Zero-Trust Security

Identity Verification

A 30-second process that protects your accounts and ours. Here’s how to confirm you’re really speaking with a Valukoda technician — and how we’ll confirm it’s really you.

How to verify our techs How we verify you

+442%

Increase in voice-phishing (vishing) attacks between 1st half and 2nd half 2024 CrowdStrike 2025 Global Threat Report

+144%

Rise in identity-based threats since 2022 Annual Threat Report 2024

10 seconds

Of recorded audio is all an attacker needs to clone a voice with publicly available AI tools

Why we verify every call

AI-powered voice cloning has made phone-based impersonation cheap and convincing. Attackers can replicate a voice from a voicemail greeting, a brief phone call, or a social media clip. Valukoda follows a Zero-Trust Policy: never trust, always verify — on every service desk interaction, both directions.

The threat is real

Bad actors impersonate IT providers to gain access to your computer, server, or network — and impersonate clients to trick us into resetting passwords or granting access.

Verification works both ways

Even if you know your technician personally, we’ll still verify your identity — and you should always verify ours. The process is fast, private, and consistent.

Built into every ticket

Verification is logged automatically inside your service ticket so there’s an audit trail for both sides. No paperwork, no friction.

Verify a Valukoda technician

If someone calls claiming to be from Valukoda, take a few seconds to confirm before sharing anything sensitive or granting access. Here’s the process — it’s the same every time.

Verification Number

(469) 991-2688

Save this in your phone as Valukoda. SMS only — this line is automated.

Step-by-step

The #verify process

From your mobile phone, kick off verification any time you’re on a call with someone claiming to be from Valukoda.

Save (469) 991-2688 in your contacts as Valukoda.
Text #verify to that number.
You’ll receive a random 6-digit code. Your technician sees the same code in their ticket.
Let the technician read the code to you first — do not read it to them. Compare what they say against what’s on your phone.
If it matches, reply #confirm. If it doesn’t match (or they refuse to read it first), hang up and call our service desk directly.
You’ll get an automated message: “The Technician Verification has been successfully completed.”

Why the order matters: Only a real Valukoda technician with access to the live ticket can see the code on their side. If you read it to them first, an attacker can simply repeat what you said and fake the verification. The tech reads first. Always.

Stay alert

When to be skeptical

Treat any inbound call from “Valukoda” with healthy skepticism — especially if the caller is creating urgency. A real Valukoda tech will never:

Refuse to participate in verification.
Ask you to read the verification code to them instead of reading it to you.
Ask you to bypass verification “just this once.”
Pressure you to install software, share passwords, or enter codes outside the normal flow.
Call from a number that isn’t ours and ask for remote access.

When in doubt, hang up and call our service desk directly using the number on your contract or in our portal.

How we verify you

When you contact our service desk, we’ll take 30 seconds to confirm your identity before proceeding. Our primary method is an authenticator app push — but we’ll fall back to other methods if needed for your account.

Primary method: A push notification to Microsoft Authenticator or Duo on your phone. Tap Approve — that’s the whole process. Push-based verification is also the hardest for attackers to spoof, because the prompt is delivered through an end-to-end channel tied to your enrolled device, not through SMS or email. Other methods below are fallbacks when an authenticator isn’t configured for your account.

Primary

Microsoft Authenticator

An “Approve sign-in?” push appears in your Authenticator app. Tap Approve.

Primary

Duo Authenticator

A Duo verification push arrives on your phone. Tap Approve to complete.

SMS

You’ll receive a 6-digit code from (469) 991-2688. Repeat it back to your technician.

Email

An email from [email protected]. Click the link, then click Validate.

Secure Link

One-tap SMS link. Opens to a Valukoda page — tap Validate and you’re done.

Client Portal

Microsoft Teams

Verification codes and links are posted in your Valukoda Teams chat. Repeat the code or click the link.

Landline

Last resort: an automated voice call reads a 6-digit code (twice). Write it down and share with your technician.

The security is in the match, not the source. Caller ID, SMS sender ID, and email From: addresses can all be spoofed. What an attacker can’t spoof is the code in your technician’s ticket. That’s why we always compare two things: the code on your phone and the code your tech reads aloud during a live call. If they don’t match, abort — regardless of how legitimate the message looks. And if you receive a verification message you didn’t initiate or expect, ignore it.

Frequently asked questions

Why do I have to verify if I’ve worked with the same technician for years?

Familiarity is exactly what attackers exploit. AI voice cloning means a 10-second clip of someone you know is enough to fake a convincing call. Verification is universal so it can’t be socially engineered around — no exceptions, even for people we know well.

How long does verification take?

About 30 seconds. With Microsoft Authenticator or Duo, it’s usually a single tap.

What if my codes don’t match?

Don’t proceed. Hang up, then call the Valukoda service desk directly using the number on your contract or in your client portal. We’d much rather you double-check than risk talking to an impersonator.

Why do I have to wait for the technician to read the code — can’t I just tell them what mine says?

No, and this is the most important rule of the whole process. Only a real Valukoda tech can see the code on their side — it shows up inside the live service ticket. If you read it first, an attacker can simply repeat what you said and pretend they had it the whole time. The verification only proves anything when the tech speaks the code first and you compare it to what’s on your phone. If a caller insists you read it to them, hang up.

I didn’t get a push notification — what now?

Make sure your authenticator app has notifications enabled and your phone has a network connection. If your contact information has changed, your technician can resend or fall back to one of the alternate methods (SMS, email, secure link, etc.).

Does Valukoda ever ask for my password?

No. We will never ask you for a password, MFA code outside the verification flow, or any other sensitive credential. Verification only confirms identity — it doesn’t transfer any secrets.

Can I verify a tech by texting #verify even if they didn’t ask me to?

Yes — that’s the whole point. You can initiate verification any time, on any call. If the person on the line resists or can’t produce a matching code, they’re not a Valukoda technician.

Can attackers spoof your verification number or email address?

They can try — SMS sender IDs, caller IDs, and email From: headers can all be faked, and lookalike domains (e.g. valukoda.co) can be registered. That’s why our verification process isn’t built on trusting the source. It’s built on the code matching between what’s on your phone and what’s in your technician’s ticket during a live call. An attacker can put a fake message in front of you, but they can’t put the same code into a real Valukoda ticket. If the codes don’t match, hang up. And ignore any “verification” message that arrives when you’re not on a call with us.

What should I do if I get a verification message I didn’t expect?

Ignore it. Verification only happens in the context of an active service-desk interaction you’re part of. An unsolicited code, push, or link is either a mistake or a phishing attempt — either way, don’t act on it. If you’re unsure, contact our service desk through your normal channel and ask.

Questions about verification?

Your Valukoda team is happy to walk through the process with you, your staff, or your whole organization. We’d rather over-explain than have anyone get caught by a sophisticated phishing call.

Contact Valukoda