diff --git a/presence/implementation/connection_authenticator.cc b/presence/implementation/connection_authenticator.cc
index 2d39d105..5b4b0a4b 100644
--- a/presence/implementation/connection_authenticator.cc
+++ b/presence/implementation/connection_authenticator.cc
@@ -91,6 +91,12 @@ absl::Status ConnectionAuthenticator::VerifyMessage(
   if (auth_frame.version() != kPresenceAuthenticatorVersion) {
     return absl::InvalidArgumentError("Presence frame has wrong version.");
   }
+  if (!auth_frame.has_credential_id_hash() ||
+      (auth_frame.credential_id_hash().size() !=
+       kPresenceAuthenticatorHkdfKeySize)) {
+    return absl::InvalidArgumentError(
+        "Presence frame missing/has bad cid hash");
+  }
   // We want to check each shared credential to verify using its public key.
   for (const auto& shared_credential : shared_credentials) {
     // Verify Credential ID hash.
diff --git a/presence/implementation/connection_authenticator_test.cc b/presence/implementation/connection_authenticator_test.cc
index 57b17cb3..f0f6103f 100644
--- a/presence/implementation/connection_authenticator_test.cc
+++ b/presence/implementation/connection_authenticator_test.cc
@@ -263,7 +263,7 @@ TEST(PresenceAuthenticatorTest, TestMissingCredentialIdHashFails) {
   EXPECT_THAT(authenticator.VerifyMessage(
                   kUkey2Secret, frame.SerializeAsString(),
                   {BuildSharedCredential(key_pair, kKeySeed1)}, false),
-              StatusIs(absl::StatusCode::kInternal));
+              StatusIs(absl::StatusCode::kInvalidArgument));
 }
 
 TEST(PresenceAuthenticatorTest, TestMissingPrivateKeySignatureFails) {