Your helpdesk is an identity provider

Companies spend real money on strong authentication: hardware keys, passkeys, conditional access. Then an attacker calls the IT helpdesk, says they have a new phone, and asks for their MFA to be reset. Ten minutes later, they are enrolling their own device on a real employee's account.

This is not a theoretical risk. Several well-publicised breaches of large companies started exactly this way, using little more than public profile information and a confident voice.

Why helpdesks are such a good target

The helpdesk is designed to help. Agents are measured on how quickly they close tickets and how satisfied callers are. A frustrated employee locked out before an important meeting is a daily occurrence. An attacker who sounds like that employee fits right in.

The verification questions most helpdesks use make it worse. Employee ID, manager's name, date of birth, last four digits of a phone number: all of these can be found on professional networking sites, in previous data breaches or through a little social media research.

Decide what the helpdesk is allowed to reset

Start by listing every account change your helpdesk can make: passwords, MFA methods, recovery email, group membership. For each one, ask what an attacker could do with it. Resetting MFA on an ordinary user is serious. Doing it for a cloud administrator or a finance approver is critical.

Then tier the process. Privileged accounts should never be recoverable by a phone call alone.

Verify through something the caller has

Good verification moves away from what someone knows and toward what they already possess or can prove in person.

1. Call back on the number in your HR system, not the number they called from.
2. Manager approval sent through a separate, already-authenticated channel, such as a ticket the manager must approve while logged in.
3. Video verification against the photo held by HR, with the employee showing ID. Not perfect, but a large step up from questions.
4. In-person recovery at an office for privileged roles, or a temporary access pass that only works from a managed device.

Detect the reset, not just the call

Assume some social engineering will succeed, and watch for what follows:

• A new MFA method registered shortly after a helpdesk ticket, especially from a new location or device.
• Several resets for the same team in one day, which often signals a campaign.
• A recently reset account immediately accessing admin portals, payroll or file shares it rarely uses.

Notify the real user whenever their authentication methods change, by a channel the attacker does not control. Often, the first sign of an attack is an employee saying "I didn't ask for that".

Train for the real script

Generic awareness training does not prepare agents for a caller who is polite, informed and in a hurry. Run short exercises using realistic scenarios, and review real calls together. The aim is a helpdesk that sees itself for what it is: a front door to every account in the company.