Cite as: Real Problem AI problem “How does a help desk verify a caller before resetting MFA when nobody can vouch for them?”. Opportunity score 7.4 out of 10 (severity 9, AI feasibility 7, market signal 7, competition gap 6). Category AI / Agents. Trend Agents. Source signal: Ask HN "How does your help desk verify someone before resetting MFA?", 21 October 2026.. Canonical URL: https://www.realproblem.ai/idea/how-does-a-help-desk-verify-a-caller-before-resetting-mfa.
How does a help desk verify a caller before resetting MFA when nobody can vouch for them?
Attackers now phone the IT help desk pretending to be a remote employee or contractor and talk an agent into resetting their MFA, and the agent has no reliable way to tell the real person from a convincing caller.
Who has it: IT help desk and service desk leads at companies with remote staff and contractors, and the security teams who own identity and MFA policy.
- Severity9/10
- Feasible today7/10
- Market signal7/10
- Competition gap6/10
Heard in public
“Seeing more breaches start with a convincing call to the help desk.”
Quoted word for word from the public post linked below. Nobody submitted it to Real Problem AI.
Ask HN "How does your help desk verify someone before resetting MFA?", 21 October 2026.What nothing does yet
A verification step built into the help desk ticket itself: the agent sends a one-time check to a device or ID the person already enrolled, sees a clear pass or fail with deepfake and voice-clone signals, and cannot reset MFA until it passes, with a full audit trail for the security team.
Tools that solve this
3 named so far, and where each one stops.
- Security questions and callbacks to the number on file
Easy to beat when the attacker already holds the employee's personal data or has swapped the SIM.
- Manager approval
Slow, and does not work for contractors or staff whose manager cannot see them.
- Identity verification vendors (ID document plus selfie)
Strong, but often not wired into the help desk ticket flow, so agents skip it under time pressure.
How you might build it
- 01Help desk integrations (ServiceNow, Jira, Zendesk)
- 02Identity provider APIs (Okta, Entra ID)
- 03Document and liveness checks
- 04Voice clone detection
- 05Audit logging
#NOV64 · Canonical URL: https://www.realproblem.ai/idea/how-does-a-help-desk-verify-a-caller-before-resetting-mfa