Deviceless MFA for Casino and Hotel Staff, with Avatier

Deviceless MFA for casino and hotel staff means giving cage, gaming-floor, front-desk, housekeeping and back-of-house workers a second factor that doesn't depend on a company phone, and giving the service desk a way to check callers by something they hold instead of facts they know. Avatier's Identity Challenge Card™ does both with a printed card, plus a private PIN at sign-in: in Avatier's words, "no phone, no app, no network."

The card in one paragraph: "The Identity Challenge Card is a printed grid of word pairs." The system asks for a coordinate, the worker reads the matching word off the card and adds a private PIN, and their directory identity is checked automatically. "Each value works only once, so it can't be replayed." For the full mechanics, see MFA for Frontline Workers Without Phones. For lessons from a casino help-desk breach, read the lessons from the casino help-desk breach on the Credential Governance™ blog. This post stays on the property's own workflows.

Harden the help-desk call first

When a dealer or room attendant with no enrolled company phone calls the service desk, a push or a texted code has nowhere to go, and the agent may fall back on questions. Avatier's Assisted Reset page describes where that leads: "Agents may rely on judgment instead of verified proof." Its card explainer makes the case for possession over knowledge: "Security questions can be researched. What's on the card isn't online, or on a device."

A card-verified call on a property runs in four steps:

1. The request. A locked-out worker calls for a reset or an unlock.
2. The challenge. "The agent names a coordinate, the caller reads the answer off their printed card, and that value is spent." In Avatier's words, "the agent verifies the caller, not the caller's phone."
3. The check. "The desk checks the answer locally." Avatier calls the card "a reliable identity verification method when every digital channel is down."
4. The lost-card pretext. A caller who says the card is gone is the next attempt to watch for. Avatier lists "Identity-verified re-issuance closes the social-engineering path" among the card's lifecycle controls.

For managers and staff who do carry an enrolled device, Avatier Assisted Reset takes the other route: "Every challenge goes to the user — the agent only sees pass or fail." Assisted Reset also lists the card among the systems it fits with, to "Support deviceless verification for air-gapped and restricted environments." On a multi-property operation, delegation keeps each desk in its lane: "Delegate help desk access by group, region, OU, or support function so agents can assist the right users without receiving unnecessary privilege."

A card-verified service-desk call: the agent names a coordinate, the caller reads the word off the card, and that value can't be used again.

Cover every department, cage to back of house

Device-based MFA needs a device in the worker's hand. Avatier names what happens when it isn't there: "organizations write MFA exceptions for them, and those exceptions are the first thing attackers map." Avatier positions the card to close that gap without replacing what already works: "It sits alongside the MFA you already run, and policy routes each worker to the right method." For example, policy could route a shift manager with a company phone to an authenticator and route cage and floor staff to the card.

The same card covers each moment where a property worker proves who they are:

Moment	What the card does (Avatier's wording)	Example on a property
Login	"it works with or without a password, including on shared workstations and virtual desktops"	A shared workstation in the cage or behind the front desk
Password reset	"a locked-out worker proves who they are and resets it themselves, with no help desk call"	A housekeeping supervisor locked out at the start of a shift
Service desk	"the agent verifies the caller, not the caller's phone"	A slot technician calling in from the floor
Outage	"it all resolves locally, even when devices, networks or the identity provider are down"	A property-wide identity provider or network outage

Language can be another barrier on a hospitality roster. Avatier says "The Identity Challenge Card ships in 34 languages," with the "Same card, same three-factor flow — localized for every worker." On the desk side, Assisted Reset gives "a governed workflow in the user's native language — covering 34 languages with localized enrollment templates." For the language list and rollout, see Multilingual MFA in 34 Languages.

Every department on the roster can use the same factor, an alternative to writing MFA exceptions for cage, floor and housekeeping staff.

Seasonal and high-turnover staff: HR-driven access, governed cards

Avatier's HR User Provisioning page names the scenario: "Businesses with recurring hiring cycles need fast onboarding, access removal and license reclamation when assignments end, and correct role-based access when workers return." It walks the lifecycle: "On a transfer or promotion, it applies the new role's access and removes what no longer fits. Access is suspended during a leave and restored on return. And the moment HR marks someone terminated, Avatier disables their accounts and revokes access."

The card has its own governed lifecycle. Avatier says "Cards are issued through the identity governance workflow you already run," and "Card issuance, expiration, re-enrollment, and revocation are all logged and policy-enforced. Admins set expiry windows; users receive automated reminders." As general practice, set a seasonal worker's expiry window to match the season or contract. For the issue, revoke and replace workflow, see Issuing, Revoking and Replacing Avatier's Identity Challenge Card.

One seasonal worker from hire to separation: HR events drive account access, and card issuance and revocation are logged and policy-enforced.

What gaming control standards say about credentials and cybersecurity

For Class II gaming on Indian lands, the NIGC minimum internal control standards at 25 CFR 543.20 cover computerized systems integral to the gaming environment, and say "Systems, including application software, must be secured with passwords or other means for authorizing access," and "Access credentials such as passwords, PINs, or cards must be controlled". Each user "must have his or her own individual access credential," and "Access credentials of terminated users must be deactivated within an established time period approved by the TGRA."

In Nevada, Regulation 5.260 says a covered entity (a nonrestricted licensee that operates games, or a holder of a gaming license for a race book, a sports pool or interactive gaming) "shall perform an initial risk assessment of its business operation and develop the cybersecurity best practices it deems appropriate," and that after a qualifying cybersecurity incident, its investigation report must include "the root cause of the cybersecurity incident."

Card events are logged, and Avatier says Assisted Reset helps teams "prove that service desk resets, unlocks, enrollment actions, account reviews, mapped identity checks, and user activity reviews were verified, controlled, and logged." Confirm scope with your regulator and counsel.

What Avatier ships toward this pattern

• Identity Challenge Card. Deviceless MFA at login, at password reset and at the service desk. Avatier says the whole workforce "can be up and running in under an hour," and the card can also live in Apple Wallet, Google Wallet or Samsung Wallet "as a backup alongside the printed card." For the product, see the Identity Challenge Card.
• Assisted Reset. Pillar 3 of Avatier Credential Governance: a delegated help desk console where "Every challenge goes to the user." For details, see Avatier Assisted Reset.
• HR User Provisioning. One of the five Lifecycle & Access Governance pillars, connecting "70+ HR and payroll systems through a single unified integration." For the HR-driven side, see HR User Provisioning.
• Security posture. Avatier is SOC 2 Type II audited with no exceptions noted, ISO/IEC 27001:2022 certified and PCI DSS v4.0.1 compliant. For reports and certifications, see the Avatier Trust Center.

Getting started

Pricing for Avatier Identity Anywhere 2027™ is Pay Per Identity Action™: customers pay only for completed, verified, policy-compliant outcomes. Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Full terms are available in the invitation-only preview. For Avatier Identity Anywhere 2027™, see identity-anywhere-2027.avatier.com. For Avatier's full product line, see avatier.com.