OLLET

White papers

Your MFA has a reset button. Attackers found it

Your sign-in demands two factors. But your credential reset relies on just one, or on circumstantial evidence. Put an instant passport check in your employee’s pocket - a live face matched to a digitally signed ID that AI can’t fake.

Salil Prabhakar, IEEE Fellow · Co-founder and CEO, Ollet (OptiML Vision Inc.) · salil@ollet.id · October 2026

Attackers aren’t breaking in. They’re impersonating your employees

Palo Alto Networks traces 65% of attackers’ initial access to identity-based techniques [1]. IBM found deepfakes behind 45% of AI-driven breaches, and social-engineering breaches averaging $5.23M [2].

$100M+ losses are public. So is the playbook

Clorox is suing its help-desk vendor for $380M, quoting an agent: “So let me provide the password to you ok?” [3] Marks & Spencer put the cost at £300M [4], MGM at $100M [5]. All three were attributed to Scattered Spider. FBI and CISA documented its playbook: pose as an employee, get a help-desk reset, move MFA to an attacker device [6].

Your MFA isn’t broken. There are two ways to reset it

Your reset works as designed, so no vulnerability scan flags it. Remote work and breached data made it the weakest link. Even passkeys fall back to reset if a device is reported lost. A stolen company laptop plus a reset passes as the employee.

At the help desk, the evidence is circumstantial: an employee ID, a manager’s name, an SSN or a phone number. Each can be learned or taken over. An attacker who SIM-swaps a manager’s number approves his own reset.

Self-service reset is the same failure without a human. If it exists, you don’t have two independent factors. You have one, and a documented way to replace the other using the first. It can be scripted against a list, unnoticed.

NIST, Microsoft, Okta and Ping agree: reset needs identity verification (IDV)

NIST SP 800-63: a lost factor can’t be replaced on the strength of the one left. It requires identity proofing [7]. Microsoft, after an attacker’s call hit business apps in 16 minutes, says to verify identity before any credential reset [8]. Okta warns that MFA alone can’t keep up with deepfakes and social engineering [9]. Ping and Deloitte agree [10].

The market’s answer: upload-based IDV, borrowed from consumer sign-ups

Okta and Microsoft list IDV partners for recovery; Persona, CLEAR, Jumio, Onfido and LexisNexis are on both lists [9] [11]. Ping and RSA sell their own IDV, built on an uploaded photo of a government ID checked by their subprocessors [12] [13].

Upload-based IDV began in banking. KYC rules require verifying remote strangers and keeping records for 5 years [14]. So the method became: upload ID and selfie images to a server, check both for forgery, match the faces, store them. It is tuned for conversion: a rejected customer is lost revenue. Workforce vendors changed the buyer, not the method.

Upload-based IDV is the wrong tool for reset: photos get faked and leaked

DHS tested seven ID document validation systems on its own lab’s fakes. Six failed [15]. Fakes keep getting better. IDScan.net, one such provider, exposed driver’s license images of 153M+ people [16]. Leaked IDs seed new fakes. Revolut, a fintech keeping such records, handed passport scans and KYC selfies to a fake government request [17].

In KYC, a false accept is a compliance lapse that other controls can still catch. At reset, it hands over the account. Workforce reset asks a different question: is this the employee on record? Keep upload-based IDV where it was built.

Put a passport check on your reset button

The right tool is on-device IDV: a live face matched to a digitally signed ID, on the phone

  • A signed ID, not a photo. The live person must match a portrait bound to the ID by a trusted authority’s signature. Otherwise, the cheapest attack is a leaked genuine ID with the portrait swapped. DHS calls mobile driver’s licenses (mDLs) more secure than ID photos [18], but mDL standards leave the portrait match to the verifier [19].
  • On the device, not uploaded. You should be able to verify that the check ran on the user’s attested device, with auditable proof. Uploading to a vendor cloud for matching creates a new store of identity material.

Ollet is fully on-device IDV. Set up in two minutes. Verify instantly

  • Setup, once. Employees add a digitally signed ID, such as a passport, to the Ollet app, which checks its signature.
  • Each verification. They scan a QR code or tap a link and look at their phone. Liveness and matching to the ID’s single, low-quality photo run at 30 frames a second, improving speed and accuracy.
  • The result. A single-use proof signed by the attested phone’s hardware key, checkable against the manufacturer’s certificate chain. No document or biometric leaves the device. Patented [20].

No one is worse off. The fallback becomes a tripwire

Keep your IdP, MFA and KYC vendor. Keep today’s path for users without a digitally signed ID or supported phone. Once most users verify with Ollet, the old path becomes an anomaly: route it to closer review, not routine approval.

Add Ollet from the Okta Integration Network. No development needed

Ollet is listed in the Okta Integration Network. Your team adds it with a client ID and secret. Require it in the account management policy: new authenticators, password reset, unlock, recovery phone or email. The Okta guide covers each step.

Okta’s policy covers self-service reset only. For a help-desk reset, the agent first gives a verification link or QR code. Our SDK puts the same check anywhere you need to know who stood behind an action, like deploying AI-written code. Each result is logged by the system that requested it: Okta’s System Log or the calling application, ready for a SIEM.

Try the demo. No signup needed.

References

  1. Palo Alto Networks, Unit 42 Incident Response Report, Feb 2026
  2. IBM, Cost of a Data Breach Report, Jul 2026
  3. CSO Online, Clorox sues Cognizant for $380M, Jul 2025
  4. The Record, M&S cyberattack to hit profits by £300M, May 2025
  5. BleepingComputer, MGM attack led to $100M loss, Oct 2023
  6. FBI, CISA and partners, Advisory AA23-320A, Jul 2025
  7. NIST, SP 800-63B Rev. 4, Authenticator Events, Jul 2025
  8. Microsoft Security, Passkey-themed social engineering, Sep 2026
  9. Okta, Identity Verification, accessed Oct 2026
  10. Ping Identity, Deloitte, Identity Trends 2026, accessed Oct 2026
  11. Microsoft, Entra Verified ID IDV partners, Jun 2026
  12. Ping Identity, Use Case Guide for PingOne Verify, Apr 2025
  13. RSA, Help Desk Live Verify announcement, Jun 2026
  14. FinCEN, Customer Identification Program rule, 31 CFR 1020.220
  15. DHS S&T, RIVR Document Validation Results, Feb 2026
  16. KrebsOnSecurity, Service Selling 153M+ Licenses, Sep 2026
  17. Forbes, Fake Government Request Leaks Passports, Sep 2026
  18. DHS S&T, Fighting Online Identity Fraud, Jun 2026
  19. AAMVA, mDL Implementation Guidelines v1.6, Jul 2026
  20. U.S. Patent 12,739,132, issued 15 Sep 2026