New: Account Recovery+ for Entra ID Read Now

Blog

Working notes on account takeover, help desk social engineering, deepfake fraud and identity verification, written for the security and IT teams who handle account recovery.

84 pieces Latest November 12, 2026

Blog
Agentic Account Opening: How to Verify the Person Behind the AI Agent

An AI agent can complete an application flawlessly. It cannot be the person on the ID, so the check has to reach the human.

November 12, 2026
Blog
Loyalty Accounts Are Worth Taking Over. Verify the Call That Can Hand One Over.

Sift reported a 56% year-over-year rise in attacks on travel and ticketing platforms in its Q3 2025 index, and described the targets as "accounts…

November 10, 2026
Blog
What Should Replace Security Questions for Self-Service Password Reset?

Microsoft retires security questions for Entra self-service password reset in March 2027. Here is what replaces them, how to find the users who rely…

Ori Eisen November 5, 2026
Blog
Help Desk Caller Verification: A Procedure for Password and MFA Resets

A written procedure for the moment a caller asks your help desk for a password or MFA reset, with four caller tiers and ten…

Ori Eisen November 5, 2026
Blog
AI Agent Liability for Banks: What Shows the Customer Authorized the Agent?

JPMorgan's CEO said customers who use outside AI agents should understand there's a "liability transfer." In Trusona's view, a transfer like that should rest…

November 5, 2026
Blog
How Banks Can Let Customers’ AI Agents In: Verify the Person Who Authorized the Agent

JPMorgan told CNBC in October that it blocks outside AI agents from acting on retail customers' accounts. The alternative lets any agent in on…

November 3, 2026
Blog
Verify the Caller Without Leaving the Ticket

CISA's Scattered Spider advisory describes callers who talked IT help desk staff into resetting passwords and moving MFA to a device the caller controlled.…

October 27, 2026
Blog
The Caller Had the Last Four of the SSN. Then Came the Broken Phone.

HHS's Health Sector Cybersecurity Coordination Center (HC3) describes a caller who passed a healthcare help desk's identity check with an SSN's last four digits…

October 20, 2026
Blog
Cybersecurity Awareness Month Says Verify the Caller. At the Help Desk, That’s Harder.

CISA's 2026 Cybersecurity Awareness Month materials tell people to verify an unexpected call through a phone number they already have. At a help desk,…

October 6, 2026
Blog
TfL made 28,000 employees show up in person to reset a password

When TfL's network was compromised, the way out was 28,000 employees showing up at an office in person. ATO Protect Account Recovery+ for Entra…

September 16, 2026

Browse other categories

trusona icon
Powered by  GDPR Cookie Compliance (opens in a new tab)
Privacy Overview

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.