Identity Challenge Card
The Identity Challenge Card is a printed grid of word pairs — no phone, no app, no network. A worker reads back a one-time coordinate and their identity resolves locally: at the service desk, at login, and at a password reset.
- Every worker, every environment
- Deployed in under an hour
- No MDM, no app, no hardware
- Multilingual — RTL and CJK included
- Easy re-enrollment — no device pairing
Protecting the world’s workforce since 1997 • Over 15 Million Licenses Sold
Use Cases
Three Use Cases, One Printed Card
The same card covers the three moments a credential gets proven, replaced, or recovered — at the service desk, at login, and at reset. Play any explainer and follow the transcript as it speaks.
- Use Cases 01TranscriptTap a word to play from there
A help desk agent is deciding whether to trust a voice on the phone.
Instinct shouldn't be the deciding factor.
Texting a code to the caller's phone assumes the phone is theirs.
Not a device the attacker may already control.
The Identity Challenge Card changes the question.
The agent reads a coordinate down the line.
The caller reads the word back off a printed card.
And that value is spent.
The old script was a list of questions an attacker can research.
What's on that card isn't online or on a device.
Service desk leaders get a live identity check on every call.
Security and technology leaders get one that holds when the identity provider doesn't.
Avatier's Identity Challenge Card.
Verify the human, not the device.
Try it at identitychallengecard.avatier.com.
Verify the Human
Someone calls the service desk asking for their access back. The agent names a coordinate, the caller reads the answer off their printed card, and that value is spent — a live identity check that doesn't rely on a device the attacker may already control.
See it for the service desk - Use Cases 02TranscriptTap a word to play from there
This workstation had a different worker an hour ago.
The question isn't the password, it's which one of you this is.
Some sites sign in without a password, some keep the password and add a factor.
The card is the factor, either way.
Without a password, on shared workstations and virtual desktops, the factor isn't provisioned into the machine.
It's in the worker's pocket.
Keep the password and the card answers the MFA challenge.
Password accepted. The screen types out a coordinate.
The worker reads the matching word off the printed grid, then adds the private PIN.
Directory Identity resolves automatically, nothing to approve.
The card sits alongside the MFA you already run, and policy routes each worker to the right method, even where device MFA can't reach.
Login, with or without a password.
identitychallengecard.avatier.com. Try it, or book a meeting.
Login, With or Without a Password
The card is the factor either way. Use it passwordless on shared workstations and virtual desktops, or keep the password and let the card answer the MFA challenge — no phone required, no app required, no hardware token to enroll.
Compare to device MFA - Use Cases 03TranscriptTap a word to play from there
You're locked out, and the thing that would prove it's you is a phone that's dead out of signal or in a locker.
In most enterprises, the front door got strong.
The way back in, didn't.
Recovery has to know who's asking, first.
The new password field waits.
A coordinate appears.
You read the word off your printed card, add your private PIN, and your employee ID is verified automatically.
Then, the password changes.
No call, no ticket, no escalation to security, no manager override, no waiting for systems to come back.
The lockout queue stops being your bottleneck, and every challenge and re-issue lands in the identity governance you already run.
Self-service password reset.
Proof first, then the password.
Try the live card at identitychallengecard.avatier.com.
Self-Service Password Reset
A locked-out worker resolves it themselves. The card proves who they are before the password changes, so the reset needs no help desk call — and it still works when the phone is dead, out of signal, or in a locker.
Try the live card
Also Available
Identity Challenge Card for Apple Wallet
Human verification in your pocket. Fast access and a secure backup identity, ready when standard MFA fails — alongside the printed card, not instead of it.
Device-Dependent MFA Can't Protect Workers Who Don't Have a Device
Every MFA product on the market assumes a trusted device is available at authentication time. That assumption is wrong for most of the workforce.
80% of the global workforce is deskless. Factory floors, hospitals, field service, retail, logistics, education, construction — the workers running the operation rarely carry a work phone, and the ones who do can't use it on the shop floor.
The result is a documented coverage gap. Organizations write MFA exceptions for the workers they can't reach. Those exceptions are the attack surface cyber adversaries map first.1,2,3
80 percent
80% of the global workforce is deskless
2.7 billion workers worldwide don't sit at a desk, don't carry a work phone, and can't install an authenticator app — and they're the workforce most organizations leave uncovered.
20 industries
Industries
5 to 88 percent
Device MFA reach
Deviceless MFA closes the red. Device-dependent MFA can't reach it without a phone, an app, a token, or a network.
For the CFO: every uncovered frontline worker is an uninsured breach vector — one stolen credential from a seven-figure incident, a denied cyber-policy claim, and an audit finding that pushes your next renewal. Deviceless MFA is how that math stops working against you.
Fifteen minutes. We'll map your coverage gap and what it's costing you today.
Sources
Fortune 500 workforce composition derived from 10-K filings, Bureau of Labor Statistics industry occupation mixes, and Gallup's State of the Global Workplace (2024). Deskless ratio per industry follows Emergence Capital's Deskless Workforce Report. Full methodology available on request.
- [1] Enterprise VC research — State of Technology for Deskless Workers (2020)
- [2] Global strategy consultancy — Making Work Work Better for Deskless Workers (Dec 2022)
- [3] Industry analyst firm — 75% of new mobile initiatives target frontline workers
- [4] Business publication — 2025 ranking of largest U.S. companies by revenue (June 2025)
The Iranian Handala Stryker Attack Is Why Deviceless MFA Exists.
Handala is Iran-aligned. They don't want a ransom — they want you offline.
State-aligned wiper groups don't negotiate; they build payloads designed to keep your workforce locked out. Then the phone rings at your service desk. “This is John from Cardiology — I need my access back, now.” How does the tech on the line know it's actually John — and not the attacker who already owned John's phone?
Device-Dependent MFA vs Deviceless Authentication
Device-Dependent MFA
Deviceless Authentication
With this fallback identity layer, Stryker's rebuild would have been days, not weeks.
Three Factors. Zero Device Dependency.
Deviceless MFA resolves three independent factors — all locally, all without a device, and all in under 10 seconds.
Challenge Card Factor
A printed grid of word pairs. At login, the system asks for a specific coordinate — the user reads the answer directly off the card. No network call. No device.
Private Knowledge Factor
A short PIN that only the user knows. Bound to the card via policy and verified in-memory so replay and brute-force have no surface.
Identity Anchor Factor
The user's directory identity — Employee ID, badge, or SCIM-provisioned principal. Ties the challenge to a specific human, with full audit trail.
See Deviceless Authentication. Try It. Understand It in 60 Seconds.
Self Enrollment or Auto Enroll Everyone at Once.
A narrated walkthrough of Deviceless MFA, the card, and how the three factors resolve locally.
This is Deviceless MFA. Try it.→
No signup. No download. Resolve a live three-factor challenge against a printed card, right here — same flow a worker runs during an identity outage.
No phone required
No app required
No network required
No hardware token required
No dependency on compromised systems
Works in any language, including RTL and CJK
| # | A | B | C | D | E |
|---|---|---|---|---|---|
| 1 | INSTALL POWDER | GARDEN BRIDGE | MARBLE SILVER | ROCKET WINDOW | GUITAR CASTLE |
| 2 | PLANET ANCHOR | TURTLE FOREST | BASKET TEMPLE | VELVET PIRATE | COTTON DRAGON |
| 3 | CANYON MAGNET | PUZZLE ORANGE | VIOLET BEACON | COPPER JUNGLE | CARPET MONKEY |
| 4 | HARBOR KNIGHT | VISION QUARTZ | JASPER WILLOW | SUMMIT STREAM | PARROT FABRIC |
| 5 | MEADOW COBALT | FABRIC SPHINX | FALCON BINARY | ORCHID PRISM | LANTERN OXYGEN |
Coordinate C2 — TOP word
Your PIN 1234
Employee ID EMP-48291
How Three-Factor Works
· Challenge Card Factor — Find the coordinate (e.g., A1, B3) and enter the TOP or BOTTOM word
· Private Knowledge Factor — Read your 4-digit PIN, then enter it in the PIN field
· Identity Anchor Factor — Your Employee ID is verified automatically
· All three factors required — the word and PIN must both be correct to gain access
· New challenge — Tap 'New Game' to randomize a fresh coordinate and PIN
The Business Value of Deviceless MFA Mapped to Who's Buying
Every stakeholder wins a different outcome. The Identity Challenge Card is the rare control where the CISO, CIO, CFO, CEO, service desk, and industry analyst each get their own answer.
Ready to close your compliance gaps with Deviceless MFA?
Book a 20-minute walkthrough tailored to your workforce — we'll map your exceptions to a deployment plan before you leave the call.
Built for Global Workforces
The Identity Challenge Card ships in 34 languages, including RTL Arabic and Hebrew and CJK Chinese, Japanese, and Korean. Same card, same three-factor flow — localized for every worker.
Deviceless MFA, Trusted in Regulated Environments
Designed from day one for CMMC, HIPAA, PCI-DSS, GDPR, and FERPA workloads. Three architectural pillars make the compliance story simpler than device-bound MFA, not harder.
Privacy by Architecture
Zero personal data on the auth mechanism
- No phone number, biometric, or personal data touches the card
- Card contents are opaque without the user's PIN
- Zero GDPR exposure from the authentication channel
- No third-party processor between the user and the challenge
- Revocation is immediate — no upstream device cleanup
Full Lifecycle Controls
Governed issuance, revocation, and audit
- Every card is issued through the existing IGA workflow
- Every challenge and re-issue writes an immutable audit record
- Policy-enforced expiration and re-enrollment windows
- Identity-verified re-issuance closes the social-engineering path
- Separation of duties between issuer, approver, and auditor
Replay-Proof by Design
No push, no replay, no shared secret
- No push notifications — push fatigue has no surface
- Each coordinate value is one-time — replay is structurally impossible
- Air-gapped verification — no network attack surface
- No TOTP shared secret to exfiltrate
- Offline verification with no shared secret to steal
Recognized on Gartner Peer Insights
4.4
Based on 14 verified reviews of AvatierIdentity Governance and Administration
Read the reviews on Gartner Peer Insights
Download White Paper + Product Sheets
The full category argument, the Stryker recovery narrative, and the product sheet — three PDFs for the CISO, CIO, and board packet.
Frequently Asked Questions
The same questions come up in every CISO, CIO, CFO, CEO, service desk, and analyst call. Answers below — pick your persona.
Deviceless MFA for 100% of the workforce
What exactly is Deviceless MFA — and how is the Identity Challenge Card different from every other MFA?
Is a printed card actually secure? A lost card means a compromised credential.
We already have MFA. Why does our existing solution leave a documented gap?
Can push bombing or replay attacks work against this?
See Where Deviceless MFA Fits in Your Environment
No commitment · 30-min Deviceless MFA walkthrough · same-day response
Talk to the team behind the Identity Challenge Card — the first production Deviceless MFA.
Further reading
Related from the Identity Challenge Card library
Phishing-Resistant MFA for Enterprise in 2026
Phishing-resistant MFA is the term CISA, NIST 800-63B Rev. 4, and Executive Order 14028 use for the authentication category that survives the attack patterns that defeated SMS, OTP, and push-approval MFA. The 2026 enterprise reference on what qualifies, what doesn't, and the deployment architecture across mixed workforces.
Read more
Beyond Foundational MFA in 2026: The Recovery Channel Gap
Phishing-resistant MFA is the right answer for the front door. It does not protect the recovery channel, which is where the 2026 attacks are landing.
Read more
The Best Multi-Factor Authentication Solutions for Enterprises in 2026
A 2026 buyer's guide to enterprise MFA solutions, segmented by workforce type. Compare 12 vendors across desk, frontline, contractor, and customer use cases.
Read more