The cost of one help‑desk reset
Forrester estimates a single help desk password reset costs about $70, and Gartner estimates 20% to 50% of help desk calls are password resets.
Source: Forrester and Gartner estimates- Platform
- Vouched Assure
- Account recovery
Vouched Assure: account recovery
Get back in when the factor is gone.
When a phone is lost, an email is compromised or an authenticator is gone, Vouched Assure lets the real account owner re-prove who they are with a live selfie, not a call to the help desk. The person who gets back in is the person who signed up.
Why it matters
The factor you’d use to recover is the one that’s gone.
Recovery is where account takeovers happen, because it’s the moment every other control has to step aside.
Codes go to what was lost
A reset code sent to a lost phone or a compromised email reaches the wrong person, or no one.
The help desk can be talked around
Recovery through a human help desk is the most socially engineered route into an account.
Questions can be researched
Answers to security questions are often findable, guessable or for sale.
The cost of a help‑desk recovery
Recovery is where the expensive calls happen.
When someone is locked out, the fallback is usually a person on the phone. That’s exactly the conversation attackers rehearse. These are the reported numbers.
Damages Clorox alleges after recovery calls
Clorox alleges attackers called its outsourced service desk, were given passwords and had the phone number for SMS MFA changed, and is seeking $380 million. Cognizant disputes the claims.
Source: Clorox v. Cognizant, filed July 2025M&S’s estimated hit after a password reset
Marks & Spencer’s chairman said attackers tricked a third party into resetting an employee’s password. M&S estimated a £300 million (about $400 million) hit to operating profit before insurance.
Source: Marks & Spencer, 2025Voice phishing, the phone-based social engineering that targets help desks, is now the second most common way attackers get in, at 11% of intrusions, ahead of email phishing at 6%. Source: Mandiant M-Trends 2026
How it works
Recovery that proves the person, not the device.
Recovery is requested
The person says they can’t get in: a new phone, a lost authenticator or an email they no longer control.
They take a live selfie
On whatever device they have now, guided so the first attempt works.
Liveness and match
Vouched confirms a live person is present and matches them to the identity established when they enrolled.
Access is restored
A clear decision, verified, review or rejected, with every check behind it, so your flow can restore access or route for review.
What you get
Built for the moment someone is locked out.
Liveness on every selfie
Photos, screens, recordings and deepfakes can’t stand in for the account owner.
Matched to enrollment
The selfie is compared with the identity the person established at sign-up with Vouched Verify.
IAL2 identity proofing Optional
For the highest assurance, a separate IAL2 workflow re-proves the person with a government-issued ID and a live selfie matched to it. Vouched enables it for your account, and it’s documented in the IAL2 guide.
Any device
Device agnostic, with a branded desktop-to-phone handoff when someone starts on a computer.
Your brand
White-labeled, in 15 built-in languages, so recovery looks like the rest of your product.
Your rules
Choose when recovery routes to review, and what happens on each decision.
Where it’s used
Built for the industries fraudsters target first.
Health systems
Patients locked out of their portal recover access themselves, without calling the help desk.
Health systems →Telehealth
Patients who change phones between visits get back in before their appointment, not after it.
Telehealth →Financial services
Customers regain access to their accounts without opening a door for account takeover.
Financial services →FAQ
Account recovery, answered.
Straight answers about account recovery with Vouched Assure.
Contact us with a questionWhat is account recovery with identity verification?
It lets someone regain access to an account by proving who they are, rather than by receiving a code on a phone or email they may have lost. With Vouched Assure, the person takes a live selfie that’s checked for liveness and matched to the identity they established when they enrolled.
Why are SMS and email recovery codes risky?
They depend on the person still controlling the phone number or inbox. When that phone is lost, the number has been moved or the inbox is compromised, the code proves nothing about who is asking for access.
How much can help desk account recovery cost?
A legitimate help desk reset costs about $70 by Forrester’s estimate, but recovery handed to the wrong caller can cost far more. Clorox alleges attackers who called its outsourced service desk were given passwords and had an MFA phone number changed, and is seeking $380 million. Marks & Spencer estimated a £300 million hit to operating profit in 2025 after attackers tricked a third party into resetting an employee’s password.
Why is help desk account recovery a security risk?
Recovery through a human help desk is the most socially engineered route into an account: a convincing caller can talk an agent into restoring access. Self-service recovery that re-proves the person removes that route.
What does the user need to recover their account?
A device with a camera. They take a live selfie on whatever phone or computer they have now; they don’t need the lost phone, the old email or the missing authenticator.
How does Vouched know it’s the same person?
Vouched checks the selfie for liveness, so a photo, screen, recording or deepfake can’t pass, then matches it to the identity the person established at enrollment with Vouched Verify.
What if someone was never verified with Vouched?
Pair Assure with Vouched Verify to establish identity with a digital or government-issued ID and a live selfie, so there’s a verified identity to recover against.
Can account recovery meet NIST IAL2?
Yes, as an option. Vouched has Kantara Initiative Ready to Operate approval for NIST SP 800-63A Identity Assurance Level 2 (IAL2). For recovery that must meet IAL2, Vouched can enable an IAL2 workflow on your account, which re-proves the person with a government-issued ID and a live selfie matched to it. It’s separate from the standard recovery flow, where a selfie is matched to the enrolled identity. See the IAL2 guide in the API docs.
Can account recovery be white-labeled?
Yes. Recovery runs on Vouched’s white-label options, so colors, fonts, copy and images match your product, in 15 built-in languages.
What happens if the selfie doesn’t match?
Vouched returns a review or rejected decision with the checks behind it, and your workflow decides what happens next, such as routing to a review team instead of restoring access.
How do I add account recovery to my product?
Talk to sales to set up an account recovery workflow. If you already use Vouched Verify, recovery builds on the identities you’ve established.