Signals · Identity security

Your help desk is in the contract now

The attack that still works best is not clever malware. It is a polite phone call asking IT to reset a password and register a new phone. Now your customers are starting to ask how you would handle that call.

By Gouresh Kamble, Amon Dîn · 28 October 2026 · 5 min read

Picture a call to your IT help desk on a busy afternoon. The caller says she works in accounts payable. She has a new phone, she is about to lose signal on a train, and she can't get into her email. She knows her employee number, her manager's name and the office she works from. The analyst wants to help, so they reset her password and register her new phone for multi-factor authentication. Ten minutes later, someone who is not her is reading her inbox.

There is no malware in that story and no clever exploit. It is a phone call and a process built for convenience. Earlier this month we wrote about attackers who steal a session instead of a password. This is the low-tech cousin: they persuade your own people to give them a fresh login.

“Attackers rarely need to beat your MFA. They only need to persuade someone to replace it.”
— Gouresh Kamble, Amon Dîn

How MFA gets defeated without malware

This is a well-documented pattern. In April 2024 the US health sector's HC3 alert described attackers calling help desks as finance staff, answering security questions with stolen personal details, and asking for a password reset and a new MFA device. The American Hospital Association noted that the new phone often had a local area code, and that the trick gets round MFA, including phishing-resistant methods, because the attacker is simply enrolled as the user. The mailbox was then used to change payment instructions and divert payments.

The joint advisory on Scattered Spider, updated in July 2025 by CISA, the FBI and partners including the UK NCSC, describes the same move: posing as employees to get the help desk to reset a password and transfer MFA to a device the attacker controls. They sometimes make several calls first, simply to learn how the reset process works.

In the UK, after the spring 2025 attacks on major retailers, Reuters reported that the intrusions began with impersonation calls to IT help desks. That detail came from press reporting rather than an official finding. The NCSC's own advice was nonetheless direct: review help-desk password reset processes, including how staff are authenticated before a reset, especially for privileged accounts.

Why your customers will start asking

Until recently this was a question for your IT team. It is becoming a question in your contracts.

In the Netherlands, the Cyberbeveiligingswet (Cbw) has been in force since 15 August 2026. It implements NIS2 across 18 sectors, covers thousands of organisations, and makes boards responsible for approving security measures. It also expects them to manage their supply chain. The Dutch NCSC says plainly that Cbw organisations can impose measures on their direct suppliers and record them in contracts and SLAs, including audits and incident reporting. The RDI, the Dutch regulator, expects suppliers to “indirectly feel the effects of the law” through requests for extra measures and certificates in new contracts and tenders.

In the UK, the Cyber Security and Resilience Bill finished its Lords report stage on 26 October and is scheduled for third reading on 2 November. It is not law yet. The government summary brings medium and large managed service providers into scope, explicitly because they may run IT help desks with privileged access to customers' systems. It also lets regulators designate critical suppliers and introduces a 24-hour initial incident notification. Slaughter and May expects Royal Assent in early 2027 and compliance from around 2028, and advises organisations to prepare now.

You may not be in scope of either law. Your customers might be, and so might your IT provider. The questions flow down the chain: how do you verify a caller before you reset a password or an MFA device? Who can approve it for an executive or finance account? Is it logged? How quickly would you tell us if it went wrong?

A practical checklist

Treat a new MFA device as a high-risk change, not a routine ticket, and give it a stricter process than a password reset.
Call back on the number on record, never the number the caller offers. If the caller is suddenly too busy for a callback, treat that as the answer.
Add a second person for sensitive accounts. For finance, executives and administrators, ask the line manager to confirm, or verify by video with ID or in person.
Stop relying on facts anyone can find. Employee numbers, start dates and managers' names turn up on LinkedIn and in data breaches.
Give the help desk a clear way to say no. The New Zealand NCSC recommends written verification criteria and a defined next step when a caller can't pass them, so nobody has to improvise under pressure.
Alert on resets and new MFA registrations, and review them quickly, especially when they are followed by new mailbox rules or changes to bank details.
Confirm payment changes out of band, by phone to a contact you already hold, with two people approving.
Check your provider does the same. If an MSP runs your help desk, its process is your process.
Write it down. A short, dated procedure is exactly what a supplier questionnaire will ask you to show.

How we help

We start by mapping how identity really works in your organisation: who can reset what, through which channel, with what checks, including anything your IT provider does on your behalf. Then we tighten the weak points, such as caller verification, MFA enrolment rules and alerting, without making the help desk unusable. Finally, we help you turn that into evidence you can reuse for customer questionnaires and tenders, so the next one takes an afternoon rather than a fortnight.

Sources

← All Signals