How to verify users without pre-registration

Verifying a user without pre-registration means confirming who someone is without relying on anything they set up in advance. No enrolled app, no registered device, no number on file, no security questions answered last year. The check runs against an authority that already knows the person, such as the state that issued their driver’s license, instead of against a factor your own organization handed out.

That sounds like a definitional point. In practice it decides whether your help desk can verify the person on the phone right now, or only the ones who were already easy to verify.

Almost every verification method assumes an earlier step

An authenticator app works because the user enrolled it. A push goes to a registered device, a one-time passcode to a number already on file, a passkey to a credential created and bound to the account months ago. Security questions rely on answers somebody typed into a form at some point. Even document-and-selfie verification usually compares a new selfie against a face template captured during onboarding.

Every one of those checks something the organization already holds. That is a reasonable design, and for the bulk of your workforce on a normal Tuesday it is fine.

The trouble is that the request most in need of verification is usually the one where that earlier step is missing or unusable. Someone calls the help desk precisely because the enrolled thing is gone. The phone was stolen, the number changed, the laptop is in a drawer at a previous address, or the account was created last night and the new hire starts in the morning.

How large the never-enrolled population actually is

Most teams budget for non-enrollment as a rounding error. It behaves more like a standing population, and it is easier to think about by cause than by job title.

Some people were never issued a factor at all. A new hire on their first morning has an account and nothing else, because onboarding runs later that week. Short-term staff frequently skip enrollment because the engagement is shorter than the provisioning cycle. Universities, health systems and pension administrators keep serving people for decades after they drop out of the active directory, sometimes under a credential system that has been replaced twice since.

Some were issued one and cannot reach it. The phone is gone, the number changed, the hardware token is in a drawer at a previous address, the authenticator was never migrated when the device was swapped. This group is the largest, and it generates the call.

And some declined. A meaningful number of people will not put a corporate app on a handset they bought themselves, and that position is more common than IT staffing models assume. It also becomes invisible over time, because the people holding it stop raising it and quietly route around the system instead.

At enterprise scale, that is the daily queue.

Which is exactly where the attacks go

Attackers read this accurately, and they arrive as someone who has lost access to their factor.

The pretext is the same sentence a genuinely locked-out employee says: I am travelling, my phone was stolen, I cannot get the code, I need this today. The help desk agent is now being asked to make an identity decision with no factor to check, under time pressure, on a queue measured by handle time and first-call resolution.

This has been the reliable path for the incidents that defined the last three years. CISA’s advisory on Scattered Spider documents help desk social engineering as a core technique of the group (CISA, advisory AA23-320A). MGM Resorts disclosed roughly $100 million in impact for the quarter following its 2023 intrusion (MGM Resorts, Form 8-K, October 2023). Caesars reported a payment of around $15 million in the same period (Caesars Entertainment, Form 8-K, September 2023). Marks & Spencer put the hit at roughly £300 million in operating profit (M&S trading statements, 2025).

It shows up in aggregate threat data too. Mandiant found voice phishing was involved in 23% of cloud intrusions, the top vector in that category, and in 11% of intrusions overall (Mandiant, M-Trends 2026).

A cloned voice never has to beat your MFA when it can reach someone with the authority to turn it off.

What “no pre-registration” has to mean to be worth anything

The phrase gets used loosely. Three questions separate a product that genuinely verifies an unenrolled person from one that has moved the enrollment step somewhere less visible.

First: is there anything on file at all? Ask what the product compares the user against. If the answer is a stored face template, a registered device, a prior session, or a phone number in the HR record, then a person with none of those cannot be verified. The capability is real for your enrolled population and absent for the population that calls.

Second: does “no app” quietly mean “already enrolled”? These are separate claims and they are routinely blurred. A no-app claim can be entirely honest and still leave an enrolled factor sitting underneath it, because a browser-based product can depend on something the user registered a year ago. Read the second sentence, which is usually where that factor appears.

Third: what happens the very first time? The honest test is a person who has never interacted with the system, has no record in it, and needs something today. If the flow works for them on the first attempt, with nothing provisioned, it clears the bar.

Verifying against an authority instead of a record

If you cannot check what the organization issued, the alternative is to check what someone else already issued: an authority that has known this person for years and had no involvement in your onboarding process.

A government-issued ID is the obvious candidate, though scanning one and inspecting it accomplishes little on its own. Reading a document only tells you what the document says, and generative models produce convincing documents cheaply now. The query to the issuing authority is what confirms a matching record exists.

In the United States, that means the state DMV, reached over the AAMVA network. The question shifts from whether the license looks genuine to whether the issuing state holds a record matching it. A forged document has no record behind it, so the quality of the forgery stops mattering.

Two further signals travel with the same request and neither requires enrollment:

SIM swap and port-out detection. Mobile network operators know when a number moved to a new SIM recently. A number that changed hands hours before a password reset request tells the agent more than anything in your own directory will, and it comes from the carrier.

Man-in-the-middle and replay detection. These confirm the session is live and direct: the scan is happening now, on this device, rather than being relayed or replayed from a previous capture. Trusona’s implementation is patented (US Pat. 10,601,859).

None of this depends on the user having done something beforehand. It depends on institutions that already hold authoritative records about the person, which is why it works on a first interaction.

Where this approach has limits

Two limits, stated plainly, because a method that appears to handle everything is being oversold.

It requires the person to hold a government-issued ID they can present. Coverage is broad, and ATO Protect reads more than 2,500 document types worldwide. But a population without documents needs a different path, and any vendor who waves that away is selling.

Verification is also a point-in-time check on one request. It confirms who is asking, and leaves access control and monitoring to do their own jobs. No single control solves enterprise security.

What it removes is the guess. The agent no longer has to judge whether a voice sounds right, because there is a result to read.

What this looks like on a live call

The sequence is short by design, because a verification step that adds minutes to every reset will be bypassed within a month.

The agent sends a link over the channel already open. The caller opens it in the phone’s browser with nothing to install, photographs their ID, and the check runs against the issuing authority alongside the carrier and session signals. The agent gets a red, yellow or green summary instead of a data dump, and proceeds or stops.

The University of Connecticut runs this for NetID password recovery across students, staff and alumni, verifying against a government-issued ID in under a minute. One flow covers that spread because no step in it asks what the person set up beforehand. A first-week student and someone who graduated in 2009 take the same path.

Session PII is deleted after the check. Nothing new is stored, which means non-enrollment does not quietly turn into enrollment on the back end.

Questions to ask before you buy

• Can this verify a person who has no record in our system today, on their first interaction?
• What exactly is the comparison made against: our data, or an external authority?
• If the answer is an external authority, which one, and is the record queried or is the document merely inspected?
• Does any part of the flow require the user to have registered a device, an app, a number, or a biometric?
• What is retained after the session ends?
• What happens for a caller who has no smartphone at all?

The first question carries the most weight. If a vendor qualifies the answer, the qualification is where your never-enrolled population lives.

ATO Protect verifies a caller against the authority that issued their ID, in real time, with no enrollment, no app download, and no selfie. It runs no liveness check, because generative AI defeats those. It is available as a web portal your agents can use immediately, or through the ATOP API when you want it inside an existing workflow. See ATO Protect use cases or the IT help desk deployment. The companion piece on verifying users without making them install an app covers the app question specifically, which is a different question from this one.

Frequently asked questions

What does verification without pre-registration mean? It means confirming a person’s identity without depending on anything they enrolled beforehand: no registered device, no authenticator app, no stored biometric, no security questions. Verification runs against an external authority that already holds a record of the person, such as the state agency that issued their driver’s license.

Why does pre-registration matter if most of our users enrolled successfully? Because the requests that need verification most are the ones where the enrolled factor is unavailable. A user calls the help desk because their phone is gone or their credential no longer works. Attackers use that same situation as a pretext, which is why that path is the one under attack.

Is “no app required” the same as “no enrollment required”? No, and the two are frequently blurred. A browser-based product can still depend on a factor the user registered previously. A no-app claim describes the device. A no-enrollment claim describes what has to exist beforehand. Ask which one is being made.

How can someone be verified with nothing on file? By checking them against an authority outside your organization. A government-issued ID is queried against the issuing authority — in the US, the state DMV over the AAMVA network — to confirm a matching record exists. SIM swap detection and man-in-the-middle detection add context from the carrier and the live session. None of these require prior setup by the user.

Does this work for contractors, alumni, and first-day employees? Yes. Those populations are the reason the approach exists. They hold government-issued identity documents even when they hold no corporate credential, so there is nothing they needed to have done in advance.

What identity assurance level does this reach? ATO Protect verifies to NIST IAL2.

What happens to the ID after verification? All user PII from the verification session is deleted. Trusona runs on SOC 2 infrastructure, and its trust portal is at trust.trusona.com.

The users who never enrolled are the ones attackers call about. Verification that only starts working after enrollment misses them entirely.