Password reset verification
The reset takes ten seconds. Knowing who asked is the job.
A password reset is the most routine request a help desk handles and the most valuable thing it gives away. The control that matters is not how quickly you can reset it — it is whether you can say, afterwards, who you handed the account to.
Caller ID is not identity
A number can be spoofed, an internal directory can be read out of a breach, and a colleague's name is not a secret. Certra checks the caller against the factors held on that contact — a registered mobile, an email domain they control, a passphrase — and shows each result as it lands, so the engineer is looking at evidence rather than an impression.
The self-service gap
Self-service resets cover the users who can still reach their second factor. The calls that get through to a human are the ones where something has already gone wrong: a lost phone, a locked account, a new starter. That is precisely the population an attacker imitates, which is why the human path needs the stronger check, not the weaker one.
A reset you can account for
The factors tested, the rating, the approver where one was needed and the engineer who performed the reset are written against the ticket and cannot be edited afterwards. If a client asks who reset their finance director's password last March, the answer is a record rather than a recollection.
In short
What you get
Checked against known channels
Registered mobile, email domain and passphrase, tested in the ticket.
Sensitive resets hold
High-value accounts route to a named approver before the reset runs.
Recorded, not remembered
Who asked, what matched and who authorised it — kept immutably.
Questions
Frequently asked
How should a help desk verify a caller before resetting a password?
Against factors held in advance on the contact record — typically a code to a registered mobile, control of a known email domain, and a passphrase agreed with the client — rather than knowledge an attacker could research, such as a date of birth or a manager's name. Certra runs those checks inside the ticket and records the result.
What about a caller who has lost their phone?
That is the case worth designing for, because it is the one attackers claim. Certra falls back to the remaining factors and, where the account requires it, routes the reset to a named approver at the client rather than leaving the decision to the engineer on the call.
Does this replace self-service password reset?
No — the two complement each other. Self-service handles users who still hold their factors; Certra covers the calls that reach a person, which are the higher-risk ones.
Know who you’re really talking to, before you act.
Thirty minutes, using one of your real client accounts. We’ll set up its verification flow and run a live check with you.