MFA & token resets
An MFA reset removes the last control. Treat it that way.
Multi-factor authentication is the control most organisations lean on hardest. The help desk is the one place it can be switched off with a phone call — which is why a convincing caller asking to re-enrol a token is the most valuable ten minutes an attacker can spend.
The reset is the attack, not the breach after it
An attacker who reaches your desk does not need a vulnerability. They need an engineer who believes them for long enough to re-enrol a token on a device they control. The notable help desk intrusions of recent years have run through that step, and none of them needed malware to do it.
Higher stakes, higher threshold
Certra treats MFA and token re-enrolment as a class of its own. The caller verifies against their known channels, the request is rated, and re-enrolment holds for a named approver at the client — regardless of who the caller says they are or how urgent they sound. Seniority is a reason for more scrutiny, not less.
A record that survives the incident
When a reset is questioned later, the useful artefact is a trail nobody can tidy up. Certra records the factors tested, the outcome, the approver and the time against the ticket, and the entry cannot be edited or deleted. That is what turns an incident review from an argument into a reading exercise.
In short
What you get
Its own threshold
Token re-enrolment is gated separately from ordinary resets.
Seniority raises the bar
An executive request holds for an approver rather than skipping one.
Immutable evidence
The factors, the decision and the approver, kept as written.
Questions
Frequently asked
Why is the MFA reset such a common attack path?
Because it is the one legitimate way to remove multi-factor authentication from an account, and it runs through people rather than software. An attacker who can convince a help desk to re-enrol a token on their own device inherits the account without touching a vulnerability.
How should a help desk handle an MFA reset request?
Verify the caller against factors registered in advance, treat re-enrolment as more sensitive than a password reset, and require sign-off from a named approver at the client for privileged accounts. Certra applies those rules as configuration rather than relying on the engineer to remember them under pressure.
What if the request is genuinely urgent?
Urgency is the pressure every social engineering attempt applies, so it cannot be the thing that lowers the bar. The approver route is built to be fast — a named person on the account, notified immediately — so a legitimate urgent request resolves in minutes and an illegitimate one stops.
Know who you’re really talking to, before you act.
Thirty minutes, using one of your real client accounts. We’ll set up its verification flow and run a live check with you.