diff --git a/Core/Resgrid.Chatbot/Models/ChatbotPlatform.cs b/Core/Resgrid.Chatbot/Models/ChatbotPlatform.cs
index 385770d7c..89a89a861 100644
--- a/Core/Resgrid.Chatbot/Models/ChatbotPlatform.cs
+++ b/Core/Resgrid.Chatbot/Models/ChatbotPlatform.cs
@@ -1,5 +1,7 @@
 namespace Resgrid.Chatbot.Models
 {
+	// The SMS values (SmsTwilio, SmsSignalWire) are mirrored as constants on
+	// Resgrid.Model.ChatbotIdentity for consumers that cannot reference this project.
 	public enum ChatbotPlatform
 	{
 		Unknown = 0,
diff --git a/Core/Resgrid.Chatbot/Models/ChatbotSession.cs b/Core/Resgrid.Chatbot/Models/ChatbotSession.cs
index e336ee5a2..dad0aac76 100644
--- a/Core/Resgrid.Chatbot/Models/ChatbotSession.cs
+++ b/Core/Resgrid.Chatbot/Models/ChatbotSession.cs
@@ -12,7 +12,13 @@ public enum ChatbotDialogState
 		AwaitingConfirmation = 4,
 		AwaitingParameter = 5,
 		AwaitingAuth = 6,
-		Completed = 7
+		Completed = 7,
+
+		/// <summary>
+		/// Step-up security-PIN prompt for a confirmed destructive action (the user already replied
+		/// YES; the pending intent executes once the correct PIN is supplied).
+		/// </summary>
+		AwaitingPin = 8
 	}
 
 	public class ChatbotSession
diff --git a/Core/Resgrid.Chatbot/Services/ChatbotIngressService.cs b/Core/Resgrid.Chatbot/Services/ChatbotIngressService.cs
index 86126483a..4d134c444 100644
--- a/Core/Resgrid.Chatbot/Services/ChatbotIngressService.cs
+++ b/Core/Resgrid.Chatbot/Services/ChatbotIngressService.cs
@@ -25,6 +25,9 @@ public class ChatbotIngressService : IChatbotIngressService
 		private readonly IAuthorizationService _authorizationService;
 		private readonly IChatbotDepartmentConfigService _departmentConfigService;
 		private readonly IChatbotRateLimiter _rateLimiter;
+		private readonly ISecurityPinService _securityPinService;
+
+		private const int MaxPinAttempts = 3;
 
 		public ChatbotIngressService(
 			IChatbotUserIdentityService userIdentityService,
@@ -39,7 +42,8 @@ public ChatbotIngressService(
 			ILimitsService limitsService,
 			IAuthorizationService authorizationService,
 			IChatbotDepartmentConfigService departmentConfigService,
-			IChatbotRateLimiter rateLimiter)
+			IChatbotRateLimiter rateLimiter,
+			ISecurityPinService securityPinService)
 		{
 			_userIdentityService = userIdentityService;
 			_sessionManager = sessionManager;
@@ -54,6 +58,7 @@ public ChatbotIngressService(
 			_authorizationService = authorizationService;
 			_departmentConfigService = departmentConfigService;
 			_rateLimiter = rateLimiter;
+			_securityPinService = securityPinService;
 		}
 
 		public async Task<ChatbotResponse> ProcessMessageAsync(ChatbotMessage message)
@@ -66,9 +71,30 @@ public async Task<ChatbotResponse> ProcessMessageAsync(ChatbotMessage message)
 				// 1. Identify user from the platform-specific identifier (already-linked only).
 				var identity = await ResolveUserIdentityAsync(message);
 
-				// 1b. SMS: a phone number that matches a Resgrid profile but isn't linked yet. Depending
-				// on the department's RequireLinkingConfirmation setting, either auto-link or run a
-				// one-time "Reply YES to link" confirmation before trusting the number.
+				// 1b. SMS identities are only trusted while the linked profile's mobile number is
+				// verified AND still matches the sending number. Links created before verification was
+				// required, or made stale by a number change, must not authenticate the sender — drop
+				// them and fall through to the fresh phone-match below (the number may now belong to a
+				// different, verified profile).
+				if (identity != null && IsSmsPlatform(message.Platform))
+				{
+					var linkedProfile = await _userProfileService.GetProfileByUserIdAsync(identity.UserId);
+					if (linkedProfile == null
+						|| linkedProfile.MobileNumberVerified != true
+						|| !PhoneNumbersMatch(linkedProfile.GetPhoneNumber(), message.From))
+					{
+						// Only physically remove SMS links. The phone fallback can also surface a
+						// cross-platform identity (e.g. WhatsApp ids are phone numbers); those are
+						// merely not trusted for this SMS message, not deleted.
+						if (IsSmsPlatform(identity.Platform))
+							await _userIdentityService.UnlinkUserAsync(identity.Id);
+						identity = null;
+					}
+				}
+
+				// 1c. SMS: a phone number that matches a Resgrid profile but isn't linked yet. Only a
+				// VERIFIED mobile number may authenticate a sender; when it is verified the identity link
+				// is created silently (it's an internal optimization, not something the user is asked about).
 				if (identity == null && IsSmsPlatform(message.Platform))
 				{
 					var cleanPhone = message.From?.Replace("+", "").Trim();
@@ -77,19 +103,18 @@ public async Task<ChatbotResponse> ProcessMessageAsync(ChatbotMessage message)
 						var profile = await _userProfileService.GetProfileByMobileNumberAsync(cleanPhone);
 						if (profile != null)
 						{
-							var candidateDepartment = await ResolveActiveDepartmentAsync(profile.UserId);
-							var requireConfirmation = candidateDepartment == null
-								|| ((await _departmentConfigService.GetConfigAsync(candidateDepartment.DepartmentId))?.RequireLinkingConfirmation ?? true);
-
-							if (!requireConfirmation)
+							if (profile.MobileNumberVerified == true)
 							{
 								identity = await _userIdentityService.LinkUserAsync(
-									profile.UserId, message.Platform, message.From, profile.FullName.AsFirstNameLastName, "phone_match");
+									profile.UserId, message.Platform, message.From, profile.FullName.AsFirstNameLastName, "phone_match_verified");
 							}
 							else
 							{
-								// Returns the prompt / acknowledgement; links the number on a YES reply.
-								return await HandlePhoneLinkConfirmationAsync(message, profile, candidateDepartment);
+								return new ChatbotResponse
+								{
+									Text = "This mobile number matches a Resgrid profile but hasn't been verified yet. Please verify your mobile number on your Resgrid profile page, then text again.",
+									Processed = true
+								};
 							}
 						}
 					}
@@ -211,34 +236,49 @@ await _userIdentityService.LinkUserAsync(
 					var reply = message.Text?.Trim().ToUpperInvariant();
 					if (reply == "YES" || reply == "Y" || reply == "CONFIRM" || reply == "OK")
 					{
-						var pendingType = session.PendingIntent.Value;
-
-						// Locate the owning handler BEFORE mutating session state. If none can handle
-						// the pending intent, leave the session parked in AwaitingConfirmation and return
-						// an explicit error rather than silently dropping the confirmation.
-						var confirmHandler = _actionHandlers.FirstOrDefault(h => h.CanHandle(pendingType));
-						if (confirmHandler == null)
+						// Step-up auth: when the department forces security-PIN usage (or the user opted
+						// in), a confirmed destructive action additionally requires the user's 4-digit PIN
+						// before it executes.
+						if (await _securityPinService.IsPinRequiredAsync(identity.UserId, department.DepartmentId))
 						{
-							return new ChatbotResponse
+							// Provision a missing PIN BEFORE persisting the awaiting-PIN state: if
+							// provisioning fails (no profile, or a thrown error caught by the outer
+							// handler) the session stays parked in AwaitingConfirmation instead of
+							// being stranded awaiting a PIN that doesn't exist.
+							bool pinGenerated = false;
+							if (!await _securityPinService.HasPinAsync(identity.UserId))
 							{
-								Text = "Unable to complete confirmation — please try again or contact support.",
-								Processed = false
-							};
+								var provisioned = await _securityPinService.EnsurePinAsync(identity.UserId, department.DepartmentId);
+								if (provisioned == null || string.IsNullOrWhiteSpace(provisioned.SecurityPin))
+								{
+									return new ChatbotResponse
+									{
+										Text = "This action requires a security PIN, but one couldn't be set up for your account. Please set a PIN on your Resgrid profile page, then reply YES again.",
+										Processed = true
+									};
+								}
+								pinGenerated = true;
+							}
+
+							session.State = ChatbotDialogState.AwaitingPin;
+							session.Context["__pinAttempts"] = "0";
+							await _sessionManager.SaveSessionAsync(session);
+
+							if (pinGenerated)
+							{
+								// Department forces PINs but this user didn't have one yet — one was
+								// generated so they can look it up on their profile page and continue.
+								return new ChatbotResponse
+								{
+									Text = "This action requires your security PIN. A PIN has been generated for you — view or change it on your Resgrid profile page, then reply with the 4-digit PIN to continue, or NO to cancel.",
+									Processed = true
+								};
+							}
+
+							return new ChatbotResponse { Text = "For security, reply with your 4-digit security PIN to complete this action, or NO to cancel.", Processed = true };
 						}
 
-						var confirmedIntent = new ChatbotIntent
-						{
-							Type = pendingType,
-							Parameters = new Dictionary<string, string>(session.Context) { ["__confirmed"] = "true" }
-						};
-
-						var confirmResponse = await confirmHandler.HandleAsync(message, confirmedIntent, session);
-						confirmResponse.Intent = confirmedIntent;
-						session.Context.Clear();
-						session.State = ChatbotDialogState.Idle;
-						session.PendingIntent = null;
-						await _sessionManager.SaveSessionAsync(session);
-						return confirmResponse;
+						return await DispatchConfirmedIntentAsync(message, session);
 					}
 					else if (reply == "NO" || reply == "N" || reply == "CANCEL")
 					{
@@ -252,6 +292,46 @@ await _userIdentityService.LinkUserAsync(
 					}
 				}
 
+				// 5b. PIN step-up for an already-confirmed destructive action: the user replied YES and a
+				// security PIN is required, so the pending intent only executes on a correct PIN.
+				if (session.State == ChatbotDialogState.AwaitingPin && session.PendingIntent.HasValue)
+				{
+					var pinReply = message.Text?.Trim();
+
+					if (IsNegative(pinReply))
+					{
+						session.Reset();
+						await _sessionManager.SaveSessionAsync(session);
+						return new ChatbotResponse { Text = "Cancelled.", Processed = true };
+					}
+
+					if (!SecurityPinUtility.IsValidFormat(pinReply))
+						return new ChatbotResponse { Text = "Please reply with your 4-digit security PIN, or NO to cancel.", Processed = true };
+
+					if (await _securityPinService.ValidatePinAsync(identity.UserId, pinReply))
+					{
+						session.Context.Remove("__pinAttempts");
+						return await DispatchConfirmedIntentAsync(message, session);
+					}
+					else
+					{
+						session.Context.TryGetValue("__pinAttempts", out var attemptsRaw);
+						int.TryParse(attemptsRaw, out var attempts);
+						attempts++;
+
+						if (attempts >= MaxPinAttempts)
+						{
+							session.Reset();
+							await _sessionManager.SaveSessionAsync(session);
+							return new ChatbotResponse { Text = "Too many incorrect PIN attempts. The action has been cancelled.", Processed = true };
+						}
+
+						session.Context["__pinAttempts"] = attempts.ToString();
+						await _sessionManager.SaveSessionAsync(session);
+						return new ChatbotResponse { Text = "Incorrect PIN. Reply with your 4-digit security PIN, or NO to cancel.", Processed = true };
+					}
+				}
+
 				if (session.State != ChatbotDialogState.Idle)
 				{
 					var continuationResult = await _conversationEngine.HandleContinuationAsync(message, session);
@@ -346,12 +426,6 @@ private static bool IsEmergencyText(string text)
 			return t.Contains("mayday") || t.Contains("emergency") || t.Contains("officer down") || t.Contains("firefighter down");
 		}
 
-		private static bool IsAffirmative(string text)
-		{
-			var t = text?.Trim().ToLowerInvariant();
-			return t == "yes" || t == "y" || t == "confirm";
-		}
-
 		private static bool IsNegative(string text)
 		{
 			var t = text?.Trim().ToLowerInvariant();
@@ -359,55 +433,60 @@ private static bool IsNegative(string text)
 		}
 
 		/// <summary>
-		/// One-time confirmation before linking an unrecognized SMS number to the matching Resgrid
-		/// account. Prompts on first contact, links on YES, cancels on NO.
+		/// Executes the pending (already confirmed, and PIN-verified when required) destructive intent.
+		/// The owning handler is located BEFORE any session state is mutated: if none can handle the
+		/// pending intent the session stays parked and an explicit error is returned rather than
+		/// silently dropping the confirmation.
 		/// </summary>
-		private async Task<ChatbotResponse> HandlePhoneLinkConfirmationAsync(ChatbotMessage message, Model.UserProfile profile, Model.Department department)
+		private async Task<ChatbotResponse> DispatchConfirmedIntentAsync(ChatbotMessage message, ChatbotSession session)
 		{
-			// A matched profile may have no active department membership, in which case the caller
-			// passes a null department. The phone-link confirmation only tracks trust of the number
-			// (linking doesn't depend on a department), so fall back to department id 0 for the
-			// temporary session rather than dereferencing a null department.
-			var session = await _sessionManager.GetOrCreateSessionAsync(profile.UserId, department?.DepartmentId ?? 0, message.Platform, message.From);
-
-			var awaitingConfirmation = session.State == ChatbotDialogState.AwaitingConfirmation
-				&& session.Context != null
-				&& session.Context.TryGetValue("pendingAction", out var pendingAction)
-				&& pendingAction == "confirm_phone_link";
-
-			if (awaitingConfirmation)
-			{
-				if (IsAffirmative(message.Text))
-				{
-					await _userIdentityService.LinkUserAsync(
-						profile.UserId, message.Platform, message.From, profile.FullName.AsFirstNameLastName, "phone_match_confirmed");
-					session.State = ChatbotDialogState.Idle;
-					session.Context.Remove("pendingAction");
-					await _sessionManager.SaveSessionAsync(session);
-					return new ChatbotResponse { Text = "Your number is now linked to your Resgrid account. Text HELP to see what you can do.", Processed = true };
-				}
+			var pendingType = session.PendingIntent.Value;
 
-				if (IsNegative(message.Text))
+			var confirmHandler = _actionHandlers.FirstOrDefault(h => h.CanHandle(pendingType));
+			if (confirmHandler == null)
+			{
+				return new ChatbotResponse
 				{
-					await _sessionManager.EndSessionAsync(session.SessionId);
-					return new ChatbotResponse { Text = "No problem — I won't link this number. Reply LINK anytime to connect your account.", Processed = true };
-				}
-
-				return new ChatbotResponse { Text = "Please reply YES to link this number to your Resgrid account, or NO to cancel.", Processed = false };
+					Text = "Unable to complete confirmation — please try again or contact support.",
+					Processed = false
+				};
 			}
 
-			// First contact for this number: ask for confirmation before linking.
-			session.State = ChatbotDialogState.AwaitingConfirmation;
-			session.Context["pendingAction"] = "confirm_phone_link";
-			await _sessionManager.SaveSessionAsync(session);
-
-			return new ChatbotResponse
+			var confirmedIntent = new ChatbotIntent
 			{
-				Text = $"We found a Resgrid account for {profile.FirstName}. Reply YES to link this number, or NO to cancel.",
-				Processed = true
+				Type = pendingType,
+				Parameters = new Dictionary<string, string>(session.Context) { ["__confirmed"] = "true" }
 			};
+
+			var confirmResponse = await confirmHandler.HandleAsync(message, confirmedIntent, session);
+			confirmResponse.Intent = confirmedIntent;
+			session.Context.Clear();
+			session.State = ChatbotDialogState.Idle;
+			session.PendingIntent = null;
+			await _sessionManager.SaveSessionAsync(session);
+			return confirmResponse;
+		}
+
+		/// <summary>
+		/// Compares a profile phone number against a sender number, ignoring formatting and tolerating
+		/// a leading US country code on either side (mirrors GetProfileByMobileNumberAsync).
+		/// </summary>
+		private static bool PhoneNumbersMatch(string profileNumber, string senderNumber)
+		{
+			var a = NormalizePhone(profileNumber);
+			var b = NormalizePhone(senderNumber);
+
+			if (string.IsNullOrWhiteSpace(a) || string.IsNullOrWhiteSpace(b))
+				return false;
+
+			return a == b
+				|| (a.Length == 11 && a[0] == '1' && a.Substring(1) == b)
+				|| (b.Length == 11 && b[0] == '1' && b.Substring(1) == a);
 		}
 
+		private static string NormalizePhone(string number)
+			=> number?.Replace(" ", "").Replace("(", "").Replace(")", "").Replace("+", "").Replace("-", "").Replace(".", "").Trim();
+
 		private async Task<Model.Department> ResolveActiveDepartmentAsync(string userId)
 		{
 			// Shared resolution: the user's active (then default, then first) membership, preferring one whose
diff --git a/Core/Resgrid.Framework/SecurityPinUtility.cs b/Core/Resgrid.Framework/SecurityPinUtility.cs
new file mode 100644
index 000000000..36ccd0aff
--- /dev/null
+++ b/Core/Resgrid.Framework/SecurityPinUtility.cs
@@ -0,0 +1,71 @@
+using System.Security.Cryptography;
+
+namespace Resgrid.Framework
+{
+	/// <summary>
+	/// Generation and validation rules for the 4-digit user security PIN used as a step-up
+	/// (2FA-style) check for dangerous/department-wide chatbot and SMS actions.
+	/// </summary>
+	public static class SecurityPinUtility
+	{
+		public const int PinLength = 4;
+
+		/// <summary>True when the value is exactly <see cref="PinLength"/> ASCII digits.</summary>
+		public static bool IsValidFormat(string pin)
+		{
+			if (string.IsNullOrWhiteSpace(pin) || pin.Length != PinLength)
+				return false;
+
+			foreach (var c in pin)
+			{
+				if (c < '0' || c > '9')
+					return false;
+			}
+
+			return true;
+		}
+
+		/// <summary>
+		/// True for trivially guessable PINs: all-same-digit (0000, 1111, ...) and consecutive
+		/// ascending/descending runs (1234, 0123, 4321, 9876, ...).
+		/// </summary>
+		public static bool IsWeak(string pin)
+		{
+			if (!IsValidFormat(pin))
+				return true;
+
+			bool allSame = true, ascending = true, descending = true;
+			for (int i = 1; i < pin.Length; i++)
+			{
+				if (pin[i] != pin[0])
+					allSame = false;
+				if (pin[i] != pin[i - 1] + 1)
+					ascending = false;
+				if (pin[i] != pin[i - 1] - 1)
+					descending = false;
+			}
+
+			return allSame || ascending || descending;
+		}
+
+		/// <summary>Valid format and not weak.</summary>
+		public static bool IsAcceptable(string pin) => IsValidFormat(pin) && !IsWeak(pin);
+
+		/// <summary>Generates a random PIN that passes <see cref="IsAcceptable"/> using a crypto RNG.</summary>
+		public static string Generate()
+		{
+			using var rng = RandomNumberGenerator.Create();
+			var bytes = new byte[4];
+
+			while (true)
+			{
+				rng.GetBytes(bytes);
+				uint value = (uint)(bytes[0] | bytes[1] << 8 | bytes[2] << 16 | bytes[3] << 24);
+				string pin = (value % 10000).ToString().PadLeft(PinLength, '0');
+
+				if (IsAcceptable(pin))
+					return pin;
+			}
+		}
+	}
+}
diff --git a/Core/Resgrid.Framework/StringHelpers.cs b/Core/Resgrid.Framework/StringHelpers.cs
index 872be8ce6..5caee30e6 100644
--- a/Core/Resgrid.Framework/StringHelpers.cs
+++ b/Core/Resgrid.Framework/StringHelpers.cs
@@ -21,6 +21,22 @@ public sealed record PasswordComplexityResult(
 
 	public static class StringHelpers
 	{
+		/// <summary>
+		/// Masks a phone number for diagnostic logging (PII redaction), keeping only the last
+		/// four digits (e.g. "***4567"). Values with four or fewer characters are fully masked.
+		/// </summary>
+		public static string MaskPhoneNumber(string number)
+		{
+			if (string.IsNullOrWhiteSpace(number))
+				return "***";
+
+			var trimmed = number.Trim();
+			if (trimmed.Length <= 4)
+				return "***";
+
+			return "***" + trimmed.Substring(trimmed.Length - 4);
+		}
+
 		/// <summary>
 		/// Remove HTML tags from string using char array.
 		/// </summary>
diff --git a/Core/Resgrid.Localization/Areas/User/Department/Department.ar.resx b/Core/Resgrid.Localization/Areas/User/Department/Department.ar.resx
index d931429c1..b101355df 100644
--- a/Core/Resgrid.Localization/Areas/User/Department/Department.ar.resx
+++ b/Core/Resgrid.Localization/Areas/User/Department/Department.ar.resx
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <root>
   <!--
     Microsoft ResX Schema
@@ -732,4 +732,10 @@
   <data name="EnableModernNotificationsHelp" xml:space="preserve">
     <value>When enabled, push notifications will use the modern notification sounds instead of the legacy sounds for all users in this department.</value>
   </data>
-</root>
+  <data name="ForceChatbotSecurityPin" xml:space="preserve">
+    <value>طلب رمز PIN الأمان</value>
+  </data>
+  <data name="ForceChatbotSecurityPinHelp" xml:space="preserve">
+    <value>يتطلب من كل عضو تأكيد الإجراءات الخطرة أو على مستوى القسم عبر روبوت الدردشة/الرسائل النصية باستخدام رمز PIN الأمان الشخصي المكون من 4 أرقام. يحصل الأعضاء الذين ليس لديهم رمز PIN على رمز يتم إنشاؤه عشوائيًا (يمكن عرضه في صفحة ملفهم الشخصي).</value>
+  </data>
+</root>
\ No newline at end of file
diff --git a/Core/Resgrid.Localization/Areas/User/Department/Department.de.resx b/Core/Resgrid.Localization/Areas/User/Department/Department.de.resx
index ef215ef74..58200d5b5 100644
--- a/Core/Resgrid.Localization/Areas/User/Department/Department.de.resx
+++ b/Core/Resgrid.Localization/Areas/User/Department/Department.de.resx
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <root>
   <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
     <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
@@ -683,4 +683,10 @@
   <data name="EnableModernNotificationsHelp" xml:space="preserve">
     <value>When enabled, push notifications will use the modern notification sounds instead of the legacy sounds for all users in this department.</value>
   </data>
-</root>
+  <data name="ForceChatbotSecurityPin" xml:space="preserve">
+    <value>Sicherheits-PIN erforderlich</value>
+  </data>
+  <data name="ForceChatbotSecurityPinHelp" xml:space="preserve">
+    <value>Verlangt, dass jedes Mitglied gefährliche oder abteilungsweite Chatbot-/SMS-Aktionen mit seiner persönlichen 4-stelligen Sicherheits-PIN bestätigt. Mitglieder ohne PIN erhalten eine zufällig generierte (einsehbar auf ihrer Profilseite).</value>
+  </data>
+</root>
\ No newline at end of file
diff --git a/Core/Resgrid.Localization/Areas/User/Department/Department.en.resx b/Core/Resgrid.Localization/Areas/User/Department/Department.en.resx
index 7049b9d31..5ad4fe260 100644
--- a/Core/Resgrid.Localization/Areas/User/Department/Department.en.resx
+++ b/Core/Resgrid.Localization/Areas/User/Department/Department.en.resx
@@ -762,4 +762,10 @@
   <data name="EnableModernNotificationsHelp" xml:space="preserve">
     <value>When enabled, push notifications will use the modern notification sounds instead of the legacy sounds for all users in this department.</value>
   </data>
-</root>
+  <data name="ForceChatbotSecurityPin" xml:space="preserve">
+    <value>Require Security PIN</value>
+  </data>
+  <data name="ForceChatbotSecurityPinHelp" xml:space="preserve">
+    <value>Require every member to confirm dangerous or department-wide chatbot/text actions with their personal 4-digit security PIN. Members without a PIN get a randomly generated one (viewable on their profile page).</value>
+  </data>
+</root>
\ No newline at end of file
diff --git a/Core/Resgrid.Localization/Areas/User/Department/Department.es.resx b/Core/Resgrid.Localization/Areas/User/Department/Department.es.resx
index f518398e8..98127dc05 100644
--- a/Core/Resgrid.Localization/Areas/User/Department/Department.es.resx
+++ b/Core/Resgrid.Localization/Areas/User/Department/Department.es.resx
@@ -618,4 +618,10 @@
   <data name="EnableModernNotificationsHelp" xml:space="preserve">
     <value>When enabled, push notifications will use the modern notification sounds instead of the legacy sounds for all users in this department.</value>
   </data>
+  <data name="ForceChatbotSecurityPin" xml:space="preserve">
+    <value>Requerir PIN de seguridad</value>
+  </data>
+  <data name="ForceChatbotSecurityPinHelp" xml:space="preserve">
+    <value>Exige que cada miembro confirme las acciones peligrosas o de todo el departamento del chatbot/mensajes de texto con su PIN de seguridad personal de 4 dígitos. Los miembros sin PIN reciben uno generado aleatoriamente (visible en su página de perfil).</value>
+  </data>
 </root>
\ No newline at end of file
diff --git a/Core/Resgrid.Localization/Areas/User/Department/Department.fr.resx b/Core/Resgrid.Localization/Areas/User/Department/Department.fr.resx
index 788b6c2c8..5bd75802d 100644
--- a/Core/Resgrid.Localization/Areas/User/Department/Department.fr.resx
+++ b/Core/Resgrid.Localization/Areas/User/Department/Department.fr.resx
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <root>
   <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
     <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
@@ -683,4 +683,10 @@
   <data name="EnableModernNotificationsHelp" xml:space="preserve">
     <value>When enabled, push notifications will use the modern notification sounds instead of the legacy sounds for all users in this department.</value>
   </data>
-</root>
+  <data name="ForceChatbotSecurityPin" xml:space="preserve">
+    <value>Exiger le code PIN de sécurité</value>
+  </data>
+  <data name="ForceChatbotSecurityPinHelp" xml:space="preserve">
+    <value>Exige que chaque membre confirme les actions dangereuses ou à l'échelle du service du chatbot/SMS avec son code PIN de sécurité personnel à 4 chiffres. Les membres sans PIN en reçoivent un généré aléatoirement (visible sur leur page de profil).</value>
+  </data>
+</root>
\ No newline at end of file
diff --git a/Core/Resgrid.Localization/Areas/User/Department/Department.it.resx b/Core/Resgrid.Localization/Areas/User/Department/Department.it.resx
index 51bfb54a9..4cc37f7a2 100644
--- a/Core/Resgrid.Localization/Areas/User/Department/Department.it.resx
+++ b/Core/Resgrid.Localization/Areas/User/Department/Department.it.resx
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <root>
   <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
     <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
@@ -683,4 +683,10 @@
   <data name="EnableModernNotificationsHelp" xml:space="preserve">
     <value>When enabled, push notifications will use the modern notification sounds instead of the legacy sounds for all users in this department.</value>
   </data>
-</root>
+  <data name="ForceChatbotSecurityPin" xml:space="preserve">
+    <value>Richiedi PIN di sicurezza</value>
+  </data>
+  <data name="ForceChatbotSecurityPinHelp" xml:space="preserve">
+    <value>Richiede che ogni membro confermi le azioni pericolose o a livello di dipartimento del chatbot/SMS con il proprio PIN di sicurezza personale a 4 cifre. I membri senza PIN ne ricevono uno generato casualmente (visibile nella pagina del profilo).</value>
+  </data>
+</root>
\ No newline at end of file
diff --git a/Core/Resgrid.Localization/Areas/User/Department/Department.pl.resx b/Core/Resgrid.Localization/Areas/User/Department/Department.pl.resx
index b2c0f6acb..60f7a531b 100644
--- a/Core/Resgrid.Localization/Areas/User/Department/Department.pl.resx
+++ b/Core/Resgrid.Localization/Areas/User/Department/Department.pl.resx
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <root>
   <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
     <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
@@ -683,4 +683,10 @@
   <data name="EnableModernNotificationsHelp" xml:space="preserve">
     <value>When enabled, push notifications will use the modern notification sounds instead of the legacy sounds for all users in this department.</value>
   </data>
-</root>
+  <data name="ForceChatbotSecurityPin" xml:space="preserve">
+    <value>Wymagaj kodu PIN bezpieczeństwa</value>
+  </data>
+  <data name="ForceChatbotSecurityPinHelp" xml:space="preserve">
+    <value>Wymaga, aby każdy członek potwierdzał niebezpieczne lub obejmujące cały wydział akcje chatbota/SMS swoim osobistym 4-cyfrowym kodem PIN bezpieczeństwa. Członkowie bez kodu PIN otrzymują losowo wygenerowany (widoczny na stronie profilu).</value>
+  </data>
+</root>
\ No newline at end of file
diff --git a/Core/Resgrid.Localization/Areas/User/Department/Department.resx b/Core/Resgrid.Localization/Areas/User/Department/Department.resx
index 62f6200b5..2e5ac6d8b 100644
--- a/Core/Resgrid.Localization/Areas/User/Department/Department.resx
+++ b/Core/Resgrid.Localization/Areas/User/Department/Department.resx
@@ -357,4 +357,10 @@
   <data name="EnableModernNotificationsHelp" xml:space="preserve">
     <value>When enabled, push notifications will use the modern notification sounds instead of the legacy sounds for all users in this department.</value>
   </data>
-</root>
+  <data name="ForceChatbotSecurityPin" xml:space="preserve">
+    <value>Require Security PIN</value>
+  </data>
+  <data name="ForceChatbotSecurityPinHelp" xml:space="preserve">
+    <value>Require every member to confirm dangerous or department-wide chatbot/text actions with their personal 4-digit security PIN. Members without a PIN get a randomly generated one (viewable on their profile page).</value>
+  </data>
+</root>
\ No newline at end of file
diff --git a/Core/Resgrid.Localization/Areas/User/Department/Department.sv.resx b/Core/Resgrid.Localization/Areas/User/Department/Department.sv.resx
index a245d09a2..34b760ba7 100644
--- a/Core/Resgrid.Localization/Areas/User/Department/Department.sv.resx
+++ b/Core/Resgrid.Localization/Areas/User/Department/Department.sv.resx
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <root>
   <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
     <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
@@ -683,4 +683,10 @@
   <data name="EnableModernNotificationsHelp" xml:space="preserve">
     <value>When enabled, push notifications will use the modern notification sounds instead of the legacy sounds for all users in this department.</value>
   </data>
-</root>
+  <data name="ForceChatbotSecurityPin" xml:space="preserve">
+    <value>Kräv säkerhets-PIN</value>
+  </data>
+  <data name="ForceChatbotSecurityPinHelp" xml:space="preserve">
+    <value>Kräver att varje medlem bekräftar farliga eller avdelningsövergripande chatbot-/SMS-åtgärder med sin personliga 4-siffriga säkerhets-PIN. Medlemmar utan PIN får en slumpmässigt genererad (visas på deras profilsida).</value>
+  </data>
+</root>
\ No newline at end of file
diff --git a/Core/Resgrid.Localization/Areas/User/Department/Department.uk.resx b/Core/Resgrid.Localization/Areas/User/Department/Department.uk.resx
index 1c448ba63..9fa659bf7 100644
--- a/Core/Resgrid.Localization/Areas/User/Department/Department.uk.resx
+++ b/Core/Resgrid.Localization/Areas/User/Department/Department.uk.resx
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <root>
   <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
     <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
@@ -683,4 +683,10 @@
   <data name="EnableModernNotificationsHelp" xml:space="preserve">
     <value>When enabled, push notifications will use the modern notification sounds instead of the legacy sounds for all users in this department.</value>
   </data>
-</root>
+  <data name="ForceChatbotSecurityPin" xml:space="preserve">
+    <value>Вимагати PIN-код безпеки</value>
+  </data>
+  <data name="ForceChatbotSecurityPinHelp" xml:space="preserve">
+    <value>Вимагає, щоб кожен учасник підтверджував небезпечні або загальновідомчі дії чат-бота/SMS своїм особистим 4-значним PIN-кодом безпеки. Учасники без PIN-коду отримують випадково згенерований (доступний на сторінці профілю).</value>
+  </data>
+</root>
\ No newline at end of file
diff --git a/Core/Resgrid.Localization/Areas/User/Home/EditProfile.ar.resx b/Core/Resgrid.Localization/Areas/User/Home/EditProfile.ar.resx
index 2eb051a8b..23920828f 100644
--- a/Core/Resgrid.Localization/Areas/User/Home/EditProfile.ar.resx
+++ b/Core/Resgrid.Localization/Areas/User/Home/EditProfile.ar.resx
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <root>
   <resheader name="resmimetype"><value>text/microsoft-resx</value></resheader>
   <resheader name="version"><value>2.0</value></resheader>
@@ -107,4 +107,22 @@
   <data name="PasswordRequirementsLength" xml:space="preserve"><value>على الأقل {0} أحرف</value></data>
   <data name="PasswordRequirementsDigit" xml:space="preserve"><value>رقم واحد على الأقل</value></data>
   <data name="PasswordRequirementsCase" xml:space="preserve"><value>حرف كبير وحرف صغير على الأقل</value></data>
-</root>
+  <data name="SecurityPinEnabledHelp" xml:space="preserve">
+    <value>عند التفعيل، تطلب الإجراءات الخطرة عبر روبوت الدردشة/الرسائل النصية رمز PIN كخطوة أمان إضافية. إذا فعّلت هذا بدون رمز PIN، يتم إنشاء رمز عشوائي لك.</value>
+  </data>
+  <data name="SecurityPinEnabledLabel" xml:space="preserve">
+    <value>طلب رمز PIN الأمان</value>
+  </data>
+  <data name="SecurityPinForcedHelp" xml:space="preserve">
+    <value>يتطلب قسمك رمز PIN الأمان للإجراءات الخطرة عبر روبوت الدردشة/الرسائل النصية، لذلك يكون هذا الخيار مفعلاً دائمًا.</value>
+  </data>
+  <data name="SecurityPinHelp" xml:space="preserve">
+    <value>يؤكد رمز PIN الأمان المكون من 4 أرقام الإجراءات الخطرة أو على مستوى القسم التي تتم عبر الرسائل النصية أو روبوت الدردشة. تجنب الأرقام المتكررة (0000) والمتسلسلة (1234، 4321). اتركه فارغًا للاحتفاظ برمز PIN الحالي.</value>
+  </data>
+  <data name="SecurityPinLabel" xml:space="preserve">
+    <value>رمز PIN الأمان</value>
+  </data>
+  <data name="SecurityPinPlaceholder" xml:space="preserve">
+    <value>رمز PIN من 4 أرقام</value>
+  </data>
+</root>
\ No newline at end of file
diff --git a/Core/Resgrid.Localization/Areas/User/Home/EditProfile.de.resx b/Core/Resgrid.Localization/Areas/User/Home/EditProfile.de.resx
index ff60e4ded..0e659186e 100644
--- a/Core/Resgrid.Localization/Areas/User/Home/EditProfile.de.resx
+++ b/Core/Resgrid.Localization/Areas/User/Home/EditProfile.de.resx
@@ -365,4 +365,22 @@
   <data name="PasswordRequirementsLength" xml:space="preserve"><value>Mindestens {0} Zeichen lang</value></data>
   <data name="PasswordRequirementsDigit" xml:space="preserve"><value>Mindestens eine Ziffer (Zahl)</value></data>
   <data name="PasswordRequirementsCase" xml:space="preserve"><value>Mindestens ein Groß- und ein Kleinbuchstabe</value></data>
-</root>
+  <data name="SecurityPinEnabledHelp" xml:space="preserve">
+    <value>Wenn aktiviert, fragen gefährliche Chatbot-/SMS-Aktionen Ihre PIN als zusätzlichen Sicherheitsschritt ab. Wenn Sie dies ohne PIN aktivieren, wird eine zufällige PIN für Sie generiert.</value>
+  </data>
+  <data name="SecurityPinEnabledLabel" xml:space="preserve">
+    <value>Sicherheits-PIN erforderlich</value>
+  </data>
+  <data name="SecurityPinForcedHelp" xml:space="preserve">
+    <value>Ihre Abteilung verlangt eine Sicherheits-PIN für gefährliche Chatbot-/SMS-Aktionen, daher ist diese Option immer aktiviert.</value>
+  </data>
+  <data name="SecurityPinHelp" xml:space="preserve">
+    <value>Ihre 4-stellige Sicherheits-PIN bestätigt gefährliche oder abteilungsweite Aktionen per SMS oder Chatbot. Vermeiden Sie wiederholte Ziffern (0000) und Folgen (1234, 4321). Leer lassen, um Ihre aktuelle PIN zu behalten.</value>
+  </data>
+  <data name="SecurityPinLabel" xml:space="preserve">
+    <value>Sicherheits-PIN</value>
+  </data>
+  <data name="SecurityPinPlaceholder" xml:space="preserve">
+    <value>4-stellige PIN</value>
+  </data>
+</root>
\ No newline at end of file
diff --git a/Core/Resgrid.Localization/Areas/User/Home/EditProfile.en.resx b/Core/Resgrid.Localization/Areas/User/Home/EditProfile.en.resx
index 552e2f548..f80087aa2 100644
--- a/Core/Resgrid.Localization/Areas/User/Home/EditProfile.en.resx
+++ b/Core/Resgrid.Localization/Areas/User/Home/EditProfile.en.resx
@@ -420,4 +420,22 @@
   <data name="PasswordRequirementsLength" xml:space="preserve"><value>At least {0} characters long</value></data>
   <data name="PasswordRequirementsDigit" xml:space="preserve"><value>At least one digit (number)</value></data>
   <data name="PasswordRequirementsCase" xml:space="preserve"><value>At least one uppercase and one lowercase letter</value></data>
-</root>
+  <data name="SecurityPinEnabledHelp" xml:space="preserve">
+    <value>When enabled, dangerous chatbot/text actions ask for your PIN as an extra security step. If you enable this without a PIN a random one is generated for you.</value>
+  </data>
+  <data name="SecurityPinEnabledLabel" xml:space="preserve">
+    <value>Require Security PIN</value>
+  </data>
+  <data name="SecurityPinForcedHelp" xml:space="preserve">
+    <value>Your department requires a security PIN for dangerous chatbot/text actions, so this option is always on.</value>
+  </data>
+  <data name="SecurityPinHelp" xml:space="preserve">
+    <value>Your 4-digit security PIN confirms dangerous or department-wide actions performed over text message or chatbot. Avoid repeated digits (0000) and sequences (1234, 4321). Leave blank to keep your current PIN.</value>
+  </data>
+  <data name="SecurityPinLabel" xml:space="preserve">
+    <value>Security PIN</value>
+  </data>
+  <data name="SecurityPinPlaceholder" xml:space="preserve">
+    <value>4-digit PIN</value>
+  </data>
+</root>
\ No newline at end of file
diff --git a/Core/Resgrid.Localization/Areas/User/Home/EditProfile.es.resx b/Core/Resgrid.Localization/Areas/User/Home/EditProfile.es.resx
index 42e44ae17..bdcf59b1d 100644
--- a/Core/Resgrid.Localization/Areas/User/Home/EditProfile.es.resx
+++ b/Core/Resgrid.Localization/Areas/User/Home/EditProfile.es.resx
@@ -411,4 +411,22 @@
   <data name="PasswordRequirementsLength" xml:space="preserve"><value>Al menos {0} caracteres</value></data>
   <data name="PasswordRequirementsDigit" xml:space="preserve"><value>Al menos un dígito (número)</value></data>
   <data name="PasswordRequirementsCase" xml:space="preserve"><value>Al menos una letra mayúscula y una minúscula</value></data>
-</root>
+  <data name="SecurityPinEnabledHelp" xml:space="preserve">
+    <value>Cuando está activado, las acciones peligrosas de chatbot/mensajes de texto solicitan su PIN como paso de seguridad adicional. Si lo activa sin un PIN, se genera uno aleatorio para usted.</value>
+  </data>
+  <data name="SecurityPinEnabledLabel" xml:space="preserve">
+    <value>Requerir PIN de seguridad</value>
+  </data>
+  <data name="SecurityPinForcedHelp" xml:space="preserve">
+    <value>Su departamento requiere un PIN de seguridad para acciones peligrosas de chatbot/mensajes de texto, por lo que esta opción está siempre activada.</value>
+  </data>
+  <data name="SecurityPinHelp" xml:space="preserve">
+    <value>Su PIN de seguridad de 4 dígitos confirma acciones peligrosas o de todo el departamento realizadas por mensaje de texto o chatbot. Evite dígitos repetidos (0000) y secuencias (1234, 4321). Déjelo en blanco para conservar su PIN actual.</value>
+  </data>
+  <data name="SecurityPinLabel" xml:space="preserve">
+    <value>PIN de seguridad</value>
+  </data>
+  <data name="SecurityPinPlaceholder" xml:space="preserve">
+    <value>PIN de 4 dígitos</value>
+  </data>
+</root>
\ No newline at end of file
diff --git a/Core/Resgrid.Localization/Areas/User/Home/EditProfile.fr.resx b/Core/Resgrid.Localization/Areas/User/Home/EditProfile.fr.resx
index 6b6b75c70..769d01aae 100644
--- a/Core/Resgrid.Localization/Areas/User/Home/EditProfile.fr.resx
+++ b/Core/Resgrid.Localization/Areas/User/Home/EditProfile.fr.resx
@@ -365,4 +365,22 @@
   <data name="PasswordRequirementsLength" xml:space="preserve"><value>Au moins {0} caractères</value></data>
   <data name="PasswordRequirementsDigit" xml:space="preserve"><value>Au moins un chiffre</value></data>
   <data name="PasswordRequirementsCase" xml:space="preserve"><value>Au moins une lettre majuscule et une minuscule</value></data>
-</root>
+  <data name="SecurityPinEnabledHelp" xml:space="preserve">
+    <value>Lorsqu'elle est activée, les actions dangereuses du chatbot/SMS demandent votre PIN comme étape de sécurité supplémentaire. Si vous l'activez sans PIN, un code aléatoire est généré pour vous.</value>
+  </data>
+  <data name="SecurityPinEnabledLabel" xml:space="preserve">
+    <value>Exiger le code PIN de sécurité</value>
+  </data>
+  <data name="SecurityPinForcedHelp" xml:space="preserve">
+    <value>Votre service exige un code PIN de sécurité pour les actions dangereuses du chatbot/SMS, cette option est donc toujours activée.</value>
+  </data>
+  <data name="SecurityPinHelp" xml:space="preserve">
+    <value>Votre code PIN de sécurité à 4 chiffres confirme les actions dangereuses ou à l'échelle du service effectuées par SMS ou chatbot. Évitez les chiffres répétés (0000) et les séquences (1234, 4321). Laissez vide pour conserver votre PIN actuel.</value>
+  </data>
+  <data name="SecurityPinLabel" xml:space="preserve">
+    <value>Code PIN de sécurité</value>
+  </data>
+  <data name="SecurityPinPlaceholder" xml:space="preserve">
+    <value>PIN à 4 chiffres</value>
+  </data>
+</root>
\ No newline at end of file
diff --git a/Core/Resgrid.Localization/Areas/User/Home/EditProfile.it.resx b/Core/Resgrid.Localization/Areas/User/Home/EditProfile.it.resx
index 5d4deefa1..001a097f2 100644
--- a/Core/Resgrid.Localization/Areas/User/Home/EditProfile.it.resx
+++ b/Core/Resgrid.Localization/Areas/User/Home/EditProfile.it.resx
@@ -365,4 +365,22 @@
   <data name="PasswordRequirementsLength" xml:space="preserve"><value>Almeno {0} caratteri</value></data>
   <data name="PasswordRequirementsDigit" xml:space="preserve"><value>Almeno una cifra (numero)</value></data>
   <data name="PasswordRequirementsCase" xml:space="preserve"><value>Almeno una lettera maiuscola e una minuscola</value></data>
-</root>
+  <data name="SecurityPinEnabledHelp" xml:space="preserve">
+    <value>Se attivato, le azioni pericolose di chatbot/SMS richiedono il tuo PIN come passaggio di sicurezza aggiuntivo. Se lo attivi senza un PIN, ne viene generato uno casuale per te.</value>
+  </data>
+  <data name="SecurityPinEnabledLabel" xml:space="preserve">
+    <value>Richiedi PIN di sicurezza</value>
+  </data>
+  <data name="SecurityPinForcedHelp" xml:space="preserve">
+    <value>Il tuo dipartimento richiede un PIN di sicurezza per le azioni pericolose di chatbot/SMS, quindi questa opzione è sempre attiva.</value>
+  </data>
+  <data name="SecurityPinHelp" xml:space="preserve">
+    <value>Il tuo PIN di sicurezza a 4 cifre conferma le azioni pericolose o a livello di dipartimento eseguite tramite SMS o chatbot. Evita cifre ripetute (0000) e sequenze (1234, 4321). Lascia vuoto per mantenere il PIN attuale.</value>
+  </data>
+  <data name="SecurityPinLabel" xml:space="preserve">
+    <value>PIN di sicurezza</value>
+  </data>
+  <data name="SecurityPinPlaceholder" xml:space="preserve">
+    <value>PIN a 4 cifre</value>
+  </data>
+</root>
\ No newline at end of file
diff --git a/Core/Resgrid.Localization/Areas/User/Home/EditProfile.pl.resx b/Core/Resgrid.Localization/Areas/User/Home/EditProfile.pl.resx
index 48d72c22c..7d41f6cca 100644
--- a/Core/Resgrid.Localization/Areas/User/Home/EditProfile.pl.resx
+++ b/Core/Resgrid.Localization/Areas/User/Home/EditProfile.pl.resx
@@ -365,4 +365,22 @@
   <data name="PasswordRequirementsLength" xml:space="preserve"><value>Co najmniej {0} znaków</value></data>
   <data name="PasswordRequirementsDigit" xml:space="preserve"><value>Co najmniej jedna cyfra</value></data>
   <data name="PasswordRequirementsCase" xml:space="preserve"><value>Co najmniej jedna wielka i jedna mała litera</value></data>
-</root>
+  <data name="SecurityPinEnabledHelp" xml:space="preserve">
+    <value>Po włączeniu niebezpieczne akcje chatbota/SMS wymagają podania kodu PIN jako dodatkowego zabezpieczenia. Jeśli włączysz tę opcję bez kodu PIN, zostanie wygenerowany losowy.</value>
+  </data>
+  <data name="SecurityPinEnabledLabel" xml:space="preserve">
+    <value>Wymagaj kodu PIN bezpieczeństwa</value>
+  </data>
+  <data name="SecurityPinForcedHelp" xml:space="preserve">
+    <value>Twój wydział wymaga kodu PIN bezpieczeństwa dla niebezpiecznych akcji chatbota/SMS, więc ta opcja jest zawsze włączona.</value>
+  </data>
+  <data name="SecurityPinHelp" xml:space="preserve">
+    <value>Twój 4-cyfrowy kod PIN bezpieczeństwa potwierdza niebezpieczne lub obejmujące cały wydział akcje wykonywane przez SMS lub chatbota. Unikaj powtarzających się cyfr (0000) i sekwencji (1234, 4321). Pozostaw puste, aby zachować obecny PIN.</value>
+  </data>
+  <data name="SecurityPinLabel" xml:space="preserve">
+    <value>Kod PIN bezpieczeństwa</value>
+  </data>
+  <data name="SecurityPinPlaceholder" xml:space="preserve">
+    <value>4-cyfrowy PIN</value>
+  </data>
+</root>
\ No newline at end of file
diff --git a/Core/Resgrid.Localization/Areas/User/Home/EditProfile.sv.resx b/Core/Resgrid.Localization/Areas/User/Home/EditProfile.sv.resx
index ee7354344..58d055450 100644
--- a/Core/Resgrid.Localization/Areas/User/Home/EditProfile.sv.resx
+++ b/Core/Resgrid.Localization/Areas/User/Home/EditProfile.sv.resx
@@ -365,4 +365,22 @@
   <data name="PasswordRequirementsLength" xml:space="preserve"><value>Minst {0} tecken</value></data>
   <data name="PasswordRequirementsDigit" xml:space="preserve"><value>Minst en siffra</value></data>
   <data name="PasswordRequirementsCase" xml:space="preserve"><value>Minst en stor och en liten bokstav</value></data>
-</root>
+  <data name="SecurityPinEnabledHelp" xml:space="preserve">
+    <value>När det är aktiverat begär farliga chatbot-/SMS-åtgärder din PIN som ett extra säkerhetssteg. Om du aktiverar detta utan PIN genereras en slumpmässig åt dig.</value>
+  </data>
+  <data name="SecurityPinEnabledLabel" xml:space="preserve">
+    <value>Kräv säkerhets-PIN</value>
+  </data>
+  <data name="SecurityPinForcedHelp" xml:space="preserve">
+    <value>Din avdelning kräver en säkerhets-PIN för farliga chatbot-/SMS-åtgärder, så det här alternativet är alltid på.</value>
+  </data>
+  <data name="SecurityPinHelp" xml:space="preserve">
+    <value>Din 4-siffriga säkerhets-PIN bekräftar farliga eller avdelningsövergripande åtgärder som utförs via SMS eller chatbot. Undvik upprepade siffror (0000) och sekvenser (1234, 4321). Lämna tomt för att behålla din nuvarande PIN.</value>
+  </data>
+  <data name="SecurityPinLabel" xml:space="preserve">
+    <value>Säkerhets-PIN</value>
+  </data>
+  <data name="SecurityPinPlaceholder" xml:space="preserve">
+    <value>4-siffrig PIN</value>
+  </data>
+</root>
\ No newline at end of file
diff --git a/Core/Resgrid.Localization/Areas/User/Home/EditProfile.uk.resx b/Core/Resgrid.Localization/Areas/User/Home/EditProfile.uk.resx
index 3f86a1313..d6c59aef9 100644
--- a/Core/Resgrid.Localization/Areas/User/Home/EditProfile.uk.resx
+++ b/Core/Resgrid.Localization/Areas/User/Home/EditProfile.uk.resx
@@ -365,4 +365,22 @@
   <data name="PasswordRequirementsLength" xml:space="preserve"><value>Щонайменше {0} символів</value></data>
   <data name="PasswordRequirementsDigit" xml:space="preserve"><value>Щонайменше одна цифра</value></data>
   <data name="PasswordRequirementsCase" xml:space="preserve"><value>Щонайменше одна велика та одна мала літера</value></data>
-</root>
+  <data name="SecurityPinEnabledHelp" xml:space="preserve">
+    <value>Якщо ввімкнено, небезпечні дії чат-бота/SMS запитують ваш PIN як додатковий крок безпеки. Якщо ви ввімкнете це без PIN-коду, для вас буде згенеровано випадковий.</value>
+  </data>
+  <data name="SecurityPinEnabledLabel" xml:space="preserve">
+    <value>Вимагати PIN-код безпеки</value>
+  </data>
+  <data name="SecurityPinForcedHelp" xml:space="preserve">
+    <value>Ваш відділ вимагає PIN-код безпеки для небезпечних дій чат-бота/SMS, тому цей параметр завжди ввімкнено.</value>
+  </data>
+  <data name="SecurityPinHelp" xml:space="preserve">
+    <value>Ваш 4-значний PIN-код безпеки підтверджує небезпечні або загальновідомчі дії, виконані через SMS або чат-бот. Уникайте повторюваних цифр (0000) і послідовностей (1234, 4321). Залиште порожнім, щоб зберегти поточний PIN.</value>
+  </data>
+  <data name="SecurityPinLabel" xml:space="preserve">
+    <value>PIN-код безпеки</value>
+  </data>
+  <data name="SecurityPinPlaceholder" xml:space="preserve">
+    <value>4-значний PIN</value>
+  </data>
+</root>
\ No newline at end of file
diff --git a/Core/Resgrid.Model/ChatbotIdentity.cs b/Core/Resgrid.Model/ChatbotIdentity.cs
index 538d16d96..1dd1c9570 100644
--- a/Core/Resgrid.Model/ChatbotIdentity.cs
+++ b/Core/Resgrid.Model/ChatbotIdentity.cs
@@ -14,6 +14,14 @@ namespace Resgrid.Model
 	[Table("ChatbotUserIdentities")]
 	public class ChatbotIdentity : IEntity
 	{
+		/// <summary>
+		/// SMS platform values, kept in sync with <c>Resgrid.Chatbot.Models.ChatbotPlatform</c>
+		/// (which Resgrid.Services cannot reference). Used when services outside the chatbot
+		/// project need to invalidate SMS-based identity links.
+		/// </summary>
+		public const int PlatformSmsTwilio = 1;
+		public const int PlatformSmsSignalWire = 2;
+
 		public string Id { get; set; }
 
 		[Required]
diff --git a/Core/Resgrid.Model/DepartmentSettingTypes.cs b/Core/Resgrid.Model/DepartmentSettingTypes.cs
index d219ed065..d747393f8 100644
--- a/Core/Resgrid.Model/DepartmentSettingTypes.cs
+++ b/Core/Resgrid.Model/DepartmentSettingTypes.cs
@@ -55,5 +55,6 @@ public enum DepartmentSettingTypes
 		UnitCallReleaseStatusToSet = 51,
 		UnitCallStatusOverridesByUnitType = 52,
 		EnableModernNotifications = 53,
+		ForceChatbotSecurityPin = 54,
 	}
 }
diff --git a/Core/Resgrid.Model/Repositories/IUserProfilesRepository.cs b/Core/Resgrid.Model/Repositories/IUserProfilesRepository.cs
index 6c6ec43b7..41c3d27d4 100644
--- a/Core/Resgrid.Model/Repositories/IUserProfilesRepository.cs
+++ b/Core/Resgrid.Model/Repositories/IUserProfilesRepository.cs
@@ -1,4 +1,5 @@
 using System.Collections.Generic;
+using System.Threading;
 using System.Threading.Tasks;
 
 namespace Resgrid.Model.Repositories
@@ -51,5 +52,14 @@ public interface IUserProfilesRepository: IRepository<UserProfile>
 		/// <param name="departmentId">The department identifier.</param>
 		/// <returns>Task&lt;IEnumerable&lt;UserProfile&gt;&gt;.</returns>
 		Task<IEnumerable<UserProfile>> GetAllUserProfilesForDepartmentIncDisabledDeletedAsync(int departmentId);
+
+		/// <summary>
+		/// Updates only the SecurityPin (and LastUpdated) columns for the supplied profiles as a
+		/// single batched command. Used for department-wide security PIN provisioning; callers are
+		/// responsible for profile cache eviction.
+		/// </summary>
+		/// <param name="profiles">Profiles with SecurityPin and LastUpdated already set.</param>
+		/// <param name="cancellationToken">The cancellation token.</param>
+		Task UpdateSecurityPinsAsync(IEnumerable<UserProfile> profiles, CancellationToken cancellationToken = default);
 	}
 }
diff --git a/Core/Resgrid.Model/Services/IDepartmentSettingsService.cs b/Core/Resgrid.Model/Services/IDepartmentSettingsService.cs
index 221dd84cc..d0054b6f4 100644
--- a/Core/Resgrid.Model/Services/IDepartmentSettingsService.cs
+++ b/Core/Resgrid.Model/Services/IDepartmentSettingsService.cs
@@ -314,5 +314,11 @@ Task<DepartmentSetting> SetUnitCallStatusOverridesByUnitTypeAsync(int department
 		Task<DepartmentSetting> GetSettingByTypeAsync(int departmentId, DepartmentSettingTypes type);
 
 		Task<bool> GetModernNotificationsEnabledAsync(int departmentId, bool bypassCache = false);
+
+		/// <summary>
+		/// True when the department forces every member to use their security PIN for dangerous
+		/// chatbot/SMS actions (overrides the per-user opt-in).
+		/// </summary>
+		Task<bool> GetForceChatbotSecurityPinAsync(int departmentId, bool bypassCache = false);
 	}
 }
diff --git a/Core/Resgrid.Model/Services/ISecurityPinService.cs b/Core/Resgrid.Model/Services/ISecurityPinService.cs
new file mode 100644
index 000000000..c2c5a0e11
--- /dev/null
+++ b/Core/Resgrid.Model/Services/ISecurityPinService.cs
@@ -0,0 +1,41 @@
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace Resgrid.Model.Services
+{
+	/// <summary>
+	/// Manages the per-user 4-digit security PIN used as a step-up (2FA-style) check for
+	/// dangerous/department-wide chatbot and SMS actions. PINs are stored AES-encrypted on the
+	/// user profile. A user can opt in personally (UserProfile.SecurityPinEnabled) or a
+	/// department can force PIN usage for all members (DepartmentSettingTypes.ForceChatbotSecurityPin).
+	/// </summary>
+	public interface ISecurityPinService
+	{
+		/// <summary>
+		/// True when the user must supply their security PIN for dangerous actions: either the
+		/// department forces PIN usage or the user opted in on their profile.
+		/// </summary>
+		Task<bool> IsPinRequiredAsync(string userId, int departmentId);
+
+		/// <summary>True when the user has a security PIN set on their profile.</summary>
+		Task<bool> HasPinAsync(string userId);
+
+		/// <summary>Validates the supplied PIN against the user's stored (encrypted) PIN.</summary>
+		Task<bool> ValidatePinAsync(string userId, string pin);
+
+		/// <summary>Gets the user's decrypted PIN (for own-profile display), or null when none is set.</summary>
+		Task<string> GetPinAsync(string userId);
+
+		/// <summary>
+		/// Generates and saves a random PIN for the user when they don't have one yet.
+		/// Returns the profile (with a PIN guaranteed set) or null when no profile exists.
+		/// </summary>
+		Task<UserProfile> EnsurePinAsync(string userId, int departmentId, CancellationToken cancellationToken = default);
+
+		/// <summary>
+		/// Generates a random PIN for every member of the department that doesn't have one yet.
+		/// Used when a department enables the ForceChatbotSecurityPin setting.
+		/// </summary>
+		Task EnsurePinsForDepartmentAsync(int departmentId, CancellationToken cancellationToken = default);
+	}
+}
diff --git a/Core/Resgrid.Model/UserProfile.cs b/Core/Resgrid.Model/UserProfile.cs
index e40481c1d..0866b3aaf 100644
--- a/Core/Resgrid.Model/UserProfile.cs
+++ b/Core/Resgrid.Model/UserProfile.cs
@@ -184,6 +184,20 @@ public class UserProfile: IEntity
 		[ProtoMember(50)]
 		public bool HomeVerificationVoiceCodeConsumed { get; set; }
 
+		/// <summary>
+		/// AES-encrypted (via IEncryptionService) 4-digit security PIN used as a step-up check for
+		/// dangerous/department-wide chatbot and SMS actions. Null = no PIN set yet.
+		/// </summary>
+		[ProtoMember(51)]
+		public string SecurityPin { get; set; }
+
+		/// <summary>
+		/// The user opted in to requiring their security PIN for dangerous chatbot/SMS actions.
+		/// The department-level ForceChatbotSecurityPin setting overrides this to on for everyone.
+		/// </summary>
+		[ProtoMember(52)]
+		public bool SecurityPinEnabled { get; set; }
+
 		[NotMapped]
 		[JsonIgnore]
 		public object IdValue
diff --git a/Core/Resgrid.Services/DepartmentSettingsService.cs b/Core/Resgrid.Services/DepartmentSettingsService.cs
index 194521ddc..5103f1638 100644
--- a/Core/Resgrid.Services/DepartmentSettingsService.cs
+++ b/Core/Resgrid.Services/DepartmentSettingsService.cs
@@ -23,6 +23,7 @@ public class DepartmentSettingsService : IDepartmentSettingsService
 		private static string TtsLanguageCacheKey = "DSetTtsLanguage_{0}";
 		private static string PersonnelOnUnitSetUnitStatusCacheKey = "DSetPersonnelOnUnitSetUnitStatus_{0}";
 		private static string ModernNotificationsCacheKey = "DSetModernNotifications_{0}";
+		private static string ForceChatbotSecurityPinCacheKey = "DSetForceChatbotSecurityPin_{0}";
 		private static TimeSpan LongCacheLength = TimeSpan.FromDays(14);
 		private static TimeSpan ThatsNotLongThisIsLongCacheLength = TimeSpan.FromDays(365);
 		private static TimeSpan TwoYearCacheLength = TimeSpan.FromDays(730);
@@ -85,6 +86,9 @@ public DepartmentSettingsService(IDepartmentSettingsRepository departmentSetting
 					case DepartmentSettingTypes.EnableModernNotifications:
 						await _cacheProvider.RemoveAsync(string.Format(ModernNotificationsCacheKey, departmentId));
 						break;
+					case DepartmentSettingTypes.ForceChatbotSecurityPin:
+						await _cacheProvider.RemoveAsync(string.Format(ForceChatbotSecurityPinCacheKey, departmentId));
+						break;
 				}
 
 				savedSetting.Setting = setting;
@@ -954,6 +958,23 @@ async Task<string> getSetting()
 			return bool.Parse(await getSetting());
 		}
 
+		public async Task<bool> GetForceChatbotSecurityPinAsync(int departmentId, bool bypassCache = false)
+		{
+			async Task<string> getSetting()
+			{
+				var s = await GetSettingByDepartmentIdType(departmentId, DepartmentSettingTypes.ForceChatbotSecurityPin);
+				return s?.Setting ?? "false";
+			}
+
+			if (Config.SystemBehaviorConfig.CacheEnabled && !bypassCache)
+			{
+				var cachedValue = await _cacheProvider.RetrieveAsync<string>(string.Format(ForceChatbotSecurityPinCacheKey, departmentId), getSetting, LongCacheLength);
+				return bool.Parse(cachedValue);
+			}
+
+			return bool.Parse(await getSetting());
+		}
+
 		private static string GetDefaultTtsLanguage()
 		{
 			if (EspeakVoiceCatalog.TryNormalizeIdentifier(TtsConfig.DefaultVoice, out var normalizedVoice))
diff --git a/Core/Resgrid.Services/SecurityPinService.cs b/Core/Resgrid.Services/SecurityPinService.cs
new file mode 100644
index 000000000..9085ccc0b
--- /dev/null
+++ b/Core/Resgrid.Services/SecurityPinService.cs
@@ -0,0 +1,120 @@
+using System;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Resgrid.Framework;
+using Resgrid.Model;
+using Resgrid.Model.Repositories;
+using Resgrid.Model.Services;
+
+namespace Resgrid.Services
+{
+	/// <summary>
+	/// Implements the per-user security PIN used as a step-up check for dangerous/department-wide
+	/// chatbot and SMS actions. PINs are stored AES-encrypted (via <see cref="IEncryptionService"/>)
+	/// on the user profile, mirroring how contact verification codes are stored.
+	/// </summary>
+	public class SecurityPinService : ISecurityPinService
+	{
+		private readonly IUserProfileService _userProfileService;
+		private readonly IDepartmentSettingsService _departmentSettingsService;
+		private readonly IEncryptionService _encryptionService;
+		private readonly IUserProfilesRepository _userProfileRepository;
+
+		public SecurityPinService(IUserProfileService userProfileService, IDepartmentSettingsService departmentSettingsService,
+			IEncryptionService encryptionService, IUserProfilesRepository userProfileRepository)
+		{
+			_userProfileService = userProfileService;
+			_departmentSettingsService = departmentSettingsService;
+			_encryptionService = encryptionService;
+			_userProfileRepository = userProfileRepository;
+		}
+
+		public async Task<bool> IsPinRequiredAsync(string userId, int departmentId)
+		{
+			if (await _departmentSettingsService.GetForceChatbotSecurityPinAsync(departmentId))
+				return true;
+
+			var profile = await _userProfileService.GetProfileByUserIdAsync(userId);
+			return profile != null && profile.SecurityPinEnabled;
+		}
+
+		public async Task<bool> HasPinAsync(string userId)
+		{
+			var profile = await _userProfileService.GetProfileByUserIdAsync(userId);
+			return !string.IsNullOrWhiteSpace(profile?.SecurityPin);
+		}
+
+		public async Task<bool> ValidatePinAsync(string userId, string pin)
+		{
+			if (!SecurityPinUtility.IsValidFormat(pin))
+				return false;
+
+			var storedPin = await GetPinAsync(userId);
+			return storedPin != null && string.Equals(storedPin, pin, StringComparison.Ordinal);
+		}
+
+		public async Task<string> GetPinAsync(string userId)
+		{
+			var profile = await _userProfileService.GetProfileByUserIdAsync(userId);
+			if (string.IsNullOrWhiteSpace(profile?.SecurityPin))
+				return null;
+
+			try
+			{
+				return _encryptionService.Decrypt(profile.SecurityPin);
+			}
+			catch (Exception ex)
+			{
+				// An undecryptable value (corrupted or written with a different key) is treated as no PIN.
+				Logging.LogException(ex);
+				return null;
+			}
+		}
+
+		public async Task<UserProfile> EnsurePinAsync(string userId, int departmentId, CancellationToken cancellationToken = default)
+		{
+			var profile = await _userProfileService.GetProfileByUserIdAsync(userId, bypassCache: true);
+			if (profile == null)
+				return null;
+
+			if (!string.IsNullOrWhiteSpace(profile.SecurityPin))
+				return profile;
+
+			profile.SecurityPin = _encryptionService.Encrypt(SecurityPinUtility.Generate());
+			return await _userProfileService.SaveProfileAsync(departmentId, profile, cancellationToken);
+		}
+
+		public async Task EnsurePinsForDepartmentAsync(int departmentId, CancellationToken cancellationToken = default)
+		{
+			var profiles = await _userProfileService.GetAllProfilesForDepartmentAsync(departmentId, bypassCache: true);
+			if (profiles == null)
+				return;
+
+			// Batch: generate all PINs in memory, then persist in a single bulk update rather than a
+			// full profile save per member.
+			var toUpdate = profiles.Values
+				.Where(p => string.IsNullOrWhiteSpace(p.SecurityPin))
+				.ToList();
+
+			if (toUpdate.Count == 0)
+				return;
+
+			var now = DateTime.UtcNow;
+			foreach (var profile in toUpdate)
+			{
+				profile.SecurityPin = _encryptionService.Encrypt(SecurityPinUtility.Generate());
+				profile.LastUpdated = now;
+			}
+
+			await _userProfileRepository.UpdateSecurityPinsAsync(toUpdate, cancellationToken);
+
+			// Match SaveProfileAsync's cache eviction: each member's profile cache plus the
+			// department-wide profile list.
+			foreach (var profile in toUpdate)
+				_userProfileService.ClearUserProfileFromCache(profile.UserId);
+
+			_userProfileService.ClearAllUserProfilesFromCache(departmentId);
+		}
+	}
+}
diff --git a/Core/Resgrid.Services/ServicesModule.cs b/Core/Resgrid.Services/ServicesModule.cs
index f198cab6e..44dc5fbf9 100644
--- a/Core/Resgrid.Services/ServicesModule.cs
+++ b/Core/Resgrid.Services/ServicesModule.cs
@@ -93,6 +93,7 @@ protected override void Load(ContainerBuilder builder)
 			builder.RegisterType<VoiceService>().As<IVoiceService>().InstancePerLifetimeScope();
 			builder.RegisterType<SystemAuditsService>().As<ISystemAuditsService>().InstancePerLifetimeScope();
 			builder.RegisterType<ContactVerificationService>().As<IContactVerificationService>().InstancePerLifetimeScope();
+			builder.RegisterType<SecurityPinService>().As<ISecurityPinService>().InstancePerLifetimeScope();
 			builder.RegisterType<AutofillsService>().As<IAutofillsService>().InstancePerLifetimeScope();
 			builder.RegisterType<UnitStatesService>().As<IUnitStatesService>().InstancePerLifetimeScope();
 			builder.Register(_ =>
diff --git a/Core/Resgrid.Services/UserProfileService.cs b/Core/Resgrid.Services/UserProfileService.cs
index 147768847..f9a5bdc94 100644
--- a/Core/Resgrid.Services/UserProfileService.cs
+++ b/Core/Resgrid.Services/UserProfileService.cs
@@ -18,11 +18,14 @@ public class UserProfileService : IUserProfileService
 
 		private readonly IUserProfilesRepository _userProfileRepository;
 		private readonly ICacheProvider _cacheProvider;
+		private readonly IChatbotIdentityRepository _chatbotIdentityRepository;
 
-		public UserProfileService(IUserProfilesRepository userProfileRepository, ICacheProvider cacheProvider)
+		public UserProfileService(IUserProfilesRepository userProfileRepository, ICacheProvider cacheProvider,
+			IChatbotIdentityRepository chatbotIdentityRepository)
 		{
 			_userProfileRepository = userProfileRepository;
 			_cacheProvider = cacheProvider;
+			_chatbotIdentityRepository = chatbotIdentityRepository;
 		}
 
 		public async Task<UserProfile> GetProfileByUserIdAsync(string userId, bool bypassCache = false)
@@ -75,6 +78,12 @@ public async Task<Dictionary<string, UserProfile>> GetAllProfilesForDepartmentIn
 			// Load existing profile directly from repository (bypass cache) to detect contact changes
 			var existing = await _userProfileRepository.GetProfileByUserIdAsync(profile.UserId);
 
+			// A null SecurityPin means "not supplied by this caller" — keep the stored (encrypted) PIN
+			// so profile saves from flows that don't know about PINs can't silently wipe it. Clearing a
+			// PIN intentionally is done by saving an empty string.
+			if (existing != null && profile.SecurityPin == null && existing.SecurityPin != null)
+				profile.SecurityPin = existing.SecurityPin;
+
 			if (existing == null)
 			{
 				// Brand-new profile (admin-created user) — mark all contact methods as pending
@@ -96,6 +105,11 @@ public async Task<Dictionary<string, UserProfile>> GetAllProfilesForDepartmentIn
 					profile.MobileVerificationVoiceCodeConsumed = false;
 					profile.MobileVerificationAttempts = 0;
 					profile.MobileVerificationAttemptsResetDate = null;
+
+					// The old number no longer identifies this user: remove any SMS chatbot identity
+					// links so inbound texts can't act as this account until the new number is verified
+					// and re-linked.
+					await RemoveSmsChatbotIdentitiesAsync(profile.UserId, cancellationToken);
 				}
 				if (!string.Equals(existing.HomeNumber ?? string.Empty, profile.HomeNumber ?? string.Empty, StringComparison.OrdinalIgnoreCase))
 				{
@@ -125,6 +139,19 @@ public async Task<Dictionary<string, UserProfile>> GetAllProfilesForDepartmentIn
 			return savedProfile;
 		}
 
+		private async Task RemoveSmsChatbotIdentitiesAsync(string userId, CancellationToken cancellationToken)
+		{
+			var identities = await _chatbotIdentityRepository.GetAllByUserIdAsync(userId);
+			if (identities == null)
+				return;
+
+			foreach (var identity in identities.Where(i =>
+						 i.Platform == ChatbotIdentity.PlatformSmsTwilio || i.Platform == ChatbotIdentity.PlatformSmsSignalWire))
+			{
+				await _chatbotIdentityRepository.DeleteAsync(identity, cancellationToken);
+			}
+		}
+
 		public void ClearUserProfileFromCache(string userId)
 		{
 			_cacheProvider.Remove(string.Format(CacheKey, userId));
diff --git a/Providers/Resgrid.Providers.Migrations/Migrations/M0089_AddingUserSecurityPin.cs b/Providers/Resgrid.Providers.Migrations/Migrations/M0089_AddingUserSecurityPin.cs
new file mode 100644
index 000000000..f58aec67f
--- /dev/null
+++ b/Providers/Resgrid.Providers.Migrations/Migrations/M0089_AddingUserSecurityPin.cs
@@ -0,0 +1,21 @@
+using FluentMigrator;
+
+namespace Resgrid.Providers.Migrations.Migrations
+{
+	[Migration(89)]
+	public class M0089_AddingUserSecurityPin : Migration
+	{
+		public override void Up()
+		{
+			Alter.Table("UserProfiles")
+				.AddColumn("SecurityPin").AsString(512).Nullable()
+				.AddColumn("SecurityPinEnabled").AsBoolean().NotNullable().WithDefaultValue(false);
+		}
+
+		public override void Down()
+		{
+			Delete.Column("SecurityPin").FromTable("UserProfiles");
+			Delete.Column("SecurityPinEnabled").FromTable("UserProfiles");
+		}
+	}
+}
diff --git a/Providers/Resgrid.Providers.MigrationsPg/Migrations/M0089_AddingUserSecurityPinPg.cs b/Providers/Resgrid.Providers.MigrationsPg/Migrations/M0089_AddingUserSecurityPinPg.cs
new file mode 100644
index 000000000..e97a36ba1
--- /dev/null
+++ b/Providers/Resgrid.Providers.MigrationsPg/Migrations/M0089_AddingUserSecurityPinPg.cs
@@ -0,0 +1,21 @@
+using FluentMigrator;
+
+namespace Resgrid.Providers.MigrationsPg.Migrations
+{
+	[Migration(89)]
+	public class M0089_AddingUserSecurityPinPg : Migration
+	{
+		public override void Up()
+		{
+			Alter.Table("UserProfiles".ToLower())
+				.AddColumn("SecurityPin".ToLower()).AsCustom("citext").Nullable()
+				.AddColumn("SecurityPinEnabled".ToLower()).AsBoolean().NotNullable().WithDefaultValue(false);
+		}
+
+		public override void Down()
+		{
+			Delete.Column("SecurityPin".ToLower()).FromTable("UserProfiles".ToLower());
+			Delete.Column("SecurityPinEnabled".ToLower()).FromTable("UserProfiles".ToLower());
+		}
+	}
+}
diff --git a/Repositories/Resgrid.Repositories.DataRepository/Modules/TestingDataModule.cs b/Repositories/Resgrid.Repositories.DataRepository/Modules/TestingDataModule.cs
index 18ed1e97d..e085e84c0 100644
--- a/Repositories/Resgrid.Repositories.DataRepository/Modules/TestingDataModule.cs
+++ b/Repositories/Resgrid.Repositories.DataRepository/Modules/TestingDataModule.cs
@@ -189,6 +189,7 @@ protected override void Load(ContainerBuilder builder)
 			builder.RegisterType<ContactNotesRepository>().As<IContactNotesRepository>().InstancePerLifetimeScope();
 			builder.RegisterType<ContactsRepository>().As<IContactsRepository>().InstancePerLifetimeScope();
 			builder.RegisterType<ContactCategoryRepository>().As<IContactCategoryRepository>().InstancePerLifetimeScope();
+			builder.RegisterType<ChatbotIdentityRepository>().As<IChatbotIdentityRepository>().InstancePerLifetimeScope();
 
 			// Indoor Maps Repositories
 			builder.RegisterType<IndoorMapsRepository>().As<IIndoorMapsRepository>().InstancePerLifetimeScope();
diff --git a/Repositories/Resgrid.Repositories.DataRepository/UserProfilesRepository.cs b/Repositories/Resgrid.Repositories.DataRepository/UserProfilesRepository.cs
index e0dd031be..1d727bc69 100644
--- a/Repositories/Resgrid.Repositories.DataRepository/UserProfilesRepository.cs
+++ b/Repositories/Resgrid.Repositories.DataRepository/UserProfilesRepository.cs
@@ -4,8 +4,10 @@
 using System.Linq;
 using Resgrid.Model;
 using Resgrid.Model.Repositories;
+using System.Threading;
 using System.Threading.Tasks;
 using Dapper;
+using Resgrid.Config;
 using Resgrid.Framework;
 using Resgrid.Model.Identity;
 using Resgrid.Model.Repositories.Connection;
@@ -312,6 +314,55 @@ public async Task<IEnumerable<UserProfile>> GetSelectedUserProfilesAsync(List<st
 			}
 		}
 
+		public async Task UpdateSecurityPinsAsync(IEnumerable<UserProfile> profiles, CancellationToken cancellationToken = default)
+		{
+			try
+			{
+				var items = profiles?
+					.Where(p => p != null)
+					.Select(p => new { p.SecurityPin, p.LastUpdated, p.UserProfileId })
+					.ToList();
+
+				if (items == null || items.Count == 0)
+					return;
+
+				var pn = _sqlConfiguration.ParameterNotation;
+				var sql = DataConfig.DatabaseType == DatabaseTypes.Postgres
+					? $"UPDATE {_sqlConfiguration.SchemaName}.userprofiles SET securitypin = {pn}SecurityPin, lastupdated = {pn}LastUpdated WHERE userprofileid = {pn}UserProfileId"
+					: $"UPDATE {_sqlConfiguration.SchemaName}.[UserProfiles] SET [SecurityPin] = {pn}SecurityPin, [LastUpdated] = {pn}LastUpdated WHERE [UserProfileId] = {pn}UserProfileId";
+
+				// Dapper executes the statement once per item over a single prepared command/connection.
+				if (_unitOfWork?.Connection == null)
+				{
+					using (var conn = _connectionProvider.Create())
+					{
+						await conn.OpenAsync(cancellationToken);
+
+						// No ambient unit-of-work: run the batch atomically so a mid-batch failure
+						// rolls back rather than leaving some members with PINs and others without.
+						using (var transaction = await conn.BeginTransactionAsync(cancellationToken))
+						{
+							await conn.ExecuteAsync(sql, items, transaction);
+							await transaction.CommitAsync(cancellationToken);
+						}
+					}
+				}
+				else
+				{
+					// Ambient unit-of-work: participate in the caller's transaction.
+					var connection = _unitOfWork.CreateOrGetConnection();
+					await connection.ExecuteAsync(sql, items, _unitOfWork.Transaction);
+				}
+			}
+			catch (Exception ex)
+			{
+				// Rethrow (unlike the read paths): callers gate follow-on writes — e.g. persisting the
+				// department force-PIN setting — on this batch succeeding.
+				Logging.LogException(ex);
+				throw;
+			}
+		}
+
 		private static Func<UserProfile, IdentityUser, UserProfile> UserProfileMapping(Dictionary<int, UserProfile> dictionary)
 		{
 			return new Func<UserProfile, IdentityUser, UserProfile>((userProfile, identityUser) =>
diff --git a/Tests/Resgrid.Tests/Services/SecurityPinServiceTests.cs b/Tests/Resgrid.Tests/Services/SecurityPinServiceTests.cs
new file mode 100644
index 000000000..f940d418f
--- /dev/null
+++ b/Tests/Resgrid.Tests/Services/SecurityPinServiceTests.cs
@@ -0,0 +1,287 @@
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using FluentAssertions;
+using Moq;
+using NUnit.Framework;
+using Resgrid.Framework;
+using Resgrid.Model;
+using Resgrid.Model.Repositories;
+using Resgrid.Model.Services;
+using Resgrid.Services;
+
+namespace Resgrid.Tests.Services
+{
+	namespace SecurityPinUtilityTests
+	{
+		[TestFixture]
+		public class when_validating_pin_format
+		{
+			[TestCase("2580", ExpectedResult = true)]
+			[TestCase("7392", ExpectedResult = true)]
+			[TestCase("123", ExpectedResult = false)]
+			[TestCase("12345", ExpectedResult = false)]
+			[TestCase("12a4", ExpectedResult = false)]
+			[TestCase("", ExpectedResult = false)]
+			[TestCase(null, ExpectedResult = false)]
+			[TestCase(" 123", ExpectedResult = false)]
+			public bool validates_format(string pin) => SecurityPinUtility.IsValidFormat(pin);
+		}
+
+		[TestFixture]
+		public class when_checking_pin_strength
+		{
+			[TestCase("0000")]
+			[TestCase("1111")]
+			[TestCase("9999")]
+			[TestCase("1234")]
+			[TestCase("0123")]
+			[TestCase("6789")]
+			[TestCase("4321")]
+			[TestCase("9876")]
+			[TestCase("3210")]
+			public void rejects_weak_pins(string pin)
+			{
+				SecurityPinUtility.IsWeak(pin).Should().BeTrue();
+				SecurityPinUtility.IsAcceptable(pin).Should().BeFalse();
+			}
+
+			[TestCase("2580")]
+			[TestCase("1357")]
+			[TestCase("7392")]
+			[TestCase("1233")]
+			[TestCase("1235")]
+			public void accepts_normal_pins(string pin)
+			{
+				SecurityPinUtility.IsWeak(pin).Should().BeFalse();
+				SecurityPinUtility.IsAcceptable(pin).Should().BeTrue();
+			}
+		}
+
+		[TestFixture]
+		public class when_generating_a_pin
+		{
+			[Test]
+			public void generated_pins_are_always_acceptable()
+			{
+				for (int i = 0; i < 250; i++)
+				{
+					var pin = SecurityPinUtility.Generate();
+					SecurityPinUtility.IsAcceptable(pin).Should().BeTrue($"generated pin '{pin}' should be acceptable");
+				}
+			}
+		}
+	}
+
+	namespace SecurityPinServiceTests
+	{
+		public class with_the_security_pin_service : TestBase
+		{
+			protected Mock<IUserProfileService> _userProfileServiceMock;
+			protected Mock<IDepartmentSettingsService> _departmentSettingsServiceMock;
+			protected Mock<IEncryptionService> _encryptionServiceMock;
+			protected Mock<IUserProfilesRepository> _userProfileRepositoryMock;
+			protected ISecurityPinService _securityPinService;
+
+			protected const string UserId = "user1";
+			protected const int DepartmentId = 42;
+
+			[SetUp]
+			public void SetUpSecurityPinService()
+			{
+				_userProfileServiceMock = new Mock<IUserProfileService>();
+				_departmentSettingsServiceMock = new Mock<IDepartmentSettingsService>();
+
+				// Passthrough encryption mock: Encrypt wraps with "ENC:" so tests can verify the
+				// persisted value is transformed, and Decrypt strips it back.
+				_encryptionServiceMock = new Mock<IEncryptionService>();
+				_encryptionServiceMock
+					.Setup(e => e.Encrypt(It.IsAny<string>()))
+					.Returns<string>(plain => "ENC:" + plain);
+				_encryptionServiceMock
+					.Setup(e => e.Decrypt(It.IsAny<string>()))
+					.Returns<string>(cipher => cipher.StartsWith("ENC:") ? cipher.Substring(4) : cipher);
+
+				_userProfileRepositoryMock = new Mock<IUserProfilesRepository>();
+
+				_securityPinService = new SecurityPinService(
+					_userProfileServiceMock.Object,
+					_departmentSettingsServiceMock.Object,
+					_encryptionServiceMock.Object,
+					_userProfileRepositoryMock.Object);
+			}
+
+			protected void SetupProfile(UserProfile profile)
+			{
+				_userProfileServiceMock
+					.Setup(s => s.GetProfileByUserIdAsync(UserId, It.IsAny<bool>()))
+					.ReturnsAsync(profile);
+			}
+
+			protected void SetupForcePin(bool forced)
+			{
+				_departmentSettingsServiceMock
+					.Setup(s => s.GetForceChatbotSecurityPinAsync(DepartmentId, It.IsAny<bool>()))
+					.ReturnsAsync(forced);
+			}
+		}
+
+		[TestFixture]
+		public class when_checking_if_a_pin_is_required : with_the_security_pin_service
+		{
+			[Test]
+			public async Task required_when_department_forces_pins()
+			{
+				SetupForcePin(true);
+				SetupProfile(new UserProfile { UserId = UserId, SecurityPinEnabled = false });
+
+				(await _securityPinService.IsPinRequiredAsync(UserId, DepartmentId)).Should().BeTrue();
+			}
+
+			[Test]
+			public async Task required_when_the_user_opted_in()
+			{
+				SetupForcePin(false);
+				SetupProfile(new UserProfile { UserId = UserId, SecurityPinEnabled = true });
+
+				(await _securityPinService.IsPinRequiredAsync(UserId, DepartmentId)).Should().BeTrue();
+			}
+
+			[Test]
+			public async Task not_required_when_neither_forced_nor_opted_in()
+			{
+				SetupForcePin(false);
+				SetupProfile(new UserProfile { UserId = UserId, SecurityPinEnabled = false });
+
+				(await _securityPinService.IsPinRequiredAsync(UserId, DepartmentId)).Should().BeFalse();
+			}
+
+			[Test]
+			public async Task not_required_when_no_profile_exists_and_not_forced()
+			{
+				SetupForcePin(false);
+				SetupProfile(null);
+
+				(await _securityPinService.IsPinRequiredAsync(UserId, DepartmentId)).Should().BeFalse();
+			}
+		}
+
+		[TestFixture]
+		public class when_validating_a_pin : with_the_security_pin_service
+		{
+			[Test]
+			public async Task correct_pin_validates()
+			{
+				SetupProfile(new UserProfile { UserId = UserId, SecurityPin = "ENC:2580" });
+
+				(await _securityPinService.ValidatePinAsync(UserId, "2580")).Should().BeTrue();
+			}
+
+			[Test]
+			public async Task wrong_pin_fails()
+			{
+				SetupProfile(new UserProfile { UserId = UserId, SecurityPin = "ENC:2580" });
+
+				(await _securityPinService.ValidatePinAsync(UserId, "2581")).Should().BeFalse();
+			}
+
+			[Test]
+			public async Task malformed_pin_fails_without_touching_the_store()
+			{
+				(await _securityPinService.ValidatePinAsync(UserId, "not-a-pin")).Should().BeFalse();
+				_userProfileServiceMock.Verify(s => s.GetProfileByUserIdAsync(It.IsAny<string>(), It.IsAny<bool>()), Times.Never);
+			}
+
+			[Test]
+			public async Task fails_when_no_pin_is_set()
+			{
+				SetupProfile(new UserProfile { UserId = UserId, SecurityPin = null });
+
+				(await _securityPinService.ValidatePinAsync(UserId, "2580")).Should().BeFalse();
+			}
+		}
+
+		[TestFixture]
+		public class when_ensuring_a_pin : with_the_security_pin_service
+		{
+			[Test]
+			public async Task generates_and_saves_a_pin_when_missing()
+			{
+				var profile = new UserProfile { UserId = UserId };
+				SetupProfile(profile);
+				_userProfileServiceMock
+					.Setup(s => s.SaveProfileAsync(DepartmentId, It.IsAny<UserProfile>(), It.IsAny<CancellationToken>()))
+					.ReturnsAsync((int d, UserProfile p, CancellationToken c) => p);
+
+				var saved = await _securityPinService.EnsurePinAsync(UserId, DepartmentId);
+
+				saved.SecurityPin.Should().StartWith("ENC:");
+				SecurityPinUtility.IsAcceptable(saved.SecurityPin.Substring(4)).Should().BeTrue();
+				_userProfileServiceMock.Verify(s => s.SaveProfileAsync(DepartmentId, profile, It.IsAny<CancellationToken>()), Times.Once);
+			}
+
+			[Test]
+			public async Task keeps_the_existing_pin()
+			{
+				SetupProfile(new UserProfile { UserId = UserId, SecurityPin = "ENC:2580" });
+
+				var saved = await _securityPinService.EnsurePinAsync(UserId, DepartmentId);
+
+				saved.SecurityPin.Should().Be("ENC:2580");
+				_userProfileServiceMock.Verify(s => s.SaveProfileAsync(It.IsAny<int>(), It.IsAny<UserProfile>(), It.IsAny<CancellationToken>()), Times.Never);
+			}
+		}
+
+		[TestFixture]
+		public class when_ensuring_pins_for_a_department : with_the_security_pin_service
+		{
+			[Test]
+			public async Task only_members_without_a_pin_get_one_via_a_single_bulk_update()
+			{
+				var withPin = new UserProfile { UserId = "hasPin", SecurityPin = "ENC:2580" };
+				var withoutPin = new UserProfile { UserId = "noPin" };
+
+				_userProfileServiceMock
+					.Setup(s => s.GetAllProfilesForDepartmentAsync(DepartmentId, It.IsAny<bool>()))
+					.ReturnsAsync(new Dictionary<string, UserProfile> { { withPin.UserId, withPin }, { withoutPin.UserId, withoutPin } });
+
+				List<UserProfile> updated = null;
+				_userProfileRepositoryMock
+					.Setup(r => r.UpdateSecurityPinsAsync(It.IsAny<IEnumerable<UserProfile>>(), It.IsAny<CancellationToken>()))
+					.Callback<IEnumerable<UserProfile>, CancellationToken>((p, c) => updated = p.ToList())
+					.Returns(Task.CompletedTask);
+
+				await _securityPinService.EnsurePinsForDepartmentAsync(DepartmentId);
+
+				withPin.SecurityPin.Should().Be("ENC:2580");
+				withoutPin.SecurityPin.Should().StartWith("ENC:");
+				withoutPin.LastUpdated.Should().NotBeNull();
+
+				updated.Should().ContainSingle().Which.Should().BeSameAs(withoutPin);
+				_userProfileRepositoryMock.Verify(r => r.UpdateSecurityPinsAsync(It.IsAny<IEnumerable<UserProfile>>(), It.IsAny<CancellationToken>()), Times.Once);
+				_userProfileServiceMock.Verify(s => s.SaveProfileAsync(It.IsAny<int>(), It.IsAny<UserProfile>(), It.IsAny<CancellationToken>()), Times.Never);
+
+				// Cache eviction must match SaveProfileAsync: the updated member plus the department list.
+				_userProfileServiceMock.Verify(s => s.ClearUserProfileFromCache(withoutPin.UserId), Times.Once);
+				_userProfileServiceMock.Verify(s => s.ClearUserProfileFromCache(withPin.UserId), Times.Never);
+				_userProfileServiceMock.Verify(s => s.ClearAllUserProfilesFromCache(DepartmentId), Times.Once);
+			}
+
+			[Test]
+			public async Task no_bulk_update_when_everyone_has_a_pin()
+			{
+				var withPin = new UserProfile { UserId = "hasPin", SecurityPin = "ENC:2580" };
+
+				_userProfileServiceMock
+					.Setup(s => s.GetAllProfilesForDepartmentAsync(DepartmentId, It.IsAny<bool>()))
+					.ReturnsAsync(new Dictionary<string, UserProfile> { { withPin.UserId, withPin } });
+
+				await _securityPinService.EnsurePinsForDepartmentAsync(DepartmentId);
+
+				_userProfileRepositoryMock.Verify(r => r.UpdateSecurityPinsAsync(It.IsAny<IEnumerable<UserProfile>>(), It.IsAny<CancellationToken>()), Times.Never);
+				_userProfileServiceMock.Verify(s => s.ClearAllUserProfilesFromCache(It.IsAny<int>()), Times.Never);
+			}
+		}
+	}
+}
diff --git a/Web/Resgrid.Web.Services/Controllers/SignalWireController.cs b/Web/Resgrid.Web.Services/Controllers/SignalWireController.cs
index e0f593e7e..f6b651e51 100644
--- a/Web/Resgrid.Web.Services/Controllers/SignalWireController.cs
+++ b/Web/Resgrid.Web.Services/Controllers/SignalWireController.cs
@@ -175,6 +175,14 @@ public async Task<ActionResult> Receive(CancellationToken cancellationToken)
 				{
 					profile = await _userProfileService.GetProfileByMobileNumberAsync(textMessage.Msisdn);
 
+					// SECURITY: an unverified mobile number must never identify/act as the matched user.
+					// Verification (MobileNumberVerified == true) is the bar for trusting an inbound sender.
+					if (profile != null && profile.MobileNumberVerified != true)
+					{
+						Framework.Logging.LogInfo($"[SignalWire SMS] MessageSid={textMessage.MessageId} From={Framework.StringHelpers.MaskPhoneNumber(textMessage.Msisdn)} matched a profile but the mobile number is not verified; not linking sender to user.");
+						profile = null;
+					}
+
 					if (profile != null)
 					{
 						var department = await _departmentsService.GetDepartmentByUserIdAsync(profile.UserId);
diff --git a/Web/Resgrid.Web.Services/Controllers/TwilioController.cs b/Web/Resgrid.Web.Services/Controllers/TwilioController.cs
index 2eb185ce0..8ff89bca4 100644
--- a/Web/Resgrid.Web.Services/Controllers/TwilioController.cs
+++ b/Web/Resgrid.Web.Services/Controllers/TwilioController.cs
@@ -142,6 +142,17 @@ public async Task<ActionResult> IncomingMessage([FromQuery] TwilioMessage reques
 				// department the sender operates in. Legacy clients that still text a per-department provisioned
 				// inbound number fall back to resolving the department from that number.
 				UserProfile userProfile = await _userProfileService.GetProfileByMobileNumberAsync(textMessage.Msisdn);
+
+				// SECURITY: an unverified mobile number must never identify/act as the matched user —
+				// anyone can type someone else's number into a profile. Verification (MobileNumberVerified
+				// == true) is the bar for trusting an inbound sender.
+				bool senderNumberUnverified = userProfile != null && userProfile.MobileNumberVerified != true;
+				if (senderNumberUnverified)
+				{
+					Framework.Logging.LogInfo($"[Twilio SMS] MessageSid={request.MessageSid} From={Framework.StringHelpers.MaskPhoneNumber(textMessage.Msisdn)} matched a profile but the mobile number is not verified; not linking sender to user.");
+					userProfile = null;
+				}
+
 				int? departmentId = null;
 				if (userProfile != null)
 				{
@@ -160,7 +171,7 @@ public async Task<ActionResult> IncomingMessage([FromQuery] TwilioMessage reques
 					messageEvent.CustomerId = departmentId.Value.ToString();
 
 				// Diagnostic: did we resolve a department for this inbound text? If not, no reply is sent.
-				Framework.Logging.LogInfo($"[Twilio SMS] MessageSid={request.MessageSid} To={textMessage.To} From={textMessage.Msisdn} resolved DepartmentId={(departmentId.HasValue ? departmentId.Value.ToString() : "none")}");
+				Framework.Logging.LogInfo($"[Twilio SMS] MessageSid={request.MessageSid} To={textMessage.To} From={Framework.StringHelpers.MaskPhoneNumber(textMessage.Msisdn)} resolved DepartmentId={(departmentId.HasValue ? departmentId.Value.ToString() : "none")}");
 
 				// Feature-flagged rollout: the chatbot ingress is the new path. When the flag is off
 				// (globally or for this department) fall back to the original text-command handling so
@@ -194,7 +205,7 @@ public async Task<ActionResult> IncomingMessage([FromQuery] TwilioMessage reques
 				}
 				else
 				{
-					await ProcessTextCommandsAsync(textMessage, messageEvent, response, departmentId, userProfile);
+					await ProcessTextCommandsAsync(textMessage, messageEvent, response, departmentId, userProfile, senderNumberUnverified);
 				}
 			}
 			catch (Exception ex)
@@ -225,11 +236,11 @@ public async Task<ActionResult> IncomingMessage([FromQuery] TwilioMessage reques
 		// enabled the Chatbot Twilio integration feature flag keep their existing behavior. departmentId
 		// and userProfile are resolved by the caller so the flag can be evaluated before dispatching here.
 		private async System.Threading.Tasks.Task ProcessTextCommandsAsync(TextMessage textMessage, InboundMessageEvent messageEvent,
-			MessagingResponse response, int? departmentId, UserProfile userProfile)
+			MessagingResponse response, int? departmentId, UserProfile userProfile, bool senderNumberUnverified = false)
 		{
 			// Diagnostic: without a department the legacy path adds no message, so the sender gets no reply.
 			if (!departmentId.HasValue)
-				Framework.Logging.LogInfo($"[Twilio SMS] Text-command path: no department resolved for sender {textMessage.Msisdn} → number {textMessage.To}; no reply will be sent.");
+				Framework.Logging.LogInfo($"[Twilio SMS] Text-command path: no department resolved for sender {Framework.StringHelpers.MaskPhoneNumber(textMessage.Msisdn)} → number {textMessage.To}; no reply will be sent.");
 
 			if (departmentId.HasValue)
 			{
@@ -300,13 +311,25 @@ private async System.Threading.Tasks.Task ProcessTextCommandsAsync(TextMessage t
 						// only hit the DB again if the department came from the phone-number lookup path.
 						var profile = userProfile ?? await _userProfileService.GetProfileByMobileNumberAsync(textMessage.Msisdn);
 
+						// SECURITY: same verified-number bar as the caller — an unverified number must not
+						// act as the matched user.
+						if (profile != null && profile.MobileNumberVerified != true)
+						{
+							senderNumberUnverified = true;
+							profile = null;
+						}
+
 						// No matching user profile for the sender's number: reply so the user knows, rather than
 						// returning an empty response (pre-refactor behavior).
 						if (profile == null)
 						{
-							Framework.Logging.LogInfo($"[Twilio SMS] DepartmentId={departmentId.Value} sender {textMessage.Msisdn} has no matching user profile; replying with not-found message.");
+							Framework.Logging.LogInfo($"[Twilio SMS] DepartmentId={departmentId.Value} sender {Framework.StringHelpers.MaskPhoneNumber(textMessage.Msisdn)} has no usable user profile (unverified={senderNumberUnverified}); replying with not-found message.");
 							messageEvent.Processed = true;
-							response.Message("Resgrid: We couldn't find a Resgrid user linked to this mobile number. Please add this number to your Resgrid profile to use text commands.");
+
+							if (senderNumberUnverified)
+								response.Message("Resgrid: This mobile number matches a Resgrid profile but hasn't been verified. Please verify your mobile number on your Resgrid profile page to use text commands.");
+							else
+								response.Message("Resgrid: We couldn't find a Resgrid user linked to this mobile number. Please add this number to your Resgrid profile to use text commands.");
 						}
 
 						if (profile != null)
diff --git a/Web/Resgrid.Web/Areas/User/Controllers/DepartmentController.cs b/Web/Resgrid.Web/Areas/User/Controllers/DepartmentController.cs
index fae2037d4..e5710b369 100644
--- a/Web/Resgrid.Web/Areas/User/Controllers/DepartmentController.cs
+++ b/Web/Resgrid.Web/Areas/User/Controllers/DepartmentController.cs
@@ -63,6 +63,7 @@ public class DepartmentController : SecureBaseController
 		private readonly INotesService _notesService;
 		private readonly IContactsService _contactsService;
 		private readonly ICheckInTimerService _checkInTimerService;
+		private readonly ISecurityPinService _securityPinService;
 
 		public DepartmentController(IDepartmentsService departmentsService, IUsersService usersService, IActionLogsService actionLogsService,
 			IEmailService emailService, IDepartmentGroupsService departmentGroupsService, IUserProfileService userProfileService, IDeleteService deleteService,
@@ -70,7 +71,8 @@ public DepartmentController(IDepartmentsService departmentsService, IUsersServic
 			ILimitsService limitsService, ICallsService callsService, IDepartmentSettingsService departmentSettingsService, IUnitsService unitsService,
 			ICertificationService certificationService, INumbersService numbersService, IScheduledTasksService scheduledTasksService, IPersonnelRolesService personnelRolesService,
 			IEventAggregator eventAggregator, ICustomStateService customStateService, ICqrsProvider cqrsProvider, IPrinterProvider printerProvider, IQueueService queueService,
-			IDocumentsService documentsService, INotesService notesService, IContactsService contactsService, ICheckInTimerService checkInTimerService)
+			IDocumentsService documentsService, INotesService notesService, IContactsService contactsService, ICheckInTimerService checkInTimerService,
+			ISecurityPinService securityPinService)
 		{
 			_departmentsService = departmentsService;
 			_usersService = usersService;
@@ -100,6 +102,7 @@ public DepartmentController(IDepartmentsService departmentsService, IUsersServic
 			_notesService = notesService;
 			_contactsService = contactsService;
 			_checkInTimerService = checkInTimerService;
+			_securityPinService = securityPinService;
 		}
 
 		#endregion Private Members and Constructors
@@ -244,6 +247,7 @@ public async Task<IActionResult> Settings()
 			var activeCallRssKey = await _departmentSettingsService.GetRssKeyForDepartmentAsync(DepartmentId);
 			model.DisableAutoAvailable = await _departmentSettingsService.GetDisableAutoAvailableForDepartmentAsync(DepartmentId);
 			model.EnableModernNotifications = await _departmentSettingsService.GetModernNotificationsEnabledAsync(DepartmentId);
+			model.ForceChatbotSecurityPin = await _departmentSettingsService.GetForceChatbotSecurityPinAsync(DepartmentId);
 			model.TtsLanguage = await _departmentSettingsService.GetTtsLanguageForDepartmentAsync(DepartmentId);
 			model.TtsLanguages = BuildTtsLanguageSelectList(model.TtsLanguage);
 
@@ -541,6 +545,18 @@ await _departmentSettingsService.SaveOrUpdateSettingAsync(DepartmentId, model.Di
 					cancellationToken);
 				await _departmentSettingsService.SaveOrUpdateSettingAsync(DepartmentId, model.EnableModernNotifications.ToString(), DepartmentSettingTypes.EnableModernNotifications,
 					cancellationToken);
+
+				var forcePinWasEnabled = await _departmentSettingsService.GetForceChatbotSecurityPinAsync(DepartmentId, bypassCache: true);
+
+				// Turning the forced-PIN requirement on: give every member without a PIN a random one so
+				// they can complete PIN-protected chatbot/text actions immediately. Provision BEFORE
+				// persisting the enabled setting — if generation fails the setting stays off, so a
+				// later save re-detects the transition and retries PIN generation.
+				if (model.ForceChatbotSecurityPin && !forcePinWasEnabled)
+					await _securityPinService.EnsurePinsForDepartmentAsync(DepartmentId, cancellationToken);
+
+				await _departmentSettingsService.SaveOrUpdateSettingAsync(DepartmentId, model.ForceChatbotSecurityPin.ToString(), DepartmentSettingTypes.ForceChatbotSecurityPin,
+					cancellationToken);
 				await _departmentSettingsService.SaveOrUpdateSettingAsync(DepartmentId, model.TtsLanguage, DepartmentSettingTypes.TtsLanguage,
 					cancellationToken);
 
diff --git a/Web/Resgrid.Web/Areas/User/Controllers/HomeController.cs b/Web/Resgrid.Web/Areas/User/Controllers/HomeController.cs
index 2c6812ce0..157debd35 100644
--- a/Web/Resgrid.Web/Areas/User/Controllers/HomeController.cs
+++ b/Web/Resgrid.Web/Areas/User/Controllers/HomeController.cs
@@ -71,6 +71,8 @@ public class HomeController : SecureBaseController
 		private readonly IGdprDataExportService _gdprDataExportService;
 		private readonly ISystemAuditsService _systemAuditsService;
 		private readonly IPhoneNumberProcesserProvider _phoneNumberProcesser;
+		private readonly ISecurityPinService _securityPinService;
+		private readonly IEncryptionService _encryptionService;
 
 		public HomeController(IDepartmentsService departmentsService, IUsersService usersService, IActionLogsService actionLogsService,
 			IUserStateService userStateService, IDepartmentGroupsService departmentGroupsService, Resgrid.Model.Services.IAuthorizationService authorizationService,
@@ -80,7 +82,8 @@ public HomeController(IDepartmentsService departmentsService, IUsersService user
 			IStringLocalizerFactory factory, ISubscriptionsService subscriptionsService, IContactVerificationService contactVerificationService,
 			IUserDefinedFieldsService userDefinedFieldsService, IUdfRenderingService udfRenderingService, IDepartmentSsoService departmentSsoService,
 			IStringLocalizer<Resgrid.Localization.Areas.User.Security.Security> secLocalizer, IGdprDataExportService gdprDataExportService,
-			ISystemAuditsService systemAuditsService, IPhoneNumberProcesserProvider phoneNumberProcesser)
+			ISystemAuditsService systemAuditsService, IPhoneNumberProcesserProvider phoneNumberProcesser,
+			ISecurityPinService securityPinService, IEncryptionService encryptionService)
 		{
 			_departmentsService = departmentsService;
 			_usersService = usersService;
@@ -110,6 +113,8 @@ public HomeController(IDepartmentsService departmentsService, IUsersService user
 			_gdprDataExportService = gdprDataExportService;
 			_systemAuditsService = systemAuditsService;
 			_phoneNumberProcesser = phoneNumberProcesser;
+			_securityPinService = securityPinService;
+			_encryptionService = encryptionService;
 
 			_localizer = factory.Create("Home.Dashboard", new AssemblyName(typeof(SupportedLocales).GetTypeInfo().Assembly.FullName).Name);
 		}
@@ -411,6 +416,14 @@ public async Task<IActionResult> EditUserProfile(string userId)
 			if (model.Profile == null)
 				model.Profile = new UserProfile();
 
+			// Security PIN is only shown to the profile's owner (never to admins editing another user).
+			model.DepartmentForcesSecurityPin = await _departmentSettingsService.GetForceChatbotSecurityPinAsync(DepartmentId);
+			if (model.IsOwnProfile)
+			{
+				model.SecurityPinEnabled = model.Profile.SecurityPinEnabled;
+				model.SecurityPin = await _securityPinService.GetPinAsync(userId);
+			}
+
 			if (model.Profile.Image == null)
 				model.HasCustomIamge = false;
 			else
@@ -680,6 +693,17 @@ public async Task<IActionResult> EditUserProfile(EditProfileModel model, IFormCo
 					if (newUser != null)
 						ModelState.AddModelError("", "The NEW username you have supplied is already in use, please try another one. If you didn't mean to update your username please leave that field blank.");
 				}
+
+				if (!String.IsNullOrWhiteSpace(model.SecurityPin))
+				{
+					// Normalize once so validation sees the same value that gets encrypted on save.
+					model.SecurityPin = model.SecurityPin.Trim();
+
+					if (!SecurityPinUtility.IsValidFormat(model.SecurityPin))
+						ModelState.AddModelError("SecurityPin", "The security PIN must be exactly 4 digits.");
+					else if (SecurityPinUtility.IsWeak(model.SecurityPin))
+						ModelState.AddModelError("SecurityPin", "That security PIN is too easy to guess. Avoid repeated digits (like 0000) and sequences (like 1234 or 4321).");
+				}
 			}
 
 			if (ModelState.IsValid)
@@ -727,6 +751,18 @@ public async Task<IActionResult> EditUserProfile(EditProfileModel model, IFormCo
 				savedProfile.TimeZone = model.Profile.TimeZone;
 				savedProfile.Language = model.Profile.Language;
 
+				// Security PIN: only the profile owner can manage it. A blank input keeps the current
+				// PIN; enabling the option with no PIN on file generates a random one.
+				if (model.IsOwnProfile)
+				{
+					savedProfile.SecurityPinEnabled = model.SecurityPinEnabled;
+
+					if (!String.IsNullOrWhiteSpace(model.SecurityPin))
+						savedProfile.SecurityPin = _encryptionService.Encrypt(model.SecurityPin.Trim());
+					else if (model.SecurityPinEnabled && String.IsNullOrWhiteSpace(savedProfile.SecurityPin))
+						savedProfile.SecurityPin = _encryptionService.Encrypt(SecurityPinUtility.Generate());
+				}
+
 				if (model.CanEnableVoice)
 				{
 					savedProfile.VoiceForCall = model.Profile.VoiceForCall;
diff --git a/Web/Resgrid.Web/Areas/User/Models/DepartmentSettingsModel.cs b/Web/Resgrid.Web/Areas/User/Models/DepartmentSettingsModel.cs
index 0d87a7195..b58f8f9b5 100644
--- a/Web/Resgrid.Web/Areas/User/Models/DepartmentSettingsModel.cs
+++ b/Web/Resgrid.Web/Areas/User/Models/DepartmentSettingsModel.cs
@@ -68,6 +68,9 @@ public class DepartmentSettingsModel : BaseUserModel
 
 		public bool EnableModernNotifications { get; set; }
 
+		[Display(Name = "Require security PIN for dangerous chatbot/text actions")]
+		public bool ForceChatbotSecurityPin { get; set; }
+
 		public DepartmentSettingsModel()
 		{
 			Users = new Dictionary<string, string>();
diff --git a/Web/Resgrid.Web/Areas/User/Models/EditProfileModel.cs b/Web/Resgrid.Web/Areas/User/Models/EditProfileModel.cs
index 643ee976b..34c98245d 100644
--- a/Web/Resgrid.Web/Areas/User/Models/EditProfileModel.cs
+++ b/Web/Resgrid.Web/Areas/User/Models/EditProfileModel.cs
@@ -111,6 +111,18 @@ public class EditProfileModel: BaseUserModel
 
 		public bool EnableSms { get; set; }
 
+		// ── Security PIN (step-up auth for dangerous chatbot/SMS actions; own profile only) ──
+
+		/// <summary>The user's decrypted 4-digit security PIN (only populated for the own-profile view).</summary>
+		[Display(Name = "Security PIN")]
+		public string SecurityPin { get; set; }
+
+		[Display(Name = "Require my security PIN for dangerous chatbot/text actions")]
+		public bool SecurityPinEnabled { get; set; }
+
+		/// <summary>True when the department forces PIN usage for all members (personal opt-in is then moot).</summary>
+		public bool DepartmentForcesSecurityPin { get; set; }
+
 		// ── Contact verification status (tri-state: null = grandfathered, false = pending, true = verified) ──
 		public bool? EmailVerified => Profile?.EmailVerified;
 		public bool? MobileNumberVerified => Profile?.MobileNumberVerified;
diff --git a/Web/Resgrid.Web/Areas/User/Views/Department/Settings.cshtml b/Web/Resgrid.Web/Areas/User/Views/Department/Settings.cshtml
index 2f9de053b..4ce613aa8 100644
--- a/Web/Resgrid.Web/Areas/User/Views/Department/Settings.cshtml
+++ b/Web/Resgrid.Web/Areas/User/Views/Department/Settings.cshtml
@@ -91,6 +91,17 @@
                                 <span class="help-block m-b-none">@localizer["EnableModernNotificationsHelp"]</span>
                             </div>
                         </div>
+                        <div class="form-group">
+                            <label class="col-sm-2 control-label">@localizer["ForceChatbotSecurityPin"]</label>
+                            <div class="col-sm-10">
+                                <div class="row">
+                                    <div class="col-sm-10">
+                                        <input type="checkbox" asp-for="ForceChatbotSecurityPin">
+                                    </div>
+                                </div>
+                                <span class="help-block m-b-none">@localizer["ForceChatbotSecurityPinHelp"]</span>
+                            </div>
+                        </div>
                         <div class="form-group">
                             <label class="col-sm-2 control-label">@localizer["TtsLanguage"]</label>
                             <div class="col-sm-10">
diff --git a/Web/Resgrid.Web/Areas/User/Views/Home/EditUserProfile.cshtml b/Web/Resgrid.Web/Areas/User/Views/Home/EditUserProfile.cshtml
index 2957b9b15..9ba539e7a 100644
--- a/Web/Resgrid.Web/Areas/User/Views/Home/EditUserProfile.cshtml
+++ b/Web/Resgrid.Web/Areas/User/Views/Home/EditUserProfile.cshtml
@@ -296,6 +296,35 @@
                         </div>
                         <div class="hr-line-dashed"></div>
 
+                        @if (Model.IsOwnProfile)
+                        {
+                            <div class="form-group">
+                                <label class="col-sm-2 control-label">@localizer["SecurityPinLabel"]</label>
+                                <div class="col-sm-10">
+                                    <input type="text" class="form-control" style="max-width:160px;" maxlength="4" inputmode="numeric" pattern="[0-9]*" autocomplete="off" placeholder="@localizer["SecurityPinPlaceholder"]" asp-for="SecurityPin">
+                                    <span asp-validation-for="SecurityPin" class="text-danger"></span>
+                                    <span class="help-block m-b-none">@localizer["SecurityPinHelp"]</span>
+                                </div>
+                            </div>
+                            <div class="form-group">
+                                <label class="col-sm-2 control-label">@localizer["SecurityPinEnabledLabel"]</label>
+                                <div class="col-sm-10">
+                                    @if (Model.DepartmentForcesSecurityPin)
+                                    {
+                                        <input type="checkbox" checked="checked" disabled="disabled">
+                                        <input type="hidden" asp-for="SecurityPinEnabled" value="true">
+                                        <span class="help-block m-b-none">@localizer["SecurityPinForcedHelp"]</span>
+                                    }
+                                    else
+                                    {
+                                        <input type="checkbox" asp-for="SecurityPinEnabled">
+                                        <span class="help-block m-b-none">@localizer["SecurityPinEnabledHelp"]</span>
+                                    }
+                                </div>
+                            </div>
+                            <div class="hr-line-dashed"></div>
+                        }
+
                         @if (ClaimsAuthorizationHelper.IsUserDepartmentAdmin())
                         {
                             <div class="form-group">