What should happen when the normal verification route is unavailable?
Use another explicitly approved route or escalate to a named decision owner. Keep the requested account change pending until the applicable requirements are met, and record the decision and handoff.
The caller has lost the phone used for verification. They know the employee’s name, manager, and project. They offer a new number for a callback. The agent needs an approved recovery route that works under that condition, before changing the account.
The Temporary Access Pass article explains what an incorrect recovery decision can authorize. The procedure below needs to be adapted to your organization’s approved identity-proofing requirements.
Start with the action, not the caller’s confidence
Classify the requested change and account category first. Removing an authenticator, issuing a TAP, changing a contact address, and restoring a privileged account need not use the same approval path. A convincing conversation does not supply that authority.
NIST distinguishes recovery and authenticator binding requirements by context and assurance level. Your identity team should select the applicable requirements for each account category. NIST SP 800-63B-4: account recovery
Decide before the reset
Template for an approved procedure
- Classify the change
Identify account category and applicable procedure. If no approved route is available, keep the change pending and use recovery or exception escalation.
Approved route available
- Complete the checks
Use the procedure’s trusted evidence source. Failed checks or missing authorization keep the change pending.
Checks pass and change is authorized
- Perform the approved change
Record scope, approver, and verification reference.
A new number supplied by the caller is not an independent verification source.
Choose the approved verification route
The procedure should identify the evidence source, who may evaluate it, and the exact change that a successful check permits. Public biographical facts can help an agent find the employee record, but finding the record is not proof that the caller controls the employee’s identity.
For a callback route, specify how the agent obtains the destination independently. Calling the new number supplied in the same disputed conversation proves reachability at that number. It does not independently connect the caller to the employee. If a contact detail needs changing, verify that change through its own approved process before using it as a trusted destination.
Give staff a fallback they can use
Tell the agent where to send a request they cannot verify. Name the queue or responsible role, what to record, and how the employee will hear back. Keep the account change pending until the required checks pass and the change is approved.
An exception can be valid, but it needs its own approval route. Do not let urgency silently substitute for a missing verification step. Record which exception was approved, by whom, and what limited action it permits.
Leave a record the next agent can follow
Complete this table for one recovery action before testing the workflow:
| Procedure element | What the guide must specify | Failure to look for |
|---|---|---|
Requested change |
Exact action and account category |
“Restore access” conceals several different changes |
Primary route |
Required checks and independent evidence source |
Caller-provided facts become the sole proof |
Unavailable route |
Approved alternative or escalation destination |
Agent invents a fallback under time pressure |
Contact change |
Separate authorization for the new destination |
New number immediately becomes trusted |
Decision record |
Check reference, approver, action, time |
Completed ticket cannot explain why the change was allowed |
Handoff |
Pending state, receiving role, next contact |
Request disappears into an unnamed escalation |
The record should contain references to the verification evidence, not copies of unnecessary identity documents or recovery secrets. The agent needs enough information to justify the decision without creating a second store of sensitive material.
Test the guide with paired scenarios
Use two fictional requests in an authorized exercise. In A, the legitimate employee can satisfy the approved route. In B, the normal route is unavailable and the requester offers a replacement number. Keep the requested change and account category constant.
For A, observe whether the agent completes the required checks and performs only the approved change. For B, observe whether the agent finds the approved fallback or keeps the change pending and reaches the designated escalation role. A secure guide must support legitimate recovery as well as resist an unsupported request.
If B fails because no recipient is listed, the remedy is a routing change. If the route exists but the agent cannot access the required record, the remedy is evidence access. If the agent substitutes caller-provided facts for the required check, examine training and procedure clarity. These are different findings with different retests.
Take one workflow to the next team review
Bring one procedure, one account category, and the two scenarios to the help-desk lead and identity team. Leave with an approved route and a named pending-state handoff. Then run the 90-minute recovery tabletop to test how that decision reaches identity responders and the application owner when recovery is disputed.
An editable copy of the procedure table is available for the help-desk review.
