How do you verify a user before a password reset?

Use a check the caller can't research or fake. If the user's MFA still works, use it. If not, ask questions based on dynamic data from internal systems, score the replies automatically and hide the answers from the agent. Avoid relying on employee ID, manager name or date of birth, which are often easy to find.

How do you verify an employee who has lost their phone or MFA device?

Ask questions based on dynamic data from your organisation's own systems, such as recent IT tickets, issued devices or approvals. Retrieve the answers automatically, hide them from the agent and score the replies. This works without any device and resists voice and video deepfakes.

What is the difference between identity verification and authentication?

Authentication checks that a credential can sign in. Identity verification confirms that the person is who they claim to be. You need verification when the usual credential is lost, compromised or being reset.

How do you recover access when a user loses their passkey?

The user needs a secure way to prove their identity before a new passkey or Temporary Access Pass is issued. For users with no other enrolled device, that usually means a verified help desk interaction, which should be based on evidence rather than the agent's judgement.

Isn't knowledge-based authentication insecure?

Static security questions are insecure, which is why NIST SP 800-63B no longer accepts them. Dynamic verification is different: it uses current, organisation-held data that isn't public and changes over time.

Can deepfakes fool help desk verification?

Yes, if verification relies on recognising a voice or face. Deepfakes can clone both from public footage. Questions about a user's recent activity in internal systems don't depend on how someone looks or sounds.

How do you stop social engineering attacks on the IT help desk?

Standardise verification for every high-risk request and remove agents' rights to reset passwords, reset MFA or issue TAPs, so only the verification workflow can perform those actions. Then remove agent discretion over what counts as a pass, apply stricter thresholds to privileged accounts and log every check.

Should help desk agents have admin rights to reset passwords or issue Temporary Access Passes?

No. If agents can reset accounts directly, an attacker only has to persuade them to skip verification. Give those privileges to the verification workflow instead, and let it act only after a successful check.

Does workforce identity verification replace MFA or Microsoft Entra ID?

No. It complements them. Entra ID and MFA handle everyday authentication; verification covers the situations where those factors are unavailable.

2026 Archives - Self Service Password Reset Tool

Workforce Identity Verifiication: How to verify employees blog

Workforce Identity Verification for Password & MFA Resets

October 5, 2026

Home » 2026 Share on Facebook Facebook Share on Linkedin Linkedin 𝕏 Share on X X Workforce Identity Verification: Why Your Own Company Data Is the Safest Way to Verify Locked-Out Employees Finn Jensen | Founder, FastPasscorp Short answer: when an employee needs a password reset and can’t use their MFA device, or has lost their

Workforce Identity Verification for Password & MFA Resets Read More »

Microsoft Entra goes passwordless - identity verification gap at the help desk visual

Microsoft Entra Is Going Passwordless. Here’s the Identity Verification Gap You Have to Close.

August 3, 2026

Home » 2026 Share on Facebook Facebook Share on Linkedin Linkedin 𝕏 Share on X X Microsoft Entra Is Going Passwordless. Here’s the Identity Verification Gap You Have to Close. Finn Jensen | Founder, FastPasscorp Passkeys are the right destination. But a passkey is something a user has — and the moment they don’t have it,

Microsoft Entra Is Going Passwordless. Here’s the Identity Verification Gap You Have to Close. Read More »

Blog image: How Credential Breaches Really Start

The Help Desk Verification Gap: How Credential Breaches Really Start

July 2, 2026

Home » 2026 Share on Facebook Facebook Share on Linkedin Linkedin 𝕏 Share on X X The Help Desk Is Your Biggest Identity Security Blind Spot Finn Jensen | Founder, FastPasscorp Help desk impersonation is one of the most reliably effective credential attack vectors in use today. An attacker calls your IT service desk, claims to

The Help Desk Verification Gap: How Credential Breaches Really Start Read More »

women for help desk vishing attacks blog header 4

Scattered Spider Pays $1000 to Women for Help Desk Attacks

March 16, 2026

Home » 2026 Share on Facebook Facebook Share on Linkedin Linkedin 𝕏 Share on X X Scattered Spider Pays $1000 to Women for Help Desk Attacks Finn Jensen | Founder, FastPasscorp Why stronger help desk identity verification is now critical Social engineering attacks against IT help desks are evolving again—and the latest tactic shows just how

Scattered Spider Pays $1000 to Women for Help Desk Attacks Read More »