I work for a help desk, and we recently launched an online service where our members can log in.

A problem we are having is that users who are calling us often ask us to confirm that the password handed in to them is correct. By doing so, they disclose their password over the phone. How can we prevent this?

It is mentioned in the sign up mail that they mustn't disclose their password, and we mention it whenever we feel they are going to disclose it to us.

About the users: Around 90% of our callers are first time callers.  Since they're doing it the first time they call, it's difficult to educate them. They are pensioners, so they usually have less experience of authenticated services than the average computer user. 

Ensure there is a method for users to reset their own passwords, and make a policy whereby the helpdesk will initiate a password reset if a password is revealed to them.

Users will tend to phone up when they can't log in, and therefore triggering the same password reset process as they can themselves results in them slowly learning that it doesn't help to phone up.
