Every help desk has a moment when someone on the phone asks for a password reset and an agent has to decide whether the caller is who they say. If that decision rests on the agent’s judgment alone, an attacker with a good story and a calm voice is arguing with one tired person. This procedure writes the decision down, from the first callback to the reset.
What should a help desk do before resetting a password or MFA?
Before resetting a password, MFA or any other credential, the help desk should confirm the caller against a source the caller does not control, such as a government-issued ID checked with the authority that issued it. How strict the check is depends on who is asking. Record the outcome in the ticket either way.
Why callbacks and security questions are not enough
Security questions ask for facts that are effectively public, such as a date of birth or the last four digits of a Social Security number. A callback to the number on file does better, because it beats a spoofed caller ID, but it proves only that someone can answer that number. CISA’s advisory on Scattered Spider describes actors who “Convinced cellular carriers to transfer control of a targeted user’s phone number to a SIM card in their possession, gaining control over the phone and access to MFA prompts” (CISA Advisory AA23-320A). After that, the callback rings on the attacker’s phone. A post on CISA’s Cybersecurity Awareness Month advice walks through that case in more detail.
The same advisory describes callers who “Posed as employees to convince IT and/or helpdesk staff to provide sensitive information, reset the employee’s password, and transfer the employee’s MFA to a device they control” (CISA Advisory AA23-320A). Mandiant found voice phishing was the initial infection vector in 11% of intrusions in 2025, second only to exploits (Mandiant, M-Trends 2026).
Which requests need verification?
Verify any request that changes how someone signs in: a password reset, an MFA reset or any other credential reset, plus IT onboarding for a new employee. The rule covers everyone who can make that request, including general staff, administrators, executives and contractors, on every call that meets the threshold. A procedure with an exception for senior people tells an attacker which caller to pretend to be.
How strict should the check be for each type of caller?
The risk depends on who is asking and how the request arrives. A ticket from a signed-in employee on the IT portal is a different thing from a phone call by someone who says they lost their laptop. The procedure sorts callers into four tiers:
| Who is asking | How the request arrives | What your help desk requires |
|---|---|---|
| General staff with systems access | A trusted channel: an intranet IT ticket, corporate email, or an authenticated Teams or Slack session | Your standard process for that channel |
| General staff with systems access | A phone call, or any other unauthenticated channel | The full procedure below, or a request to resubmit through a trusted channel |
| General staff without access to their devices (lost, stolen or damaged) | Any channel | The full procedure, with extra caution: attackers tell this story too |
| Elevated or administrator accounts | Any channel, including a trusted one | The full procedure for any change to admin credentials |
| Executive team: C-level, senior HR and finance leaders, and the administrative staff who report to them | Any channel | Confirm the request through the executive’s assistant on an authenticated corporate channel, or on the executive’s desk phone. Then the full procedure |
Where an executive normally routes support requests through an assistant, a reset request that comes straight from the executive can be a warning sign. Executives are also high-value targets, and a request in a senior name can put a junior agent under pressure to move fast. So the executive row adds a step.
To see how your own help desk measures up, score it with the account takeover checklist for IT help desks.
The ten-step caller verification procedure
The first two steps come before any identity check, and the last two cover a result that does not come back clean.
- Call back on the listed number. If the request came by text or voicemail, contact the person on the cell or desk number in your company directory, not a number they gave you. If they called from an unfamiliar number, ask them to hang up, and call them back on the listed one.
- Record an unavailable number. If they say their listed numbers do not work, note it, record the number they are using, and treat the rest of the call with caution.
- Send a verification link through a trusted channel. Send it by SMS to the listed number, to their corporate email, or through an authenticated Teams or Slack chat.
- Have the caller scan a government-issued ID. They open the link on their phone and scan the ID in the mobile browser. There is no app to install.
- Check the device and channel signals. Look for a number that recently moved to a new SIM or was ported out, a relayed man-in-the-middle session, or a replayed scan. Any one of them is a reason to stop.
- Check the ID with the authority that issued it. In the US, that is the state DMV, over the AAMVA network. Where it is available, also check the phone number with the mobile carrier.
- Match the result to the account. Confirm that the person the check verified is the employee whose account is changing, against your HR or directory record and not against details the caller gave you.
- Proceed only on a clean result. If every check passes and the person matches the record, complete the reset and record the result in the ticket.
- Stop on a risk flag or a significant mismatch. End the call, lock the account, and notify the employee’s manager (verify the manager’s identity before you discuss it). Alert your security operations or incident response team if needed.
- Escalate a borderline result. For a low-risk flag or a minor data mismatch, consult a supervisor about further verification, which may mean confirming the person in person.
What to do when the check fails
Treat a failed check as a security event. End the call without arguing, since a determined caller will keep talking for as long as the agent listens. Lock the account so the same person cannot try again through a different agent or channel. Tell the employee’s manager, and verify the manager first: a manager’s name and number are as easy to find as an employee’s. Then hand it to your security operations or incident response team, with the ticket showing what was checked and what failed.
A borderline result is a different case. A minor mismatch, such as an old address on a license, may be innocent. It is a reason for a supervisor to choose the next check, which can be an in-person visit. The agent on the call should not have to make that decision alone.
How ATO Protect handles the identity check
ATO Protect for IT Help Desk handles steps 3 to 6. From the web portal, or through the API, the agent sends the caller a secure link by SMS, email or chat. The caller scans a government-issued ID in their mobile browser, and ATO Protect checks it against the authority that issued it (in the US, the state DMV over the AAMVA network). Alongside that check it detects SIM swaps and port-outs, and its man-in-the-middle and anti-replay detection is patented (US Pat. 10,601,859). The agent sees a red, yellow or green result. It works on a first-time caller with no prior enrollment. It runs no selfie or liveness check, because generative AI can now defeat those methods, and all user PII from the verification session is deleted.
The same check can run without an agent. At the University of Connecticut, students and staff can verify their identity with a government ID and reset their passwords in under a minute, without waiting for support (UConn case study). See how ATO Protect works at the IT help desk.
Frequently asked questions
How can support agents verify callers before resetting an employee account? Call the person back on the number in your company directory, then send a verification link through a trusted channel and have them scan a government-issued ID. Check the ID with the authority that issued it and the phone number for a recent SIM swap or port-out, then confirm the person verified is the employee whose account is changing. Reset only on a clean result.
How do you verify identity during a password reset to prevent unauthorized resets? Check the person against a source they do not control. Knowledge questions fail because the answers are easy to find, and a callback fails once an attacker has moved the number to their own SIM. A government-issued ID checked with its issuer, together with a check that the session is not being relayed, holds up against both.
How do you reduce social engineering fraud in account recovery flows? Take the decision out of the agent’s judgment of the caller. Write a procedure that sets the check by who is asking and applies it to every caller, executives included. Verify the person with evidence from outside the conversation, and make a failed check lead to a locked account and an incident every time.
Should executives go through the same verification? Yes, with one step added. Confirm the request first, with the executive’s assistant on an authenticated corporate channel or on the executive’s desk phone, then run the full procedure.
What should the help desk do if a caller says their listed phone number is unavailable? Record that the listed numbers are unavailable, note the number the caller is using, and continue with extra caution. Lost and broken phones happen, and they are also a story attackers tell, so this is the case where the identity check matters most.
How can a help desk verify a caller when deepfakes and voice cloning make voice unreliable? Stop treating the voice as evidence. McAfee researchers produced a clone with an 85% voice match from three seconds of audio in one test (McAfee Labs, 2023). Move the check off the call: send a link the caller opens on their phone, and verify a government-issued ID with the authority that issued it. A convincing voice changes nothing about that record.
A phone number tells you which phone is ringing. The procedure exists to find out who is holding it. To talk through running this procedure on your help desk, contact the Trusona team.
See how ATO Protect verifies a caller against the authority that issued their ID.