Show how you verified the caller

Your assessor will ask how the help desk confirms identity before it resets an authenticator.

Most teams answer with a policy and a ticket note. Neither shows what was checked at the moment of the reset.

In February 2026, New York's financial regulator told firms to stop relying on caller ID and to confirm identity before any credential reset. Personal questions lean on facts that already leaked, and a callback leans on a number that can move without the owner knowing.

How it works with your callback

Run the check, then call back the number on file. Proceed means the callback still reaches your employee's SIM. Step up means it may not, so the agent verifies on video or in person instead.

New phone this week? The agent sees Step up and uses your existing video or in-person check. Nobody gets locked out.

What you get

A record per resetEach check produces a signed receipt: decision, time, ticket, agent. An auditor can confirm it wasn't edited.
Least data possibleThe number goes through Vonage to the carrier for one yes or no answer. The receipt keeps the last four digits; the service stores nothing, and your team keeps the log under your own retention rules.
Consent built inThe pilot covers employees who agreed in writing, with a one-line consent you can file.

The signals

Reset checkWorking on test carrier access

Before a password reset or MFA move, asks the carrier whether the SIM on the employee's number changed in the last 72 hours.

Identity matchSandbox, US later this year

Compares what a person says (name, birthdate, zip) with what their carrier holds, and returns match or no match per field. Nothing comes back but the answer.

Call forwarding checkBuilt, awaiting carrier

Built to tell you whether calls to the line are being forwarded somewhere else. Waiting on the carrier to switch it on.

See the agent page

Pilot it for 30 days and keep the receipts as evidence.

  1. 15-minute setup call: consents, numbers, access key.
  2. Your agents run the check on every covered reset.
  3. Day 30: a readout of every check, then you decide.
Request a pilot

The pilot is free. After day 30, plans are priced per protected employee, agreed with you then.

William Haynes
Founder of Mobile Security Guru (working across telecom, mobility, enterprise sales, and cybersecurity since 2006).