Before you reset a password or move MFA to a new phone, check whether the SIM on the employee's number on file changed recently. A callback only proves something if that SIM hasn't moved.