SMS is the channel customers already read within minutes, and the one most likely to get you a TCPA complaint if you treat it like a marketing blast. Done right, AI customer support over SMS resolves issues in a few texts. Done wrong, it is an expensive lesson in consent law.
AI customer support over SMS is the use of an AI agent to resolve customer issues through text messages, handling both inbound questions (a customer texts your support number) and outbound re-engagement (the AI texts a customer about an abandoned signup or an open dispute), under explicit consent and opt-out controls. This guide walks through when SMS is the right channel, how inbound and outbound differ, the compliance rules you cannot skip, how to design concise conversational flows, when to escalate to a human, and how to measure whether it is working.
SMS open rates run far higher than email, which is why it works for time-sensitive support and re-engagement, but the same immediacy raises the compliance stakes.
Consent, opt-out handling (STOP/HELP), quiet-hours rules, and not interrupting an active conversation with an outbound message are the four controls that keep you compliant.
Concise conversational design matters more on SMS than any other channel: no markdown, no walls of text, one question per message.
Escalation has to be seamless because SMS is asynchronous and a customer may reply hours later, so context has to survive the handoff.
Measurement should track resolution rate, time to first reply, opt-out rate, and escalation rate, not just message volume.
Last updated: June 2026
Most teams add SMS because a customer asked for it or because email reply times were embarrassing. Then they discover that SMS has rules the other channels do not, that a 400-word answer that reads fine in chat is unreadable on a phone, and that an outbound text sent at the wrong hour to a customer who never opted in is a regulatory problem, not a CSAT problem. This guide is written for support and operations leaders at complex or regulated businesses who want AI to handle SMS correctly: inbound and outbound, with compliance controls that survive an audit, conversational design that respects the channel, and escalation that does not drop the customer. The examples use Lorikeet because that is the platform we build, but the principles apply regardless of vendor.
When SMS Is the Right Channel (and When It Is Not)
SMS is not a universal upgrade. It is the right channel for a specific set of jobs and the wrong one for others. Choosing it deliberately is the first step.
SMS works well when the interaction is short, time-sensitive, and benefits from being read quickly. A one-time passcode, a fraud alert, a shipping update, a card-lock confirmation, a payment-failed nudge, or a quick account question all fit. Customers read text messages within minutes, far faster than email, which is exactly what you want when a transfer failed or a login is blocked.
SMS is the wrong channel when the interaction needs rich formatting, long explanations, file attachments, or back-and-forth that runs to dozens of turns. A detailed dispute walkthrough, a document upload, or a multi-screen onboarding flow belongs in chat or email. Forcing those into SMS produces fragmented threads and frustrated customers.
A useful test before turning SMS on: would this exchange feel natural as a text between two people, finished in a handful of short messages? If yes, SMS fits. If it would read like a contract or require the customer to scroll, route it elsewhere. The strongest programs also use SMS as the fast first touch and then move richer steps to another channel, sending a secure link to chat when a customer needs to upload a document, rather than trying to force the whole interaction through text.
Inbound SMS: the customer initiates by texting your support number with a question or request. Consent is implied by the inbound message itself, but you still owe opt-out handling and disclosures.
Outbound SMS: your system initiates the text, usually to re-engage (abandoned signup, open dispute, payment retry, appointment reminder). This is where consent, quiet hours, and frequency rules bind hardest.
Inbound vs Outbound SMS Support
The two directions are different products with different risk profiles, and a serious AI deployment handles both on the same agent so context is shared.
Inbound SMS
A customer texts your number. The AI agent reads the message, identifies the customer (by phone number, then a verification step for anything sensitive), resolves the issue, and replies. Because the customer started the conversation, you have implied consent to reply, but you still must honor STOP and respond to HELP. The hard part of inbound is identity and context: a phone number is a weak identifier, so before the agent unlocks an account or shares balance information it should verify the customer through a second factor. A capable agent can pull the customer profile, check recent tickets, and resolve a card-lock or transfer-status question in two or three messages.
Outbound SMS
Your system sends the first message. This is re-engagement: a user who abandoned KYC verification, a customer with a failed payment, an open dispute that needs a document, a collections reminder. Outbound is where compliance is strictest because you are interrupting someone who did not just ask for help. You need documented consent to text them for this purpose, you must respect quiet hours and frequency caps, and you must suppress the outbound message if the customer is already in an active conversation on any channel. Sending an automated re-engagement text to someone who is mid-chat with a human agent is the kind of mistake that erodes trust fast.
Lorikeet runs both directions on one concierge. The same agent that answers an inbound "why was my card declined" text can also send the outbound "your verification is incomplete, reply to finish" text, with shared memory so the customer never repeats themselves and outbound respects whether an inbound conversation is already open.
SMS Compliance: The Rules You Cannot Skip
SMS is regulated in ways chat and in-app messaging are not. In the US the TCPA governs automated texts, carriers enforce 10DLC registration, and the CTIA publishes messaging guidelines. The specifics vary by jurisdiction, and this is not legal advice, but five controls are non-negotiable for any compliant program. Build them in before you send a single message.
1. Consent
You need a documented basis to text a customer, and the standard is higher for outbound marketing-adjacent messages than for transactional replies to an inbound text. Capture consent explicitly (a checkbox that is not pre-ticked, a confirmed opt-in keyword), log when and how it was given, and store it so you can produce it later. For outbound re-engagement, the consent must cover that purpose. Reusing a marketing opt-in to send collections texts is the kind of gap that gets noticed.
2. Opt-Out (STOP) and Help (HELP)
Every program must honor STOP, UNSUBSCRIBE, CANCEL, and similar keywords by immediately ceasing messages, and must respond to HELP with contact information. This is a hard requirement, not a nicety. The AI agent should detect opt-out intent even when it is phrased loosely ("stop texting me", "leave me alone") and not just the exact keyword, then confirm the opt-out and stop. Reinstatement should require a fresh opt-in.
3. Quiet Hours
Outbound messages should respect the customer's local time zone and quiet-hours windows (commonly no texts before 8am or after 9pm local). The agent needs the customer's time zone and a scheduling layer that queues outbound messages for the next allowed window rather than firing immediately. An inbound reply at 11pm is fine because the customer initiated it; an outbound nudge at 11pm is not.
4. Do Not Interrupt an Active Conversation
If a customer is already in a live conversation, on SMS, chat, voice, or with a human agent, suppress the outbound message. Texting someone an automated re-engagement prompt while they are mid-conversation is jarring and undercuts trust. This requires the outbound system to check conversation state across channels before sending, which is only possible when inbound and outbound run on the same platform.
5. Frequency Caps and Disclosures
Cap how many outbound messages a customer can receive in a window, identify your business in the message, and keep records. These controls support your obligations under TCPA and carrier rules; they do not by themselves guarantee compliance, so pair them with a review from your legal or compliance team.
Lorikeet's outbound guardrails are built for exactly these controls: consent checks, do-not-contact suppression, quiet-hour scheduling by time zone, frequency caps, and active-conversation suppression. The guardrails run before any outbound message goes out, and every send is logged in an audit trail your compliance team can review.
Designing Concise Conversational SMS Flows
SMS punishes verbosity. The channel has no formatting, messages get split at 160 characters, and customers are reading on a phone, often one-handed. Conversational design that works in chat fails here.
Write short. One idea per message, one question at a time. If you need three pieces of information, ask for them across three short turns, not in one paragraph the customer has to parse. Strip markdown: bold, bullet points, and headers render as literal asterisks and dashes on SMS, so the agent must output plain text only. Front-load the answer. A customer who texts "is my card locked" wants "Yes, your card is locked for security. Reply UNLOCK to remove it." not a three-sentence preamble.
Avoid links where you can, and when you must send one, explain what it is for. Keep the agent's tone human and direct. Confirm before taking a consequential action ("I can refund the $4 transfer fee, reply YES to confirm") so the customer stays in control. And design for asynchrony: a customer may reply ten minutes or ten hours later, so each message should make sense on its own without assuming the customer remembers the last one.
Lorikeet's chat-channel rendering strips markdown automatically for SMS, and its workflows let you script confirmation steps for any action that moves money or changes account state.
Escalation: Handing Off Without Dropping the Customer
SMS escalation is harder than chat escalation because the channel is asynchronous and the customer is not sitting in a live window. The agent has to recognize when it should not proceed, hand off cleanly, and preserve context so the human or the next step starts where the AI left off.
Escalate when the issue is outside the agent's safe scope (a fraud claim that needs investigation, a complaint, a request the agent cannot verify), when the customer explicitly asks for a human, or when a guardrail blocks an action (a refund above a dollar threshold, an account closure). The handoff should tell the customer plainly what is happening ("I am connecting you with a specialist, they will text you back shortly") and set expectations on timing, because on SMS the customer will not see a typing indicator.
Context has to survive the handoff. The human agent picking up the thread should see the full conversation, the customer's verified identity, and what the AI already tried. When the issue resolves, the agent or human should close the loop with a final confirmation so the customer knows the thread is done. Because Lorikeet runs SMS on the same engine as chat, email, and voice, an escalation carries the full audit trail and conversation history into the human queue, and the customer keeps texting the same number.
Measuring AI SMS Support
Volume is not a success metric. The numbers that tell you whether your SMS program works are about resolution, speed, and customer consent.
Resolution rate: the share of inbound SMS conversations the AI fully resolves without a human, where you define what resolution means. This is the headline number.
Time to first reply: SMS customers expect speed; an AI agent should reply in seconds, and tracking this separates a real agent from a queue.
Opt-out rate: the share of customers who reply STOP, especially after outbound messages. A rising opt-out rate is the earliest signal that your outbound program is too aggressive or poorly targeted.
Escalation rate: how often the AI hands off, and why, so you can find the workflows that need more coverage.
Outbound conversion: for re-engagement, the share of customers who complete the desired action (finish KYC, retry payment) after the text.
Lorikeet's Coach agent provides 100% automated QA across SMS conversations, scoring resolution quality and flagging where the agent went wrong, rather than sampling a handful of tickets. Coach is available standalone at roughly $0.25–$0.30 per ticket and runs across all channels including SMS.
How Lorikeet Does AI Customer Support Over SMS
Lorikeet is an AI customer support platform built for complex and regulated businesses, with around 80% of its customers being US financial institutions and fintechs. SMS is a first-class channel alongside chat, email, and voice, handled inbound and outbound by the same concierge.
On the inbound side, a customer texts the support number and the concierge identifies them, verifies where needed, and resolves the issue end-to-end, executing actions in the systems you connect (ticketing, CRM, core banking) through least-privilege scoped tools. On the outbound side, the concierge sends re-engagement texts (abandoned verification, failed payment, open dispute) gated by the compliance controls above: consent checks, quiet-hour scheduling by time zone, frequency caps, do-not-contact suppression, and active-conversation suppression across channels.
The compliance posture is the differentiator for regulated buyers. Lorikeet's defence-in-depth approach runs pre-launch adversarial simulations, inbound message checks, outbound guardrails, and 100% post-facto QA through Coach. It is SOC 2, BAA-ready for HIPAA, and GDPR-aligned, with PII redaction, role-based access, and US, UK, and Australia data residency. Pricing is per resolution at roughly $0.80 per SMS resolution, escalations are not charged, and you define what counts as a resolution.
The honest limitation: Lorikeet is built for complex, regulated, multi-step support, and the forward-deployed implementation model (a Lorikeet PM and engineer help you launch, typically operational in about a month) is more involved than dropping a generic SMS bot into an existing helpdesk. If your SMS needs are a simple FAQ autoresponder with no actions, no compliance exposure, and no escalation, a lighter tool will be faster to stand up. The depth is worth it when the texts move money, touch regulated data, or have to survive an audit.
If you are evaluating AI for SMS support in a regulated business, book a Lorikeet demo and bring your hardest inbound and outbound SMS scenarios.
Key Takeaways
Choose SMS for short, time-sensitive interactions (passcodes, alerts, status, quick account questions) and keep long, document-heavy, or multi-screen flows in chat or email.
Inbound and outbound SMS are different products: inbound has implied consent but needs identity verification; outbound carries the strictest compliance burden.
The five compliance controls (consent, STOP/HELP opt-out, quiet hours, no-interrupt during active conversations, frequency caps and disclosures) are non-negotiable and should be reviewed by your compliance team.
Conversational design for SMS means plain text, one idea per message, front-loaded answers, and confirmation before consequential actions.
Measure resolution rate, time to first reply, opt-out rate, escalation rate, and outbound conversion, not message volume.
Conclusion
AI customer support over SMS rewards teams that treat the channel on its own terms. The immediacy that makes SMS valuable is the same immediacy that makes a missed opt-out or a 2am outbound text a real problem. The teams that get it right pick SMS for the jobs it fits, run inbound and outbound on one agent with shared context, build the compliance controls in before they send, write short, and measure resolution rather than volume.
If your SMS support has to move money, verify identity, re-engage on regulated workflows, or stand up to an audit, the platform you choose has to handle compliance and escalation as first-class concerns rather than afterthoughts. Lorikeet was built for exactly that. Start with your hardest SMS scenarios, not your easiest, and judge any vendor on how it handles the texts that carry risk.
