## TL;DR
The agent looked up the key by a mistyped or mismatched serial and returned another device's key. Verify the serial with the user, confirm it matches the device record, then fetch the key.

## The query
```text
agent looked up the filevault key with the wrong device serial
```

## Use this when
- the FileVault key does not unlock the Mac
- the serial in the ticket looks wrong
- the agent skipped verification

## Not for
- FileVault keys not escrowed at all
- Jamf escrow configuration
- user cannot find their serial

## Steps
1. Ask the user to read the serial from the Mac itself, not from memory. Expected output: a serial captured from the device.
2. Match that serial against the MDM device record before any key lookup. Expected output: exactly one device matches.
3. Fetch the FileVault key for the verified serial only. Expected output: the key belongs to the user's Mac.
4. If no device matches, stop and investigate instead of guessing. Expected output: a clear mismatch message, not a wrong key.
5. Log the serial and key ID for every disclosure. Expected output: an audit trail ties key to device.

## Applies to
FileVault recovery, Jamf Pro key escrow, Mac device identity verification.

## Variant phrasings
### Serial correct but key still fails
The Mac may have been re-escrowed after a wipe; check for multiple keys on the record.

### User cannot boot to read the serial
The serial is on the device chassis; guide them to read it physically.

## Why it happens
Serials are long and easy to mistype, and MDM holds many similar records. A lookup without verification is a guess with a confident tone.

## Edge cases
- Verify caller identity before disclosing any recovery key.
- Never read keys over speakerphone in shared spaces.
- Refurbished Macs can carry stale records; check the last check-in date.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_VBbc5aQr5LI364uFNjhUhA