How does your help desk verify someone before resetting MFA?

Resetting Multi-Factor Authentication (MFA) is a high-stakes operation, and verifying the identity of the requester requires a layered, proportional approach. Here's how mature help desks ensure security during MFA resets:

Core Principles

1. ·Layered Verification: No single method is sufficient. Combine knowledge-based, possession-based, and trust-based checks.
2. ·Dynamic Checks: Avoid static data like birthdates or mother’s maiden name—use real-time, account-specific details (e.g., “What were the last three files you accessed?”).
3. ·Contextual Risk Scoring: Flag suspicious requests based on IP location, timing, or login history, and escalate verification accordingly.
4. ·Auditability: Log every step—request details, verification methods, approvals, and outcomes—to ensure compliance and enable forensic review.

Typical Verification Workflow

1. ·Initial Request: User calls or submits a ticket, providing basic details (user ID, reason for reset).
2. ·Identity Confirmation: Verify internal-only data (employee ID, manager name) and dynamic questions. Avoid easily discoverable information.
3. ·Possession Checks: Confirm ownership of a known device or channel (e.g., partial phone number, QR code, or OTP sent to a pre-registered number).
4. ·Managerial Approval: For high-risk accounts or suspicious requests, require manager confirmation via a separate, trusted channel.
5. ·Policy Enforcement: Use a policy engine to block resets that violate rules (e.g., too frequent or after a password change).
6. ·Reset Execution: Deactivate the old MFA method, enable the new one, and provide a temporary OTP for immediate access.

Advanced Controls

• ·Callback Procedure: Always dial out to a pre-registered number; never trust incoming caller ID.
• ·Geolocation Guard: Block resets from high-risk locations unless explicitly approved.
• ·Two-Person Approval: Require dual approvals for privileged accounts (e.g., admin, finance).
• ·Automated Escalation: Trigger workflows (e.g., manager notifications) for high-risk requests.

Pitfalls to Avoid

• ·Email-Only Verification: Never rely on email alone—it’s often the target of compromise.
• ·Static Security Questions: Use dynamic, unsearchable data instead.
• ·Urgency Pressure: Train agents to resist rushed requests—social engineers exploit urgency.

Tools & Standards

Help desks often integrate ITSM platforms (e.g., ServiceNow, Jira) with identity providers (e.g., Azure AD, Okta) to enforce policies (e.g., rate-limiting resets) and log actions for compliance (PCI-DSS, SOC 2).

Bottom Line

Verifying MFA resets requires combining multiple factors—knowledge, possession, and trust—tailored to the request’s context and the user’s role. Automated tools, layered checks, and stringent logging are essential to prevent account takeovers while maintaining operational efficiency.