Help Desk Social Engineering

Layer 8: People High risk

How it works

Help desks exist to solve problems quickly, and attackers exploit that. A caller claims to be an employee who has a new phone, is locked out while travelling, or urgently needs access before a meeting. Armed with details gathered from LinkedIn, earlier breaches or the company website, they can answer basic questions and sound entirely believable. Some callers even spoof the employee's real phone number or claim to be calling on behalf of an executive.

If the support agent resets the password or re-registers multi-factor authentication to a device the attacker controls, the attacker gains legitimate access to that account. Targeting administrators or executives is especially damaging. This technique has been behind several high-profile breaches because it bypasses technical controls entirely. Smaller organizations, where everyone knows each other and processes are informal, can be particularly exposed.

Warning signs

• Reset requests from callers who cannot be easily verified
• Pressure, frustration or name-dropping to speed up the process
• Requests to change MFA to a new phone number or device
• Calls from unusual numbers or outside normal hours
• Multiple reset attempts for privileged accounts

How to defend against it

• Require strong identity verification before any password or MFA reset
• Call users back on a number from the HR or directory record
• Add extra checks and manager approval for privileged accounts
• Notify users by a separate channel when their credentials change
• Train help desk staff on impersonation tactics

If it happens to you

1. Disable the affected account and revoke all sessions
2. Re-verify the real user and reissue credentials in person or by video
3. Review recent activity for data access or changes
4. Tighten the verification process that was bypassed