Workforce and Help Desk Identity Verification Buyer's Guide

Attackers keep getting into large organisations by phoning the IT help desk, pretending to be an employee or contractor, and asking for a password or MFA reset. The help desk has no reliable way to tell who is on the line, so it falls back on questions whose answers can be found online or bought. Workforce identity verification products close that gap by verifying employees, contractors and new hires with document, biometric, device or credential checks before a reset, a new enrolment or privileged access is granted. This vendor-neutral buyer's guide covers that workforce use case only: help desk resets, account recovery, onboarding of new joiners and step-up for high-risk changes. Customer onboarding and KYC are covered in the Identity Verification Buyer's Guide. It is for IAM leads, service desk owners and security architects.

Key takeaways

The reset is the attack. CISA's advisory on Scattered Spider describes actors convincing help desk staff to reset passwords and MFA, then registering their own MFA to persist. Verification must sit in front of every credential reset and enrolment, not only new accounts.
Knowledge questions are not verification. NIST SP 800-63A-4 does not permit knowledge-based verification. Employee ID numbers, manager names and dates of birth are all discoverable.
Remote verification needs injection defence. NIST requires controls that confirm media comes from a genuine sensor and detect manipulated media. Ask for evidence against virtual cameras and deepfakes, not only printed photos.
Prefer existing strong credentials when they work. If the person still holds a passkey or a managed device, verifying with that is faster and stronger than a document check. Document and selfie checks are for when nothing else is left.
Design for contractors and outsourced help desks. Many incidents involve third-party staff or a third-party service desk. The product must work for people who are not in your HR system and for agents who are not your employees.

What the category does

Workforce identity verification answers one question at a sensitive moment: is this person the employee or contractor they claim to be? Products combine several methods and put them into help desk, IdP and HR workflows.

Method	How it works	Strength	Weakness
Existing authenticator challenge	Push or passkey challenge to an already registered authenticator or managed device	Fast, cheap, strong if the authenticator is phishing-resistant	Useless when the reason for the call is a lost device
Document plus selfie with liveness	Photo ID captured live, chip read where available, face matched to the document with presentation attack detection	Works when all credentials are lost; links to a real person	Needs a reference to match against: was this document checked at hire?
Biometric match to enrolment	Selfie matched to a face template captured at onboarding	Proves it is the same person who was hired	Biometric data protection obligations; template storage risk
Verifiable credential or digital identity wallet	Employee presents a cryptographically signed credential issued by the organisation or a trusted issuer	Strong, reusable, privacy preserving	Needs issuance at onboarding and wallet adoption. See the Verifiable Credentials Guide
Manager or peer attestation	A named manager approves the request through an authenticated channel	Uses existing trust; good for contractors	Manager account may also be compromised; slow out of hours
Live video with trained agent	Agent compares face and document over video using random prompts	Handles exceptions	Deepfake exposure; agent training required; recording needed
Out-of-band callback	Help desk calls back a number from the HR record, never one given on the call	Cheap baseline	Defeated by SIM swap; HR data must be accurate

NIST SP 800-63A-4 distinguishes remote unattended proofing (fully automated), remote attended (secure video with a proofing agent or trusted referee), and on-site attended and unattended options. Most workforce products offer remote unattended as the default with an attended route for exceptions. For the technical depth on liveness and injection attacks, see the Deepfake-Resistant Identity Verification Guide and the Biometric Liveness and Presentation Attack Detection Guide.

When you need it

Moment	Risk	Recommended verification strength
Standard user forgets password, still has a registered device	Low to medium	Self-service reset with a phishing-resistant authenticator; no help desk
User lost all authenticators	High: this is the attacker's preferred story	Document plus liveness matched to hire record, or verifiable credential, then new phishing-resistant enrolment
Administrator or privileged user reset	Very high	Strongest available method plus a second approver; consider in-person or attended video
New joiner first-day enrolment	High: the first credential sets the trust for everything after	Verify identity before issuing credentials, matched to the person checked at hiring. See the Joiner-Mover-Leaver Guide
Contractor or third-party user reset	High	Verification plus sponsor approval; check access end dates
Change of MFA method, phone number or email	High	Step-up verification and notification to the old and new channels
Candidate interviews and hiring	Fraudulent hires and proxy candidates	Identity verification before offer; see the Hiring Fraud and Candidate Identity Verification Guide

Small organisations: a manager video call plus a callback to a number on file, and a rule that the help desk never resets MFA for privileged users without a second person, closes most of the gap at no cost. A product becomes worthwhile when you have an outsourced service desk, many contractors, or remote staff across several countries. Large organisations: the deciding factors are integration with the IdP and ITSM, support for many document types and countries, and audit evidence for every reset.

Must-have capabilities

Help desk workflow integration: the agent sends a verification link from the ticket; the result returns to the ticket and the IdP; the agent never sees or handles the identity document. The agent should not be able to mark a user verified by hand.
Self-service recovery path: the same verification available to the user without calling anyone, which removes the phone call as an attack route.
Binding to an authoritative record: results matched to HR or contractor management data and, where possible, to a biometric or document captured at onboarding. A genuine passport belonging to someone other than the employee on record is a failure, not a pass.
Presentation and injection attack detection: independent testing to ISO/IEC 30107-3 for presentation attacks, plus detection of virtual cameras, emulators and manipulated media, which NIST SP 800-63A-4 requires for remote optical capture.
Risk-based routing: stronger checks for privileged users, out-of-hours requests, new devices, unusual geographies and repeated attempts.
Direct handoff to phishing-resistant enrolment: after verification, the user enrols a passkey or security key in the same session, rather than receiving a temporary password. See the Passkey account recovery.
Exception route with trusted referees: an attended video route for people without suitable documents, with trained agents and recorded sessions, as NIST expects for trusted referees.
Audit trail: who requested, which checks ran, results, agent identity, IdP actions taken, and notifications sent.
Privacy controls: minimal retention of document images and biometric data, configurable regions, and a lawful basis documented for employees, who often cannot freely consent.

Evaluation criteria

Area	What to test	Evidence to request
Attack resistance	Printed photo, screen replay, mask, face swap video, virtual camera injection, emulator	ISO/IEC 30107-3 test report from an accredited lab; injection test results
Accuracy on your workforce	False rejection rate across your staff population and document types	Pilot results; demographic performance data
Document coverage	Every country and document type your staff and contractors hold; NFC chip reading	Coverage list; chip verification support
Integration	IdP actions (reset, revoke sessions, enrol), ITSM ticket integration, HR sync	Live demonstration in your tenant
Time to verify	End-to-end time from ticket to new credential	Measured median and 90th percentile in pilot
Accessibility	Users with disabilities, no smartphone, no passport	Accessibility statement; alternative routes
Data protection	Retention, location, sub-processors, biometric template handling, deletion on leaving	Data processing agreement; DPIA support
Product security	How the vendor secures its admin console and API keys, and its own staff access to verification data	Security attestation; admin role model

Questions to ask vendors

Show us an injected deepfake video through a virtual camera during a remote verification. What happens, and what does the help desk agent see?
Which independent laboratory tested your presentation attack detection to ISO/IEC 30107-3, at which level, and when?
How do you match a verified person to our HR record, and what happens when names differ slightly?
Can a help desk agent override or skip verification? If so, how is that logged and alerted?
Which IdP actions can a successful verification trigger directly, and can you require a phishing-resistant enrolment as the next step?
How do you handle contractors who are not in our HR system and staff of an outsourced service desk?
Where are document images and face data stored, for how long, and are they used to train models?
What is the route for a user without a smartphone or without government ID?
How do you detect repeated verification attempts for the same identity from different devices?

Deployment and integration

Map every reset and recovery path: help desk phone, chat, email, walk-up, self-service portal, outsourced desk and IdP admin console. Each one needs a verification decision.
Classify users: standard, privileged, executive, contractor and service desk staff themselves. Set the method and approval rules per class.
Integrate in report-only mode: run verification alongside the current process for two to four weeks; agents still follow existing steps, and you measure pass rates, time and failures.
Switch privileged users first: require verification plus a second approver for any administrator reset. This protects the accounts attackers want most.
Extend to all users and remove knowledge questions: retire security questions and callback to numbers supplied on the call.
Connect onboarding: verify identity at hire and bind it to first credential issuance, so later recovery has something to match against.
Define the fallback: if the service is unavailable, a documented manual process with two people, a manager attestation and a time-limited, restricted account, never a silent bypass.

Detection and metrics: send verification events and IdP reset events to the SIEM and alert on a reset without a matching successful verification, MFA method changes followed by sign-in from a new device, and several failed verifications for one identity. Track: share of resets preceded by verification (target 100 percent for privileged users); verification failure and abandonment rates; median time from request to new credential; number of agent overrides; and share of users who complete recovery by self-service.

Framework mapping

Framework	Reference	How the product supports it
NIST SP 800-63A-4	IAL2 and IAL3, remote attended and unattended proofing, injection and forged media controls	Proofing and reverification at recovery
NIST SP 800-53 Rev. 5	IA-12 Identity Proofing; IA-5 Authenticator Management	Proofing before authenticator issue or reset
NIST CSF 2.0	PR.AA-02 identities proofed and bound to credentials	Verified binding of person to credential
ISO/IEC 27001:2022	A.5.16 Identity management; A.5.17 Authentication information	Controlled issue and reset of authentication information
MITRE ATT&CK	T1566.004 Spearphishing Voice; T1556.006 Multi-Factor Authentication; T1621 Multi-Factor Authentication Request Generation; T1199 Trusted Relationship	Blocks the help desk reset route and attacker MFA registration

Pitfalls

Leaving the outsourced desk out: in the Marks and Spencer cyberattack, attackers impersonated a third-party user, with reporting linking it to the contractor running the IT help desk. The verification product must be mandatory for third-party agents too.
Protecting standard users but not admins: in the MGM Resorts breach, a help desk call reportedly led to administrator access in the identity provider. Privileged resets need the strongest checks.
Verification without binding: checking that a document is genuine, but not that it belongs to the employee on record.
Temporary passwords after verification: handing out a password or SMS code re-opens the attack. Move straight to a phishing-resistant enrolment.
Agent override with no alert: the busiest agent will use it, and so will an attacker who persuades them.
Ignoring privacy law for employee biometrics: consent is rarely free in employment; plan the lawful basis and retention before rollout.

Red flags

No independent presentation attack test report, or one that is several years old.
No answer on injection attacks and virtual cameras.
Knowledge questions offered as a verification method.
Agent can mark users verified manually without logging.
Indefinite retention of document images and face data by default.
No integration that triggers IdP actions; results only shown on screen to the agent.

Proof of concept

Choose two populations: a group of permanent staff across several countries and a group of contractors.
Run the full journey from help desk ticket to verified identity to new passkey enrolment, and time it.
Run attack tests with your red team or an accredited tester: replayed video, face swap, virtual camera, stolen genuine document of another person, and a social engineering call asking the agent to skip the step.
Measure false rejections and abandonment on genuine users, including those without smartphones.
Confirm events reach the SIEM and that a reset without verification raises an alert.
Complete a data protection impact assessment with the vendor's actual data flows.

Buyer checklist

All reset and recovery paths, including outsourced desks, inventoried.
Verification method set per user class, with stronger rules for privileged users.
Knowledge-based questions retired.
Presentation and injection attack evidence reviewed.
Verification bound to HR or contractor records and onboarding enrolment.
Successful verification leads directly to phishing-resistant enrolment.
Agent overrides logged and alerted.
Verification and reset events correlated in the SIEM.
Fallback process defined for service outage.
Data protection impact assessment completed.

Standards and references

How NHI Mgmt Group can help

We provide independent identity security advisory, including help desk recovery design and verification product evaluation. Browse vendors in our products directory or contact us.

Workforce and Help Desk Identity Verification Buyer’s Guide: Choosing verification that stops help desk impersonation