Specialisation

Identity verification at the service desk

An attacker does not need a password if the service desk resets it for them. Technical verification replaces knowledge questions and the judgement of a single employee with a control that the caller must pass themselves. DeepCalls helps you choose which solution suits your organisation, and shows what it does and does not solve.

Book an intro callView the ATO assessment
  • Overview of solutions
  • Assessed against your vulnerabilities
  • Including what a solution does not cover
  • Test scenarios for your proof of concept

The problem

MFA is only as strong as the reset

Many organisations have introduced MFA. But anyone who calls to say they have a new phone is asking the service desk to reset exactly that security.

The service desk then has to establish whether the caller is who they say they are. This is often done with questions, a callback number or a judgement call.

That is not the employees' fault. The process demands a judgement under time pressure about someone they cannot see, while a colleague on the line wants to get back to work quickly.

The risk is not theoretical. In their advisory on Scattered Spider, the US CISA and FBI describe how attackers pose as employees to the helpdesk. This is how they have passwords reset and MFA transferred to a device they control themselves.

What we see

Where verification leaves room in practice

In our assessments, we see recurring patterns in verification, handover and permissions. They are properties of the process, not mistakes by people.

A technical measure can close a large part of this.

The solutions

Two ways to verify a caller

Technical verification takes the decision away from whether someone knows the right answers. The caller has to prove something. There are two approaches, and some solutions offer both.

Verification by presence

What the caller proves
That they currently have access to their own resources and data
How
Existing MFA, combined with dynamic company data such as recent sign-ins, tickets or badge access. Each check earns points. Only when the threshold you set per role and request type is reached does the reset go ahead.
Strong when
You want to use existing MFA and data instead of a new enrolment step

Verification by proof of identity

What the caller proves
That they are the person listed in the directory
How
On a phone with an ID document, which is checked against the person's own record in the directory, plus a face check against the photo in that document
Strong when
The caller no longer has their own resources. Anyone with a record in the directory can be verified.

What both have in common

01
Enforcement.
No reset without completed verification, recorded in the ticket in your ITSM. How far this goes by default differs per solution and platform. Sometimes you build the block yourself via an API.
02
Per role.
A stricter check can apply to users with elevated privileges.
03
Beyond the service desk.
With some solutions, the same verification also works for local IT, HR, finance and callback requests. Sometimes the other way round as well: the employee checks that they really are speaking to the service desk.

Who it is for

For organisations where one phone call can open a lot

Relevant to any organisation where the service desk can reset passwords or MFA by phone, in particular:

Even if you already use self-service password reset or a Temporary Access Pass. As long as the service desk can reset manually, the phone remains a route.

  • Multinationals with multiple entities, a central or outsourced service desk and local IT
  • Banks and financial institutions
  • Government bodies and organisations that fall under the Cyberbeveiligingswet (the Dutch Cybersecurity Act)
  • Organisations with many employees whom the service desk never sees in person

Regulation

Cybersecurity Act and NIS2

Since 15 August 2026, the Cybersecurity Act, the Dutch implementation of NIS2, has been in force. The board bears ultimate responsibility for cyber risk management.

NIS2 lists access control and the use of multi-factor authentication among the mandatory measures (Article 21). The directive does not specify a method for verifying callers. An MFA reset via the service desk is, however, a logical place to test whether those measures hold up in practice. For financial institutions, DORA also applies.

The approach

From assessment to working verification

  1. 01

    Assessment.

    We test your service desk with realistic phone calls and map where the process leaves room.

  2. 02

    Overview of solutions.

    Per solution: how it works, which of your vulnerabilities it closes, what it does not cover and what it requires of the caller and the employee.

  3. 03

    Contact with providers.

    We put you in touch with the providers that fit. The choice is yours.

  4. 04

    Proof of concept.

    The scenarios from the assessment become the test cases for your proof of concept.

  5. 05

    Retest.

    After implementation, we test again.

Partnerships

Open about partnerships

We describe every solution in the same way, including what it does not cover. The overview includes the providers DeepCalls works with. The choice is always yours.

Frequently asked questions

Is MFA not enough?
MFA protects the sign-in. An MFA reset via the service desk is a separate route, and MFA itself does not help against that.
Which solution is best?
That depends on your vulnerabilities, your employees and your ITSM. That is why the advice starts with what the assessment shows.
Do employees have to use an ID document?
Only with verification by proof of identity. With verification by presence, you use existing MFA and company data.
What if someone calls on behalf of someone else?
There are solutions for that too, for example where an assistant makes the request but the account holder completes the check themselves.
Does it work with ServiceNow or TOPdesk?
Integration differs per provider and per platform. The overview shows, per solution, what is available for your platform.

Introductory call

Curious which verification suits your service desk?

In an introductory call, we discuss your situation and what the logical next step is.

Book an intro call