Use case: Recover an account
Get the right person back in, and no one else.
When users lose a phone, an inbox or an authenticator, recovery is the easiest way into their account. Vouched lets them prove who they are with a live selfie, so the owner gets back in and impostors don’t.
The problem
Recovery is the weakest link in account security.
Strong logins don’t help if the fallback is a code to a lost phone, a guessable question or a persuadable agent.
Takeover
$15B+Lost to account takeover in 2025, the costliest identity fraud
SIM swap
$33MAwarded after a SIM swap let attackers take over a customer’s codes
KBA
92%Of fraudsters passed knowledge-based questions
IRS
724,000Taxpayer accounts accessed through knowledge-based questions
Recovery handed to the wrong caller. Clorox alleges attackers who called its outsourced service desk were given passwords and had an MFA phone number changed, and is seeking $380 million. Cognizant disputes the claims.
Sources: Javelin 2026 Identity Fraud Study · SecurityWeek, 2025 · Pindrop, 2022 · Nextgov, 2016 · CSO Online, 2025
How it works
Recovery by selfie, on any device.
The user proves who they are with their face, so a lost phone or inbox doesn’t mean a lost account.
- 1
Locked out
The user can’t sign in: lost phone, changed number, compromised inbox or missing authenticator.
- 2
Re-prove
They take a live selfie on any device with a camera, checked for liveness.
- 3
Match
Vouched matches it to the identity they enrolled with.
- 4
Restore
On a match, they regain access and enroll a new device or MFA method; every recovery is logged.
For NIST IAL2 assurance, add the optional Kantara-approved workflow, which adds phone and email checks and a DMV record check.
Compared
How account recovery methods hold up.
Most fallbacks depend on the very thing the user just lost.
| Reset method | Proves the person | Works after a lost phone | Resists takeover | Typical experience |
|---|---|---|---|---|
| SMS to recovery number | NoProves access to a number | NoThe phone is the thing lost | NoSIM swaps | Fast, if the phone is in hand |
| Email recovery link | NoProves access to an inbox | PartlyIf the inbox is still yours | PartlyInboxes get compromised | Fast, if the inbox is safe |
| Backup codes | NoProves possession of codes | PartlyIf they were saved | PartlyCodes can be stolen | Often lost or never saved |
| Help desk call | PartlyDepends on the agent | Yes | NoCallers can talk their way in | A queue and a conversation |
| Vouched selfie recovery | YesLive face matched to enrolled identity | YesAny device with a camera | YesNo one to persuade | Under 60 seconds |
Typical experience for Vouched selfie recovery is Vouched product data.
Who it’s for
Wherever users get locked out.
Customers, patients and employees all lose phones.
Built on
One identity, enrolled once.
Recovery reuses the identity verified at onboarding.
The proof
Fast enough to finish on the first try.
Users complete verification in one pass, so fewer fall back to a call or a branch.
Completion
97%First-attempt completion
Speed
< 60 secAverage verification time
Accuracy
99%ID document authentication accuracy
Source: Vouched product data
Related use cases
Other jobs Vouched does.
Each use case runs on the same verified identity, so one integration covers them all.
Trust
Built for the security review.
Everything your security review asks for, from the SOC 2 report to the BAA, is on one page.
Visit the Trust CenterFAQ
Account recovery, answered.
Straight answers about how Vouched helps you recover an account.
Contact us with a questionHow does selfie-based account recovery work?
The locked-out user takes a live selfie on any device with a camera. Vouched checks it for liveness and matches it to the identity they enrolled with, and on a match they regain access and enroll a new device.
What if the user has lost their phone?
That’s exactly the case it’s built for. Recovery works on any device with a camera, so a lost phone, changed number or missing authenticator doesn’t mean a lost account.
Why not recover accounts with SMS codes?
A code proves access to a phone number, not who the person is, and numbers can be SIM-swapped. In one case a court awarded $33 million after a SIM swap let attackers take over a customer’s codes.
Why not use security questions?
The answers can be guessed or bought. In 2015, fraudsters passed the IRS’s knowledge-based questions and accessed 724,000 taxpayer accounts.
Is the help desk still needed?
For edge cases, yes, but not for routine recovery. Selfie recovery removes the conversation attackers rely on to talk their way into accounts.
Can recovery meet NIST IAL2?
Yes. An optional Kantara-approved NIST SP 800-63A IAL2 workflow adds phone and email checks and a DMV record check.
How long does recovery take?
Average verification takes under 60 seconds, and 97% of users complete it on their first attempt.
What if the user never verified at sign-up?
They verify once with a government ID or mobile driver’s license and a live selfie, then recover. That identity covers every future recovery.