Passkeys don't help if the help desk can reset them - Sumsub Exec on new ID checks
Sumsub Adds Biometric Checks to Enterprise Account-Recovery Workflows
Enterprise IT teams can require employees to complete a live identity-document and biometric liveness check before a password reset, privilege change or other high-risk access request is approved under a new Sumsub product.
The identity-verification company on Sept. 15 introduced Workforce Verification, a service designed to integrate with identity and access management and human-resources platforms. Sumsub said the product is intended to address a security gap in account recovery, where help-desk processes can be exploited through social engineering even when organizations use passkeys or multifactor authentication.
The system initially verifies a new employee’s government-issued identification during onboarding, Sumsub said. It can then initiate additional checks when an existing IAM platform identifies risk signals, including a password reset, suspicious login attempt or request for elevated account privileges.
The verification process combines biometric liveness testing with passive risk signals, according to the company. Sumsub also said the offering can incorporate background screening and document checks intended to validate employment histories and credentials.
“[A] valid credential only proves possession, not identity,” Andrew Novoselsky, Sumsub’s chief product officer, said in a statement. He said the product is designed to add identity checks at higher-risk points without requiring companies to replace current IAM infrastructure.
The release comes as organizations face more social-engineering attacks aimed at IT support and account-recovery functions. Sumsub cited Gartner research identifying help-desk account recovery as a major driver of enterprise interest in workforce verification. Gartner also projects that 30% of enterprises will distrust standalone face-biometric verification by 2026 because of AI-enabled spoofing risks, according to Sumsub.
Sumsub said its deepfake-detection technology has efficiency of up to 99.98%, though the company did not provide testing methodology or independent validation details.