Last verified: September 30, 2026.
A caller says they are locked out and asks for an MFA reset. The agent cannot see a face, and a cloned voice can sound like a colleague. CISA’s advisory on Scattered Spider describes actors who “Posed as employees to convince IT and/or helpdesk staff to provide sensitive information, reset the employee’s password, and transfer the employee’s MFA to a device they control” (CISA Advisory AA23-320A).
Which control belongs behind that ticket depends on the failure you are defending against. This page compares how nine options verify a help desk caller: Okta, Microsoft Entra ID, Microsoft Entra Verified ID, Persona, Cisco Duo, HYPR, Nametag, Incode and Trusona. Each cell comes from the vendor’s own public pages, and the sourcing notes at the end give the dates. Many teams run more than one of these.
Which account takeover protection options exist for IT help desks?
Help desks choose from three layers. Identity and MFA platforms check whether a credential is valid. Device and session tools check whether a sign-in looks normal. Identity verification checks whether the person asking is who they claim to be. The options compared here sit in the third layer, though some of these vendors also sell the first two.
| Layer | Question it answers | Example from this page |
|---|---|---|
| Identity and MFA | Is this credential valid? | Okta and Microsoft Entra ID sign-in, MFA and recovery policies |
| Device and session signals | Does this sign-in look normal? | Okta Adaptive MFA: “Create contextual access policies that assess devices, networks, locations, user behavior, IP addresses, and more.” |
| Help desk identity verification | Is this person who they claim to be? | All nine options compared below |
Credential and device controls check what the requester holds or where the request comes from. Help desk attacks aim at the moment when that evidence is missing or cannot be trusted. For the longer argument, see our guide to the five ways to verify someone’s identity and the executive briefing on Identity Impersonation Detection.
How do Okta, Microsoft Entra ID, Entra Verified ID, Persona, Cisco Duo, HYPR, Nametag and Incode compare with Trusona?
They differ on four points: what the person must present, what the ID is checked against, what the person must already have in place, and what the vendor keeps. The three tables below give each vendor’s published position on the same nine questions. Trusona is first in each table, and every vendor gets the same kinds of cells.
“Not published” means the vendor’s public pages listed under Sources do not describe the capability, as read on the dates given. It does not mean the capability is absent.
Table 1. What gets checked
| Option | What the check reads | Checked against the issuing authority? | Selfie or liveness required? |
|---|---|---|---|
| Trusona | A government-issued ID, scanned on the caller’s mobile device | Yes. In the US, the state DMV over the AAMVA network | No. It runs no selfie or liveness check |
| Okta | Document verification, liveness detection and facial analysis through identity verification vendors including Persona and Incode; results are matched to the user profile in your directory | Not published for its identity verification vendor flow. Okta’s separate Digital ID Verification beta verifies mobile driver’s licenses, which Okta says let a verifier confirm that “The data originated from a trusted issuing authority (e.g., a DMV)”. Okta says the beta is “specifically designed for non-production and test environments” | Not stated as required. Okta’s blog describes “document verification and liveness detection”; its product page lists liveness and facial analysis next to document-based (mDL) and knowledge-based proofs |
| Microsoft Entra ID (account recovery) | A government ID checked by a provider from the Microsoft Security Store, then a real-time Face Check; first and last name are matched to the Entra profile | Not published | Yes. Face Check compares the ID photo with a real-time biometric check |
| Microsoft Entra Verified ID | A Verified ID credential in Microsoft Authenticator; Face Check matches a real-time selfie to the photo | Not published | Yes. Face Check includes a liveness check |
| Persona | Government ID and selfie verifications; AAMVA Verification can be added | Yes, through AAMVA Verification, which you configure | Yes, in the standard ID + selfie flow |
| Cisco Duo | A government ID scan and facial recognition, run by Persona | Not published. Its two pre-configured checks compare the ID with the name and date of birth held in Duo or Persona | Yes. Facial recognition |
| HYPR | A government ID scan and a certified liveness-detecting selfie. A liveness-only mode needs no document | Not published. An optional check against “multiple sources of records” names no source | Yes. Both modes use liveness |
| Nametag | A live selfie matched to the photo on a government-issued ID | Not published. Nametag matches the selfie to the ID photo; its privacy FAQ says data may be cross-checked with “governments and commercial databases” | Yes. A live selfie |
| Incode | A government ID with a live selfie. GovMatch can also check against state DMV records | Yes. GovMatch confirms identity against state DMV issuing databases in real time | Yes, in the standard ID + selfie flow. GovFaceMatch compares a live selfie with the DMV’s photo |
Table 2. Who can be verified, and how
| Option | What the person must already have | App or browser | Help desk workflow |
|---|---|---|---|
| Trusona | Nothing. It verifies first-time callers | Works in the browser; no separate app | The agent requests the check, the caller completes it on a mobile device, and the agent gets a risk result in real time |
| Okta | A profile in your directory to match against, including at a new hire’s first login | Not published | Self-service inside sign-in and recovery policies. No help desk agent workflow is described on the pages reviewed |
| Microsoft Entra ID (account recovery) | An Entra account whose first and last name match the ID. No existing Verified ID is needed | Microsoft Authenticator must be installed; the provider reminds the user to download it if needed | Self-service, with no agent. If name matching fails, the user follows the normal helpdesk process |
| Microsoft Entra Verified ID | A Verified ID credential issued in advance by your tenant, or issued through an identity verification partner | Microsoft Authenticator | A help desk service can request a Face Check, for example to activate a passkey or reset a password |
| Persona | Hiring and onboarding checks verify at first contact. Later checks can compare against your system of record and prior sessions | A hosted-flow link sent to the person | Configured to run at moments such as help desk requests and account recovery. Persona documents a ServiceNow integration that opens or updates ServiceNow cases when identity events occur |
| Cisco Duo | Stored attributes: an email address in Duo; first name, last name and date of birth in Duo or Persona | A desktop or mobile browser at verify.duo.com; the device needs a camera | An administrator generates a five-minute access code; the user enters it at verify.duo.com and verifies through Persona |
| HYPR | Not published | A one-time link by email or SMS; step-up checks use the Affirm Authenticator | The agent sends the link from the HYPR Help Desk App, and the result appears in the same app |
| Nametag | Nothing. Nametag states “no pre-enrollment” | No app download; the person opens Nametag on their phone from a link | The agent shares a link through existing support channels, from Nametag’s console or inside ServiceNow or Zendesk |
| Incode | Onboarding and candidate checks verify at first contact. Help desk selfie checks match against a profile created at enrollment | Browser-based on mobile, desktop or tablet; no app download | Help desk staff select the employee from the directory and share a verification link |
Table 3. What signals it reads, and what it keeps
| Option | Employee verifies the agent? | SIM-swap, port-out and man-in-the-middle signals | What it keeps |
|---|---|---|---|
| Trusona | Yes. ATO Protect – Agent Verify (patent pending) | SIM swap and port-out detection. Patented man-in-the-middle and anti-replay detection (US Pat. 10,601,859) | Stores no PII and is SOC 2 audited. It collects no face, so there is no template to keep |
| Okta | Not published | Not published | Passes first and last name from your directory to the identity verification vendor. Retention period not published |
| Microsoft Entra ID (account recovery) | Not published | Not published | Identity verification providers have their own privacy and data retention policies |
| Microsoft Entra Verified ID | Not published | SIM swap, port-out and man-in-the-middle: Not published. Microsoft states Face Check results “can’t be replayed or manipulated on compromised devices” | The selfie “is discarded and not saved on any device or service”; the verifier receives only a confidence score |
| Persona | Not published | Not published. Persona publishes phone carrier and email domain reputation checks | Granular privacy and redaction controls |
| Cisco Duo | Not published | Not published | Duo sends first name, last name and date of birth to your Persona tenant. Retention period not published |
| HYPR | Not published | Not published | Captures the ID and selfie during the check. Retention period not published |
| Nametag | Not published | Not published | States it does not store biometric data. Other verification data is kept up to three years by default, configurable |
| Incode | Not published | SIM swap and port-out: Not published. States its detection “stops injection, replay, and synthetic attacks” | An encrypted face template and an encrypted onboarding selfie. Original ID images and selfies are deleted after verification. The customer sets retention, with a 45-day default |
Pricing is not compared here. Trusona does not publish pricing: contact sales, or start a free proof of concept at try.trusona.com.
Microsoft ships a feature named “Account recovery” that is separate from self-service password reset. Microsoft’s documentation says that unlike SSPR, “which requires users to retain at least one authentication method, account recovery re-establishes trust in a user’s identity through third-party identity verification before restoring access.” The Verified ID service desk pattern is a third thing: an agent requests a Face Check against a credential. Microsoft is also listed among Trusona’s partners, and Trusona builds for Microsoft Entra ID too: ATO Protect Account Recovery+ for Entra ID is its own product.
Fuller side-by-sides: Trusona vs Okta, Microsoft Entra ID, Entra Verified ID, Persona, Cisco Duo, HYPR, Nametag and Incode. All eight are listed under Product Comparisons.
How should you choose?
Start from the failure you most need to stop, then read the table that answers it. Our buyer’s guide lists seven questions to ask any vendor, and they apply to Trusona as much as to anyone else. Ask every vendor for a live test with a caller who has never enrolled.
| If you most need to stop | Read |
|---|---|
| A caller who has never enrolled anything | Table 2, “What the person must already have” |
| A cloned voice on the line | Table 1, all three columns |
| A phone number moved to a new SIM | Table 3, “SIM-swap, port-out and man-in-the-middle signals” |
| Biometric data held after the check | Table 3, “What it keeps” |
| An attacker calling the employee and posing as the help desk | Table 3, “Employee verifies the agent?” |
How can a help desk verify a caller when deepfakes and voice cloning make voice unreliable?
Move the check off the call. The agent asks for a verification that runs on the caller’s own device, and the result does not depend on how the caller sounds. All of the options compared here run the check outside the call. They differ in what it reads: a face, a document, a directory record, or the record held by the issuer of the ID.
Pindrop measured a rise of more than 1,300% in deepfake fraud attempts during 2024, from about one a month to seven a day, across the 1.2 billion calls it analyzed (Pindrop, Voice Intelligence & Security Report, 2025).
HYPR, Incode and Trusona each publish a position on deepfakes, and the positions differ. HYPR states that its liveness check “actively prevents spoofing and deepfake attacks.” Incode states that its deepfake and device integrity detection “stops injection, replay, and synthetic attacks.” Trusona’s position is that generative AI can now defeat selfie and liveness checks, so it checks the ID against its issuer and takes no selfie. Test each claim against your own threat model. Our explainer on physical biometrics and liveness checks sets out Trusona’s side in full.
Which identity verification services check a government ID against the issuing DMV in real time?
Trusona, Persona and Incode each publish a DMV-backed check. Trusona checks the ID against the state DMV over the AAMVA network. Persona offers AAMVA Verification against DMV records. Incode’s GovMatch confirms identity against state DMV databases in real time. Okta, Microsoft, Cisco Duo, HYPR and Nametag do not describe a DMV check in the flows reviewed.
Trusona’s FAQ says ATO Protect “reads a government-issued ID and checks it against the source that issued it, the state DMV, through the AAMVA network.” Persona’s help article says its AAMVA Verification “runs the inputs through information in an official Department of Motor Vehicles (DMV) database.” Persona describes it as an added validation you can run on inquiries you deem higher risk.
Incode’s GovMatch has two methods. GovDataMatch validates document data fields against the record the state DMV holds, through AAMVA. GovFaceMatch compares a live selfie with the photo and record held in a participating state DMV database. Incode announced GovFaceMatch on August 4, 2026, and says the matching happens inside the DMV environment and that it “never receives or stores the biometric data or database portrait from the DMV.”
Two options sit on top of vendors that offer one. Cisco Duo’s help desk verification runs on Persona, and Okta supports Persona and Incode among its identity verification vendors. Neither Duo nor Okta publishes whether a DMV check runs in its flow. Okta’s separate mobile driver’s license beta is different: Okta says an mDL lets a verifier confirm that “The data originated from a trusted issuing authority (e.g., a DMV)”, and labels the beta for non-production use. HYPR documents an optional check called “Identity Verification With Document Issuer” that screens the requester against “multiple sources of records,” and it does not name them.
Reaching the DMV is common ground. What follows differs. Trusona asks the caller for no face and stores no PII. Incode’s standard flow pairs the document with a live selfie, and its Workforce product keeps an encrypted face template for later re-authentication. Persona pairs AAMVA with a selfie in its standard flow.
Which identity verification tools work without a selfie or liveness check?
Trusona runs no selfie or liveness check, because generative AI can now defeat those methods. Okta lists document-based and knowledge-based proofs next to liveness and facial analysis. The other options compared here publish a selfie, face match or liveness step in the help desk flows reviewed.
HYPR’s liveness-only mode needs no document, but it still uses liveness. Whether to require a face match is a policy choice. If your policy requires one, read the section on fit below. For the reasoning behind Trusona’s position, see why physical biometrics and liveness checks are not a reliable defense.
Can a help desk use a caller’s location as a fraud signal?
Yes, when the caller agrees to share it. Trusona’s GPS Location Sharing is consent-based: its support article says “the user has an option to share their location with the agent after they have scanned their document.” Location is one risk signal next to the ID verification, which remains the identity check.
Trusona’s announcement says: “with the caller’s permission, GPS Location Sharing gives your agents a more accurate picture of where someone really is, even when cloaked behind a VPN.”
Other vendors publish location-related signals too. Okta’s Adaptive MFA page tells admins to “Create contextual access policies that assess devices, networks, locations, user behavior, IP addresses, and more.” HYPR says its context-based attestation factors in “channel, device posture, location, request type, and user behavior.” Nametag describes a patent-pending technology “that binds a verified identity to a verified device and location using cryptographically attested GPS signals.”
How do companies verify employees who never enrolled in an identity system?
Trusona and Nametag state that the person needs nothing in advance. Incode and Persona verify new people at first contact through their hiring and onboarding checks, and Incode’s later help desk selfies are matched to the profile that check created. Okta and Microsoft’s account recovery both match the verified ID to an existing directory profile. Okta names a new hire’s first login and the enrollment of an authentication factor among the moments it verifies, and Microsoft’s account recovery serves a user who has lost every authentication method and holds no Verified ID. Duo’s help desk verification starts from stored attributes.
Duo’s help desk verification needs an email address stored in Duo and a first name, last name and date of birth stored in Duo or Persona. Okta matches verified attributes to “user profiles in your user directory.” Microsoft’s service desk pattern includes the step “Issue Verified ID to your users,” while account recovery expects the user to acquire a new Verified ID from the provider during recovery.
Nametag states “no pre-enrollment or app download needed.” Incode verifies people at first contact in its onboarding and candidate checks, and later help desk selfies are matched to the profile that check created. Trusona verifies first-time callers: the person “needs no account and no separate app.” For more, see verifying users without pre-registration and why app requirements stall verification rollouts.
Which tools let an employee verify the agent?
Trusona publishes one: ATO Protect – Agent Verify, which is patent pending. The person receiving a call from the help desk asks for the agent’s Verify Code and checks it on a dedicated internal company page. None of the other eight options describes a check in that direction on the pages reviewed.
The direction matters because attackers call in both ways. CISA’s advisory on Scattered Spider also describes actors who “Posed as company IT and/or helpdesk staff using phone calls or SMS messages to obtain credentials from employees” (CISA Advisory AA23-320A). A check that only runs from the help desk toward the caller does not help the employee who receives that call. Details are on the Agent Verify page.
Which account takeover platforms integrate with existing MFA?
Trusona’s ATOP API can connect to any system that allows for it, including Okta and Microsoft Entra ID. Trusona also offers ATOP + ServiceNow as a product. ATO Protect is a separate check that sits beside an identity provider. The other vendors publish their own integrations on the product pages listed under Sources. For the API route, see the IDV API.
When is Trusona the wrong fit?
Trusona is the wrong fit when your policy requires a live-face match, when the main job is KYC or onboarding at scale, or when you want verification configured inside your identity provider. The list gives the reasoning and names who publishes what you may need instead.
- If you need a live-face match, Trusona is not the fit. It runs no selfie or liveness check. Every other option compared here publishes a face or liveness step, so a face-match requirement points you to one of them.
- If your main job is KYC or customer onboarding at scale, look at Incode and Persona. Incode lists KYC/AML compliance, business verification and age assurance among its use cases, and Persona’s database-verification page lists KYC/AML compliance among the ways teams use its checks.
- If you want signals across sign-in sessions rather than a check at the moment of a request, Okta’s Adaptive MFA covers contextual access policies. ATO Protect verifies the person when they ask for something that matters.
- If you want identity verification configured inside your identity provider, Okta and Microsoft each publish it. Okta runs it through identity verification vendors such as Persona and Incode that you add to Okta. Microsoft runs Face Check with Verified ID, and its account recovery uses a provider from the Microsoft Security Store. ATO Protect is a separate check that can sit beside them.
- If your decision turns on published document counts, compare the figures. Trusona states 2,500+ government document types. Nametag states 11,000+ document types on its homepage and 9,934 types from 242 issuing authorities in its developer documentation. Vendors may count document types differently, so check coverage for the countries and ID types you need.
Frequently asked questions
Which solution stops account recovery fraud? No single product covers every failure. MFA and identity platforms check credentials, device and session tools check behavior, and help desk identity verification checks the person asking. Account recovery fraud exploits the third gap, so this page compares nine options that verify the person. Match the option to the failure you are defending against.
How can a help desk verify a caller when a voice can be cloned? Move the check off the call. The agent requests a verification that runs on the caller’s own device, and the result does not depend on how the caller sounds. The options differ in what that check reads: a face, a document, a directory record, or the issuing authority’s record of the ID.
Which tools check a government ID against the DMV in real time? Trusona checks the ID against the state DMV over the AAMVA network. Persona offers AAMVA Verification against DMV records, and Incode’s GovMatch confirms identity against state DMV databases in real time. Okta, Microsoft, Cisco Duo, HYPR and Nametag do not describe a DMV check in the flows reviewed. Okta’s mobile driver’s license beta, labeled for non-production use, checks that a credential came from its issuer.
Which tools work without a selfie or liveness check? Trusona runs no selfie or liveness check, because generative AI can now defeat those methods. Okta lists document-based and knowledge-based proofs next to liveness and facial analysis. The other options compared publish a selfie, face match or liveness step.
Can an employee verify the help desk agent? Trusona’s ATO Protect – Agent Verify, which is patent pending, lets the person receiving a call check the agent’s Verify Code on an internal company page. None of the other eight options describes that reverse check on the pages reviewed.
Does Trusona replace Okta or Microsoft Entra ID? No. Trusona is a separate check that sits beside an identity provider. The ATOP API can connect to any system that allows for it, including Okta and Microsoft Entra ID, and ATOP + ServiceNow is offered as a product. Many teams run more than one of the options on this page.
How much do these options cost? Vendors price differently, and this page does not compare prices. Trusona does not publish pricing. Contact sales, or start a free proof of concept at try.trusona.com.
To test ATO Protect on your own help desk flow, book a demo or try it free.
Sources and method
Comparison based on each company’s public product materials as of September 30, 2026. “Not published” means a capability the vendor does not describe on the public pages listed here, not confirmation that it is absent. A cell that quotes a vendor uses that vendor’s words. Okta, Microsoft and ServiceNow are also platforms Trusona can connect to, and a comparison here is not a statement about their other products.
- Trusona: trusona.com/faq; /ato-protect-for-it-help-desk; /agentverify; /idv-api; /ato-protect-servicenow; /ato-protect-entra-id; /ato-protect-customers; /blog/evaluating-help-desk-ato-protection; /partners; /llms.txt; /news/trusona-identity-impersonation-detection-servicenow (June 29, 2026); /news/trusona-agent-verify-location-sharing-update; help.trusona.com/support/solutions/articles/43000754227-enabling-location-services-to-share-location. Read September 30, 2026.
- Okta: okta.com/identity-verification/; okta.com/blog/identity-security/outsmart-impersonators-with-identity-verification-built-into-the-okta-platform/ (April 23, 2025); help.okta.com/oie/en-us/content/topics/security/idp-idv.htm; okta.com/blog/product-innovation/okta-digital-id-verification-beta/ (January 12, 2026); okta.com/en-in/blog/industry-insights/mdl-digital-identity-verification/ (January 20, 2026); okta.com/products/adaptive-multi-factor-authentication/. Read September 2026.
- Microsoft: learn.microsoft.com/en-us/entra/identity/authentication/self-service-account-recovery (ms.date August 14, 2026); …/how-to-account-recovery-enable; …/concept-account-recovery-overview; learn.microsoft.com/en-us/entra/verified-id/using-facecheck; …/helpdesk-with-verified-id. Read September 2026.
- Persona: help.withpersona.com/articles/1wiQ7wAhmnKh6mesCGopKl (AAMVA Verification); withpersona.com/solutions/workforce-idv; withpersona.com/product/verifications/authoritative-databases-issuing-sources; withpersona.com/product/reports/phone-email-risk; docs.withpersona.com/hosted-flow; help.withpersona.com/articles/7gVSEygLw0OqtJGBvwHigS/ (last updated August 23, 2026). Read September 2026.
- Cisco Duo: duo.com/docs/identity-verification (last updated August 21, 2026). Read September 2026.
- HYPR: hypr.com/it-help-desk-identity-verification; hypr.com/blog/hypr-help-desk-application (October 1, 2025); docs.hypr.com Affirm documentation v11.3.0. Read September 2026.
- Nametag: getnametag.com/platform/helpdesk-verification; getnametag.com/legal/faq/; getnametag.com/docs/govtid-doctypes/; getnametag.com; getnametag.com newsroom release of July 31, 2026. Read September 30, 2026.
- Incode: incode.com/workforce/; incode.com/technology/identity-verification; incode.com/use-cases/kyc-aml/; incode.com/use-cases/know-your-business/; incode.com/use-cases/age-assurance/; developer.incode.com/general-reference/united-states-govmatch/; incode.com/blog/incode-launches-govfacematch/ (August 4, 2026); workforce.developer.incode.com (Helpdesk Verifications guide; Data Handling and Security Overview). Read August 13 and September 30, 2026.
- Statistics: Pindrop, Voice Intelligence & Security Report, 2025. CISA Advisory AA23-320A.
Vendor pages change. If you see a statement here that no longer matches a vendor’s page, tell us and we will check it.
See how ATO Protect verifies a caller against the authority that issued their ID.