ATO Protect FAQ
Identity verification for the help desk, answered
Straight answers on how ATO Protect verifies a caller, what it does with data, and how fast a team can put it to work.
What is Identity Impersonation Detection (IID)?
Identity Impersonation Detection confirms in real time that a person is who they claim to be, and catches forged IDs, synthetic identities, and GenAI deepfakes in the same step. It differs from authentication, which checks a credential, and from liveness, which generative AI can now beat.
How is ATO Protect different from MFA?
MFA checks a credential or a device. It cannot tell a help desk agent who is holding the phone. ATO Protect verifies the person against government records before the agent resets an account or changes access.
Does ATO Protect store personal data or PII?
No. Trusona stores no PII and holds SOC 2 certification. The agent sees a red, yellow, or green result, not the caller's identity documents.
Does the caller need to pre-register or install an app?
No. ATO Protect verifies first-time callers. The person being verified needs no account and no separate app.
What does ATO Protect verify identity against?
ATO Protect reads a government-issued ID and checks it against the source that issued it, the state DMV, through the AAMVA network. It also detects SIM swaps and port-outs, blocks man-in-the-middle attacks, and uses anti-replay technology covered by US Patent 10,601,859.
Does it use selfie matching or liveness checks?
No. Generative AI can forge a convincing face, so a selfie or liveness check is a weak defense. ATO Protect verifies the ID against authoritative government records instead.
How fast can ATO Protect be deployed?
A team can go live in under seven minutes through a web portal, with no integration required. An API connects it to ServiceNow, Okta, or Microsoft Entra ID when you want it inside an existing workflow.
What is Agent Verify?
Agent Verify stops the reverse attack, where a criminal calls an employee while posing as IT support. The employee gives the caller a single-use, time-limited Verify Code and confirms it on an internal page. The code cannot be spoofed or intercepted through a man-in-the-middle attack.
Does ATO Protect stop Scattered Spider-style help desk attacks?
Yes. ATO Protect targets the social-engineering phone call that drove the MGM and Marks & Spencer breaches. It verifies the caller before the help desk resets a password or hands over access.
How does ATO Protect integrate with ServiceNow?
ATO Protect runs from a ServiceNow ticket and logs each verification result to the Interaction or Incident record. It stores no PII in the process.