An employee calls the IT help desk. They are locked out of their account, a deadline is approaching, and they need their password reset and their authentication app moved to a new phone. Requests like this arrive daily, and the help desk exists to resolve them quickly, a combination of urgency and helpfulness that some criminal groups have learned to exploit.
A joint advisory from the FBI, the US Cybersecurity and Infrastructure Security Agency (CISA), the UK’s National Cyber Security Centre (NCSC) and international partners, updated in July 2025, describes attackers posing as employees to convince IT and help desk staff to reset the employee’s password and transfer multi-factor authentication (MFA) to a device the attacker controls.
Guerassim Nikolov, who advises enterprises on security strategy and resilience, regards this as a weakness that many leadership teams have yet to recognise in IT help desk security. In his assessment, one of the most direct routes into an organisation can run through the people trusted to restore access to it.
Inside a help desk attack
According to the advisory, these approaches frequently take place over several calls, with early contact designed to learn what steps are needed to conduct a password reset. The attackers also search business-to-business websites to determine a target individual’s role, and make calls to employees and help desks to gather information specific to password resets.
By the decisive call, the caller may know the reset procedure and enough about the employee to sound entirely credible. Once the reset is complete, the attacker signs in as a trusted user, and subsequent activity looks like legitimate work.
Rethinking the role of the help desk
Guerassim Nikolov argues that the reset process has received less attention than the sign-in process it supports. “Organisations have invested heavily in strengthening how people log in, yet whoever controls the reset ultimately controls the account,” he says. “When a well-prepared phone call can replace an employee’s password and authentication device, the value of every other identity safeguard rests on a few minutes of conversation.”
The NCSC has advised organisations to review their help desk password reset processes, including how the help desk authenticates staff members before resetting passwords, with particular attention to accounts that hold escalated privileges. It also recommends paying specific attention to domain, enterprise and cloud administrator accounts and checking that access to them is legitimate. Identity checks carried out before a reset are therefore a security control in their own right, warranting the same design, testing and oversight as any technical protection, with the most rigorous checks reserved for the most powerful accounts.
Checks staff can rely on
Several measures make verification harder to manipulate in IT help desk security. Call-backs to a number already held on record, rather than one supplied by the caller, stop an attacker simply confirming their own identity. A scripted verification sequence gives staff a consistent process to follow, even when a caller is insistent, distressed or claims seniority. Help desk systems that record each verification step create an audit trail for reviewing unusual reset activity.
Where the help desk is run by an external provider, these standards can be written into the service agreement, and an experienced provider can apply well-established verification procedures consistently, however busy the service becomes, while the organisation’s security team sets the policy.
“Help desk teams are measured on how quickly they restore access, so the secure route has to be the straightforward one,” he explains. “A clear script, a call-back to a known number and a record of every check give staff firm ground to stand on when a caller applies pressure. That protects both the business and the person answering the phone.”
Limiting what a reset can unlock
Verification lowers the likelihood of an illegitimate reset succeeding, but organisations can also make any reset less valuable to an attacker. The joint advisory recommends phishing-resistant MFA based on FIDO/WebAuthn or public key infrastructure, particularly for webmail, virtual private networks and accounts that access critical systems. For administrators, whose accounts offer the widest access, this kind of sign-in adds an important extra layer of protection.
The NCSC further recommends deploying MFA comprehensively and enhancing monitoring against unauthorised account misuse, including the ability to identify logins from atypical sources. Even if a reset is obtained, unusual use of the account is then more likely to be detected early.
The help desk as a line of defence
Attackers have recognised that the help desk’s commitment to restoring access without delay can be turned against the organisation. Strengthening it depends far less on new technology than on clear processes, trained staff and defined ownership in IT help desk security.
“Attackers look for the point at which trust is extended most readily, and in many enterprises that point is the help desk,” Guerassim Nikolov says. “Recognising every password reset as a security decision, and resourcing it accordingly, is one of the most effective steps a leadership team can take.”
