A support desk often helps people when they are stressed or locked out. A caller may know a staff member’s name, manager, and recent work without being that person. Identity checks need a clear process that staff can follow without being pressured into improvising.
Understand the idea
Separate a convincing story from approved identity evidence. Decide how support verifies a caller, handles lost authentication methods, and escalates unusual requests. Use contact routes held in trusted records. A manager’s apparent urgency should not quietly replace the checks protecting an important account.
- Request
Understand the account change the caller wants.
- Verify
Use a trusted method independent of the caller’s new details.
- Change
Record the decision and apply only authorized access changes.
A practical example
Imagine a caller asking to reset an executive’s authentication before a flight. The agent follows the established verification route and records the request. When the caller cannot complete it, the agent escalates through the genuine contact chain rather than using a new phone number supplied during the call.
What to do next
- Identify the requested action and its risk: routine guidance, password reset, new factor, recovery change, or privileged access.
- Apply the approved verification method for that action using trusted records or registered channels.
- Do not replace a registered contact with a new one supplied by the same unverified caller and then treat it as verification.
- Escalate failed or exceptional checks to an authorized reviewer; record the reason and evidence.
- Notify the account owner through an established route and log the action and operator.
How to check the result
Test the process with support staff using an agreed exercise. Check that legitimate recovery works and that failed verification does not lead to an informal exception with greater access.
The caller lost their phone and wants a new MFA number immediately.
Follow the approved recovery process and escalation route. Verifying the caller with the same new number they just supplied does not establish their identity.
Sources and useful guides
The following resources provide background and more detailed guidance. Use the sections that match your service and situation.
