When Your IdP or MFA Goes Down: Avatier's Identity Challenge Card

When the identity provider, the MFA service or the devices themselves go down, people still have to prove who they are, at the service desk and at login. A printed, air-gapped factor keeps that verification working, because it doesn't depend on any of the systems that just failed. Avatier's Identity Challenge Card™ is that factor: a printed grid of word pairs with no phone, no app and no network.

The hard part of an identity outage isn't the theory. It's the first hours, when the queue fills with callers nobody can verify and every reset is a judgment call. For the concept behind the fallback, see What Is an Identity Continuity Layer? What follows is the operational side: what breaks, and a runbook for the desk.

What fails in an identity outage

Device-dependent MFA rests on three assumptions: the identity provider answers, the MFA service can reach the user, and the user still holds a trusted device. Avatier puts the last one plainly: "Every MFA product on the market assumes a trusted device is available at authentication time." Its comparison says device-dependent MFA "Fails when devices, networks, or IdPs are down," while the card "Resolves locally during the outage."

What goes down	What stops working	What the printed card still does
Identity provider	Sign-ins and prompts that route through it	At the desk, resolves "against the grid locally — no IdP call"
MFA push or SMS	Push approvals and texted codes	No push to approve; the worker reads a word off paper
Devices (wiped, lost, dead)	Authenticator apps and codes sent to that phone	Card plus a PIN "never stored on a device"

Three systems that device-dependent MFA relies on, and the one printed factor that doesn't need any of them to answer.

Avatier builds its case on the worst version of this. Its Identity Challenge Card page carries the headline "The Iranian Handala Stryker Attack Is Why Deviceless MFA Exists," and describes the threat in two lines: "Handala is Iran-aligned. They don't want a ransom — they want you offline." And: "State-aligned wiper groups don't negotiate; they build payloads designed to keep your workforce locked out."

Then, in Avatier's telling, the service desk phone rings. A caller says he is "John from Cardiology" and needs his access back now. The question Avatier poses is the core one for a desk in an outage: how does the tech know it's John "and not the attacker who already owned John's phone?"

Before the outage: put the fallback in place

A fallback only works if it exists before the bad day. As general preparation, four things need to be true.

• Cards are issued. Avatier says every card is issued through the existing IGA workflow, and it describes deployment in under an hour, with no MDM, no app and no hardware.
• Policy knows the card. In Avatier's description, the card sits alongside the MFA you already run, and policy routes each worker to the right method, even where device MFA can't reach.
• The desk script doesn't use the phone. Avatier contrasts the old script, "a list of questions an attacker can research," with a card whose contents aren't "online or on a device." Write the card check into the incident plan as the verification step when phones can't be trusted.
• Cards are current. Admins set expiry windows, and users receive automated reminders.

The wallet version, for Apple, Google or Samsung Wallet, is a backup that sits "alongside the printed card, not instead of it." In a device wipe, the wallet copy is on the same phone you can't trust, so plan the runbook around paper. For sites where phones never go at all, see Air-Gapped MFA for Phone-Free Sites.

The outage runbook: verify, restore, record

The order matters: prove the person first, then change their access, then make sure the record shows both. The steps below are a general pattern; the card mechanics are Avatier's.

1. Verify the human at the service desk. The agent names a coordinate, the caller reads the matching word off their printed card, and that value is spent. Avatier says the desk resolves the answer against the grid locally, with "no IdP call, no network dependency." For the wider caller-verification picture, see AI Call Center Authentication.
2. Restore access through self-service where you can. A locked-out worker doesn't need the desk. The new password field waits, a coordinate appears, the worker reads the word off the card and adds a private PIN, and their employee ID is verified automatically. Then the password changes. Avatier's list of what that skips: "No call, no ticket, no escalation to security, no manager override, no waiting for systems to come back."
3. Use the card as the login factor. Avatier says "The card is the factor either way." Keep the password and let the card answer the MFA challenge, or sign in without a password on shared workstations and virtual desktops.
4. Re-issue lost cards only after verifying identity. Avatier says a lost card is revoked in seconds and replaced the same day, and that identity-verified re-issuance "closes the social-engineering path." Without that check, a replacement becomes the attacker's shortcut.
5. Record evidence as you go. Avatier says "every challenge and re-issue lands in the identity governance you already run," and that card issuance, expiration, re-enrollment and revocation are logged and policy-enforced. The post-incident review will ask who was verified, how and by whom.

For volume, Avatier Assisted Reset includes Batch Password Reset, listed as "High-volume reset automation for mass events, with no compliance shortcuts."

Five steps from an unverified caller to restored access, with the proof captured before anything about the account changes.

After the outage: hand back to primary MFA

When the identity provider and devices are back, primary MFA takes over again. The card stays in the worker's pocket as the fallback. As a general close-out, re-enroll the phones and authenticators that were wiped or replaced, and review the challenges and re-issues logged during the incident against the incident timeline.

Avatier describes card re-enrollment as needing "no device pairing," which matters when the devices are the thing being rebuilt. Each coordinate value is one-time, so values read during the outage can't be replayed afterward.

What Avatier ships toward this pattern

• Identity Challenge Card™. The printed, three-factor card for the service desk, login and password reset, plus the wallet version. In Avatier's framing, the card defines the Identity Continuity Layer, an infrastructure layer that ensures authentication persists when device-dependent systems fail. For the product and a live demo, see the Identity Challenge Card.
• Assisted Reset, Credential Governance™ Pillar 3. Gives service desk agents "a governed way to verify users, support access recovery, and complete sensitive credential actions," and supports deviceless verification with the card. For the desk workflow, see Assisted Reset.
• The wider platform. For Avatier's AI-native identity platform, see the Avatier Identity Anywhere 2027™ preview.
• Security posture. Avatier is SOC 2 Type II audited with no exceptions noted and ISO/IEC 27001:2022 certified. For details, see the Avatier Trust Center.