Use case: Reset a password
Password resets that can’t be talked around.
Replace help desk calls, security questions and SMS codes with a live selfie matched to the identity on file. Users reset their own password and MFA in under a minute, and attackers have no one to persuade.
The problem
Every reset is a door someone can be talked through.
Help desks reset passwords for whoever sounds convincing, and the questions meant to stop attackers stop real users instead.
Cost
$70Estimated cost of one help desk password reset
Volume
20–50%Of help desk calls are password resets
Attackers
92%Passed knowledge-based questions, against 46% of genuine customers
ID proofing
No KBVAllowed for identity verification under NIST SP 800-63A-4
One reset can cost a business. Marks & Spencer estimated a £300 million hit to operating profit in 2025 after attackers tricked a third party into resetting an employee’s password.
Sources: Forrester and Gartner, via TechTarget · Pindrop, 2022 · NIST SP 800-63A-4, via Verdocs · Marks & Spencer, 2025
How it works
Reset by selfie, not by conversation.
The person proves they’re the account owner with their face, then resets their own password and MFA. No agent, no questions, no code to intercept.
- 1
Request
The user taps “Forgot password” in your app, portal or workforce sign-in.
- 2
Re-prove
They take a live selfie. Liveness detection blocks photos, screens, recordings and deepfakes.
- 3
Match
Vouched matches the selfie to the identity they enrolled with and returns a decision in seconds.
- 4
Reset
On a match, they set a new password and re-enroll MFA themselves, and every reset is logged for audit.
Users who’ve never verified do it once with a government ID or mobile driver’s license and a live selfie, then reset. That verified identity covers every future reset.
Compared
How password reset methods hold up.
Most reset methods prove something the user has or knows. Only a live selfie proves who they are.
| Reset method | Proves the person | Resists social engineering | Survives a lost phone | Typical experience |
|---|---|---|---|---|
| Security questions | NoAnswers can be guessed or bought | No | Yes | Answers to recall, often wrong |
| SMS or email code | NoProves access to a device or inbox | PartlyCodes can be phished | NoLost or SIM-swapped phone | Seconds, if the phone is in hand |
| Help desk call | PartlyDepends on the agent | NoCallers can talk their way in | Yes | A queue and a conversation |
| Vouched selfie reset | YesLive face matched to enrolled identity | YesNo one to persuade | YesAny device with a camera | Under 60 seconds |
Typical experience for the Vouched selfie reset is Vouched product data.
Who it’s for
Wherever passwords get forgotten.
The same reset flow works for customers, patients and employees, in your app or your workforce sign-in.
Built on
One platform behind every reset.
Reset a password uses the same verified identity as every other Vouched workflow.
The proof
Fast enough to replace the call.
Users finish on the first try, so the help desk stops being the fallback.
Completion
97%First-attempt completion
Speed
< 60 secAverage verification time
Accuracy
99%ID document authentication accuracy
Source: Vouched product data
Related use cases
Other jobs Vouched does.
Each use case runs on the same verified identity, so one integration covers them all.
Trust
Built for the security review.
Everything your security review asks for, from the SOC 2 report to the BAA, is on one page.
Visit the Trust CenterFAQ
Password reset, answered.
Straight answers about self-service password reset.
Contact us with a questionHow can users reset a password without calling the help desk?
With a selfie. The user takes a live selfie, Vouched checks it for liveness and matches it to the identity they enrolled with, and on a match they set a new password and re-enroll MFA themselves.
Why aren’t security questions enough?
The answers can be guessed or bought from breached data. In one contact-center study, 92% of fraudsters passed knowledge-based questions while only 46% of genuine customers did, and NIST SP 800-63A-4 no longer allows knowledge-based verification for identity verification.
Isn’t an SMS or email code enough?
A code proves access to a phone or inbox, not who the person is. Codes can be phished, phones can be lost or SIM-swapped, and a reset is often needed precisely because the user has lost that device.
What does a help desk password reset cost?
Forrester estimates about $70 per reset, and Gartner estimates 20% to 50% of help desk calls are password resets. The bigger cost is a reset given to the wrong caller: Marks & Spencer estimated a £300 million hit after attackers tricked a third party into resetting an employee’s password.
What if the user has never verified their identity?
They verify once with a government ID or mobile driver’s license and a live selfie, then reset. That verified identity is reused for every future reset.
Does it reset MFA too?
Yes. After a successful match, the user can set a new password and re-enroll MFA, so losing a phone doesn’t mean losing the account.
How long does a selfie reset take?
Average verification takes under 60 seconds, and 97% of users complete it on their first attempt.
Does it work for employees as well as customers?
Yes. The same flow works in customer apps, patient portals and workforce sign-in, and hands control back to your identity provider after the match.