Close the help desk door

Your help desk resets passwords and moves MFA for anyone who sounds right on the phone.

Callers posing as staff talked help desks into resets at MGM and Marks & Spencer. MGM put its impact near $100M; M&S estimated about £300M before insurance. The group behind those attacks also uses SIM swaps.

The usual fix is a callback to the number on file. NIST's 2025 guidance (SP 800-63B-4) says to check for a SIM change or number port before trusting that number. Most desks have no way to see one.

How it works with your callback

Run the check, then call back the number on file. Proceed means the callback still reaches your employee's SIM. Step up means it may not, so the agent verifies on video or in person instead.

New phone this week? The agent sees Step up and uses your existing video or in-person check. Nobody gets locked out.

What you get

One question before every resetThe carrier says whether that SIM moved in the last 72 hours. Your desk proceeds or steps up.
Nothing to roll outIt runs in a browser. No change to your identity provider, no agent on any phone.
Evidence you can hand upEvery check leaves a signed receipt for the board, the auditor, or the insurer.

The signals

Reset checkWorking on test carrier access

Before a password reset or MFA move, asks the carrier whether the SIM on the employee's number changed in the last 72 hours.

Call forwarding checkBuilt, awaiting carrier

Built to tell you whether calls to the line are being forwarded somewhere else. Waiting on the carrier to switch it on.

Identity matchSandbox, US later this year

Compares what a person says (name, birthdate, zip) with what their carrier holds, and returns match or no match per field. Nothing comes back but the answer.

See the agent page

Run it on 5 employees' phones for 30 days.

  1. 15-minute setup call: consents, numbers, access key.
  2. Your agents run the check on every covered reset.
  3. Day 30: a readout of every check, then you decide.
Request a pilot

The pilot is free. After day 30, plans are priced per protected employee, agreed with you then.

William Haynes
Founder of Mobile Security Guru (working across telecom, mobility, enterprise sales, and cybersecurity since 2006).