Seeing more breaches start with a convincing call to the help desk. Curious what actually works for remote staff and contractors, where nobody can vouch for the caller.
We ask them to "see the funny" https://youtu.be/HlEJbs02wAM?is=Froy84IL8G_00ulS
Sorry, I couldn't resist.
Security Question and Knowledge Checks are too easy to find nowadays. Caller ID, voices, and even faces get cloned now too. We have been mainly using MFA checks but also experimenting with ID + selfie, or just facial matches for remote workers.