[dysfunction]

Previous company I worked at had a policy that you needed to include a photo of yourself with the current date written with any PW reset request, but of course that doesn't work as well at a 2000 person company as at a 100 person startup where IT knows everyone's face.

Plus that's still vulnerable to googling photos of the employee you're impersonating and photoshopping a piece of paper with the date.