Topic starter
26/08/2026 8:34 am
TL;DR: Help desk password resets cost about $70 per call, but Trusona’s analysis shows the bigger issue is that the same verification flow can be used by impersonators who know the answers, turning a routine support transaction into an account takeover path. The real problem is broken identity assurance at the moment of reset, not help desk efficiency.
Editorial analysis by NHI Mgmt Group, based on content published by Trusona: “The $70 Call: A Help Desk Story About the Math We Ignore”.
Key questions
Q: What breaks when help desk reset verification relies on questions attackers can research?
A: The control stops proving identity and starts proving that the caller can find public facts.
Q: Why do help desk password resets create account takeover risk?
A: Because the reset is the point where access changes hands.
Q: How do organisations know if help desk identity verification is actually working?
A: Look for evidence that the workflow requires possession of a separately verified factor, not just verbal answers.
Practitioner guidance
- Replace knowledge-based reset checks Use an out-of-band verification method for password resets and MFA changes so the help desk is not relying on answers an attacker can research or infer.
- Map every reset request to identity assurance Classify password resets and account recovery as identity events with security impact, then define what proof is required before a credential can be changed.
- Review weekend and after-hours reset procedures Compare the reset workflow used outside normal staffing hours with the daytime process and remove any lighter verification path that gives attackers an easier target.
Bottom line: Help desk password resets are not merely a support cost, because a weak verification step can hand attackers control of the account through a normal business process.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
26/08/2026 8:35 am
Help desk verification has become a high-risk identity assurance point, not a support convenience. The control was built for a world where the attacker would not know enough to impersonate the caller convincingly. That assumption no longer holds because public data and AI-assisted impersonation make knowledge-based checks fragile. The implication is that account recovery must be treated as an access governance control, not an administrative task.
A few things that frame the scale:
- According to Forrester Research, a single password reset can cost around $70.
A question worth separating out:
Q: Should organisations use out-of-band verification for account recovery?
A: Yes, when a reset can lead to account takeover or privileged access. Out-of-band verification changes the trust model by tying the request to an enrolled device rather than to knowledge the attacker can gather elsewhere. That makes it materially harder for impersonators to complete the reset, while improving the experience for legitimate users.
👉 Read our full editorial: Help desk identity verification fails when attackers know the answers