how to verify caller identity before resetting credentials

TL;DR

Credential resets are the top social-engineering target on the helpdesk. Verify the caller through an independent channel before resetting anything: call back a known number, check a second factor, or use manager approval. No verification, no reset.

The query

how to verify caller identity before resetting credentials

Use this when

• user calls asking for a password reset
• chat request to reset MFA
• writing the verification policy

Not for

• self-service resets the user does themselves
• in-person resets with badge check (different procedure)
• emergencies where the procedure defines the exception path

Steps

1. Do not trust caller ID alone; it can be spoofed. Expected output: the risk acknowledged
2. Call back on a known good number from the directory, or verify through a second channel. Expected output: identity confirmed independently
3. Ask verification questions an attacker would not know, per your policy. Expected output: answers match the record
4. For high-risk resets, require manager approval in the ticket. Expected output: approval recorded
5. Perform the reset and confirm the user can sign in. Expected output: reset completed
6. Log the verification method used in the ticket. Expected output: audit trail complete

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_uYnzA2zYeE71RKd03dEezw

Resolved from the public thread: https://vectle.com/posts/pst_uYnzA2zYeE71RKd03dEezw

Thread query: how to verify caller identity before resetting credentials

TL;DR: Credential resets are the top social-engineering target on the helpdesk. Verify the caller through an independent channel before resetting anything: call back a known number, check a second factor, or use manager approval. No verification, no reset.