How does ATO Protect verify a caller before a password or MFA reset?

“Your help desk agent sends an identity verification to the caller's mobile device. The caller completes it there, outside the call, by scanning a government-issued ID. ATO Protect also checks for SIM swap and man-in-the-middle signals. In the example call shown on this page, a high-risk result ends the reset and the agent escalates to security.”