What is an MFA reset?
An MFA reset removes a person's enrolled sign-in factors, such as an authenticator app or security key, so they can set up new ones after losing them.
Last updated 29 October 2026
Why MFA resets attract attackers
A reset removes the protection MFA adds, so attackers try to get one. A joint advisory from CISA, the FBI and partner agencies describes the Scattered Spider group calling IT help desks while posing as employees, to get passwords reset and MFA moved to a device they control, then taking over the account.
A safer reset
- Confirm who is asking with something an attacker can't easily copy. A name and a typed-in email address aren't enough.
- Decide in advance which resets need an approver, for example for admin accounts.
- Tell the person after every reset, so a fraudulent one is spotted quickly. NIST's guidelines say every account recovery triggers a notification.
- Encourage everyone to set up a second factor in advance, so losing one device doesn't need a reset at all. NIST recommends at least two separate ways to authenticate.
- Record every reset: who asked, how they were verified and what changed.
MFA reset or password reset?
A password reset replaces something the person knows. An MFA reset removes the second factor, such as the app or security key, and they set up a new one. Someone who is locked out may need one or both.
See how BeforeQuery's AI employees do this work, with a person approving anything that matters.
Book a demoQuestions
Can people reset their own MFA?
If they still have another factor set up, they can sign in with it and add a new one without a reset. If they've lost every factor, an admin or the help desk has to reset MFA after confirming who they are.
Is an MFA reset risky?
Only if the identity check is weak. Attackers have talked help desks into resetting MFA and then taken over the accounts, so the check matters more than the reset itself.
How does BeforeQuery handle MFA resets?
The AI ITSM Agent only acts on a Slack account linked to the person in your identity provider, then resets the MFA factor in Okta and records it. If the link can't be confirmed, the request goes to your IT team.
Hire your first AI employee
The AI Marketer is ready today, free to start. For your other teams, tell us which one needs an AI employee and we'll show you how it works with your tools.