Identity verification
Identity verification establishes that a person is the rightful holder of a claimed identity; in NIST identity proofing, it links the applicant to the validated identity evidence they present.
Does the evidence belong to this person?
In NIST identity proofing, verification connects the applicant to the identity evidence they present. Checking that a document is genuine is validation; checking that the applicant is its rightful holder is verification.
Help desks also use “identity verification” to describe caller checks. That everyday use does not imply a particular NIST Identity Assurance Level.
Finding an account is easier than verifying a caller
A manager’s name or an employee number can help locate the account a caller is discussing. Treating those details as proof of identity is a different decision.
Mandiant documented UNC3944 using victims’ personal information, including manager names and dates of birth, to get past help-desk checks. The practical lesson is to examine what your procedure relies on: if an answer can be learned about the employee, a convincing answer may identify the account without identifying the caller.
Use the approved recovery process before replacing an authenticator. Record the check performed, rather than leaving only “identity verified” in the ticket.