask why they need to do this at all. Every one of those calls taught us something the happy flow never would have, and most of the real design decisions in this project came out of watching those calls fail and fixing why.

If you only test the path where everything goes right, you have not tested the product. You have tested your own optimism.

Be dynamic. That's where the AI earns its place.

If I had to give one piece of advice to someone building their first voice authentication flow, it would be this. The authentication logic can remain the same at the core. Do not reinvent your verification rules for voice. What has to change is everything around the logic, because the medium demands it.

In voice, you need to be much more dynamic. The agent has to adapt to interruptions, recover from noise, reroute around landlines, and keep a live human engaged through a multi-step sequence, all in real time. That dynamic layer is where the AI magic can actually happen. A rigid script cannot do this. A phone tree definitely cannot. An agent that can hold the goal of the sequence while flexing around whatever the call throws at it is what makes voice authentication work.

McLuhan was writing about television, not OTP codes. But sixty years later, his point held up on an insurance authentication call. The message stayed the same. The medium rewrote everything around it.

‍