Help Desk Social Engineering: How to Stop It

How the Attack Works

Several high-profile intrusions since 2023 started this way, and the method barely changes.

Research. The attacker picks a target from LinkedIn, the company website or breach data, and collects the details a help desk tends to ask for: employee ID, manager, date of birth, last digits of a phone number. Microsoft's analysis of Octo Tempest (also tracked as Scattered Spider) describes the group doing exactly this, and even imitating a target's way of speaking on the phone.
The call. They phone, chat or email the service desk. The story is urgent: locked out before a board meeting, a new phone, travelling, first day on the job. Octo Tempest posed as new hires to blend into normal onboarding.
The ask. Reset the password. Reset MFA. Register a new device. None of these looks unusual on its own, which is why they work.
The escalation. Once in, they go after privileged accounts. On 31 August 2023, Okta warned that attackers were getting service desks to reset all MFA factors for highly privileged users, then using the Super Administrator accounts they took over to impersonate users.

Cases From 2023 to 2026

Scattered Spider, 2023 onwards. CISA's Scattered Spider advisory describes the group posing as IT and help desk staff to get credentials, convincing help desks to reset passwords and MFA tokens, SIM swapping, and sending repeated MFA prompts until someone accepts.
UK retail, 2025. Marks & Spencer's chairman, Archie Norman, told a UK Parliament committee that the attackers got in on 17 April 2025 through "sophisticated impersonation" that involved a third party. The UK's National Cyber Security Centre responded to the retail incidents by telling organisations to review their help desk password reset processes.
Octo Tempest, 2025. In July 2025, Microsoft reported the group moving from retail, food services, hospitality and insurance to airlines, still getting in by "impersonating a user and contacting service desk support through phone calls, emails, and messages."
UNC6671, 2026. In August 2026, Google Threat Intelligence Group reported a group calling employees, often on their personal phones, while posing as IT help desk staff, sometimes spoofing the real help desk number. The caller pushes an urgent MFA or passkey update and sends the employee to a lookalike sign-in page that captures their credentials and MFA tokens. It's the same attack run the other way: the attacker plays the help desk instead of calling it.

Why MSP Help Desks Are a Bigger Target

An MSP service desk answers for dozens of client organisations. Technicians rarely know the end users, the SLA rewards closing tickets quickly, and every client's users come in through the same door. A process gap at the MSP is a gap at every client.

MSP technicians also hold the accounts attackers want most. Microsoft notes that Octo Tempest "commonly launches social engineering attacks targeting technical administrators, such as support and help desk personnel." A technician account with standing admin rights across client tenants is the prize, not the side effect.

Why Knowledge-Based Questions Don't Verify Anyone

Date of birth, employee ID, manager's name, the last four digits of anything. Mandiant's 2025 hardening guidance for this threat actor says to avoid relying on publicly available personal data "as UNC3944 often possesses this information." If the caller can recite it, you have confirmed they did their homework, not who they are.

NIST's current authentication guidelines take the same line. None of the account recovery methods they recognise is a knowledge question: they are saved or issued recovery codes, recovery contacts and repeated identity proofing. The same guidelines say verifiers "SHALL NOT" prompt people to use security questions when they choose passwords.

Control One: Verify the Caller

The guidance from Mandiant, Okta and Microsoft points the same way. A procedure that holds up has these parts:

Verify by possession or presence. Push a verification request to the user's already-registered authenticator, or verify on camera against a photo ID. Okta's advice is to "strengthen help desk identity verification processes using visual verification."
Go out of band for anything sensitive. Mandiant recommends "a call-back to a registered number or confirmation via a known corporate email before proceeding with any sensitive request." You start the call back, to a number you already hold, never one the caller gives you.
Treat admin accounts differently. Resets for admins and executives need a second technician's approval. Mandiant adds that administrative users shouldn't be able to register or use legacy MFA methods such as SMS, even if regular users can.
Apply it the same way to everyone. Urgency and seniority are what the attacker is counting on. The CFO gets verified like the intern.
Record it. Who asked, how they were verified, which technician acted, in which tenant. Without that you can't show a client, an auditor or an insurer that the control exists.

Resetting Safely When a User Really Has Lost Their Device

Verify through a known second person, such as the user's manager, using contact details you already hold. Then, in Microsoft Entra ID, issue a Temporary Access Pass rather than setting or reading out a password.

A Temporary Access Pass is a time-limited passcode the user signs in with to register a new authentication method. Its lifetime can be set from 10 minutes to 30 days, and the tenant policy can force one-time use. Keep the lifetime short and use one-time passes for recoveries. Authentication Administrators can issue passes for regular users; issuing one for an admin takes a Privileged Authentication Administrator. The MFA fatigue and MFA reset playbook walks through the Entra steps.

Control Two: Leave Nothing Standing to Steal

Verification will fail eventually. A technician will be tired, a step will be skipped, a cloned voice will sound right. Plan for the reset that gets through.

What the attacker holds afterwards depends on what that account could do. A regular user account limits the damage to one user. A technician account with standing admin rights across client tenants turns one phone call into access to every client.

That is why help desk security belongs in the same conversation as privileged access. Three phases of the PAM journey do most of the work here:

Phase 5, enforce MFA and secure access: phishing-resistant MFA on every admin account, with no SMS fallback. Caller verification belongs in this phase too, because a reset is the easiest way around MFA.
Phase 6, just-in-time access and zero standing privilege: technician admin accounts stay disabled until a task needs them, with approval for sensitive work, so a hijacked everyday account has no admin rights on it.
Phase 7, audit, monitor and alert: an alert when an admin account is reset, re-enrolled or used outside the normal process.

How CyberQP Handles It

CyberQP's QDesk verifies end users who contact the help desk before a password or MFA reset. The technician sends the request from the ticket or while on the phone, and the user either approves it in the CyberQP mobile app, Microsoft Authenticator or Duo, or reads back a code sent to them by SMS or email. Help desk identity verification is coming to Panthera; it isn't in Panthera yet. In Panthera today, technicians can work from dedicated just-in-time accounts that are disabled by default, can require a second approval and can be tied to a ConnectWise Manage ticket, and changes to privileged accounts show up in Panthera's event log and auditing alerts.

A Help Desk Verification Checklist

Open a ticket before acting, even for a quick reset. It creates the record and slows the urgency play.
Verify with a push to the user's registered authenticator, or on camera against photo ID.
If the device is lost, call back a number you already hold, or verify through the manager on file.
Never accept a callback number, email address or new device from the caller.
Reset with a short, one-time Entra Temporary Access Pass, never a password read aloud.
Don't reset both password and MFA in the same interaction without step 2 or 3.
Send admin and executive resets to a second technician for approval.
Block SMS and voice as MFA methods on admin accounts.
Log the verification method on the ticket.
Review resets on privileged accounts weekly.

What Done Looks Like

Every reset request, across every client, is verified by possession or presence, and the method is on the ticket.
No technician account holds standing admin rights in client tenants.
Admin and executive resets need a second person.
You can answer your insurer's help desk and MFA questions with records, not a policy document.

Frequently Asked Questions

What is help desk social engineering?

An attacker contacts the service desk while impersonating a user and persuades a technician to reset a password, reset or add an MFA method, or grant access. It targets the process, not the software.

How did Scattered Spider use help desks?

According to CISA's advisory on the group, it convinced IT help desk staff to reset passwords and MFA tokens, posed as IT staff to get credentials from employees, and used SIM swapping and repeated MFA prompts. Microsoft and Mandiant describe the same pattern.

Are security questions enough to verify a caller?

No. The answers are usually available online or in breach data, and attackers research them before calling. Use something the real user has or can show.

What should an MSP do when a user has lost their MFA device?

Verify through a known second person using contact details you already hold and a call you start. Then issue a short, one-time Temporary Access Pass so the user can register a new method.

Does zero standing privilege help against social engineering?

Yes. It doesn't stop the reset, but it limits what the attacker gets. If admin accounts are disabled until a task needs them, a stolen everyday account carries no admin rights.

Sources: CISA AA23-320A, Scattered Spider (16 Nov 2023); Mandiant, Defending Against UNC3944 (6 May 2025); Microsoft, Octo Tempest (25 Oct 2023); Microsoft, Protecting customers from Octo Tempest attacks across multiple industries (16 Jul 2025); Okta, cross-tenant impersonation (31 Aug 2023); UK Parliament, Business and Trade Sub-Committee oral evidence, HC 835 (8 Jul 2025); NCSC, Incidents impacting retailers (4 May 2025); Google Threat Intelligence Group, UNC6671 (6 Aug 2026); NIST SP 800-63B-4 (July 2025); Microsoft Learn, Temporary Access Pass.