Context

The Tech Verification widget helps you prevent your customers from falling victim to an identity phishing attack. Easily embedded as an iframe in your website, the Tech Verification Widget makes it easy for your customers to verify the identity of the technician who has called them.

Configuring the Tech Verification Widget

1. Login to MSP Process (https://app.mspprocess.com) as an Admin-level user
2. Navigate to the Identity Management -> Verification -> Tech Verification Widget page
3. Customize the look of the widget so that it matches your website - you can change the text that the widget displays, the background color of the widget, and the button color:
   • 
4. Choose wether or not you want to protect the widget with a CAPTCHA checkbox; enabling this helps ensure that your system doesn't get spammed by somone maliciously submitting a bunch of Tech Verification requests
5. Click Submit when you've finished customizing the widget

Deploying the Tech Verification Widget into your Website

On the Tech Verification Widget page in MSP Process, click the following button to grab the iframe code you'll need to add to your website:

Add that code to the body of your website; once that's done, you'll see the Tech Verification widget on the site. Here's one example:

FAQ:

Q: How do I change the text that is shown to the end-user once they have verified the technician's identity?

From the Identity Management -> Verification -> Verification Settings page, in the Tech Verification Settings section:

Q: How do my techs respond to the Tech Verification request?

• If you're using Autotask, ConnectWise or HaloPSA, you'll respond by going into the Tech Verificaiton module in the MSP Process Pod/Insight, in your PSA.
• If you're using a different PSA, you'll login to MSP Process (https://app.mspprocess.com) and go to the Identity Management -> Verification -> Tech Verification page.

Technician Verification via SMS

Social engineering attacks by bad actors at an MSPs clients are increasing. Bad actors are imitating the MSP / IT Service Provider attempting to gain access to a computer, server or network. CDK Networks was breached recently and they leveraged that breach to immitate the MSPs/Service Providers by calling on the dealerships in attempts to gain access to client computers and networks. 

The purpose for Technician verification is for the client of the IT company or service provider to verify the support company is legitimate before allowing access to their computer systems or providing sensitive information without verifying the caller. Typically, the systems available today provide a mechanism for the IT company verifying the end user calling in for IT support. This would be providing that same capability but in reverse.

The process could not be more simple. When you signup you receive a Verification Phone number. You simply provide this to all of your existing clients and let them know they can request a verification via SMS to it. 

1. The user sends a #verify message to the number you have provided to them. 

2. Each party is sent a randomly generated 6-digit code.

3. The Technician provides the code to the end user and assigns the verification to the ticket in progress for tracking. 

4. The end user types #confirm to the same number to confirm the verification was successful.

5. The user receives back an automated message showing the verification was completed successfully. 

To test it out send #verify to the phone number you selected above in the first step from your mobile phone. You will receive back a code automatically. 

The technician will also get a copy of this code in his PSA portal or inside our MSP Process webapp. ConnectWise is shown below for reference. 

Once the technician reads the code back to the user, the user can type in #confirm and send to complete the confirmation process. 

To setup Technician Verification: 

First go to Verification Settings -> Select Verification Phone Number. If one is not already selected, please select one to use. This number will be used for both End User Verification and Technician Verification purposes. So your users will only need to use the one number and they will receive codes for end user verification over the same phone number.