Help desk social engineering: how MSPs stop it

Short answer: help desk social engineering is when an attacker contacts your service desk as someone else, usually an executive, an admin or a new hire, and gets a technician to reset a password, reset MFA or add a new MFA device. Two controls stop it: verify the caller by something they have or can show, not something they know, and make sure any account they take over has no standing admin rights.

How the attack works

This is the entry point behind several of the largest breaches of the last three years, and the method barely changes.

1. Research. The attacker picks a target from LinkedIn, the company website or breach data, and collects the details a help desk tends to ask for: employee ID, manager, date of birth, last digits of a phone number. Microsoft's analysis of Octo Tempest (also tracked as Scattered Spider) describes the group doing exactly this, and even imitating a target's way of speaking on the phone.
2. The call. They phone, chat or email the service desk. The story is urgent: locked out before a board meeting, a new phone, travelling, first day on the job. Octo Tempest posed as new hires to blend into normal onboarding.
3. The ask. Reset the password. Reset MFA. Register a new device. None of these looks unusual on its own, which is why they work.
4. The escalation. Once in, they go after privileged accounts. In September 2023, Okta warned that attackers were getting service desks to reset MFA for Super Administrator accounts, then using those accounts to impersonate users.

Recent cases

• Scattered Spider, 2023 onwards. CISA's advisory AA23-320A describes the group posing as IT and help desk staff to get credentials, convincing help desks to reset passwords and MFA tokens, SIM swapping, and sending repeated MFA prompts until someone accepts.
• MGM Resorts, September 2023. MGM told the SEC the attack would likely cost it at least $100 million. The intrusion has been widely attributed to Scattered Spider.
• UK retail, 2025. Attackers got IT help desks to reset staff passwords at Co-op and M&S. The UK's National Cyber Security Centre responded by telling organisations to review their help desk password reset processes.

Why MSP help desks are a bigger target

An MSP service desk answers for dozens of client organisations. Technicians rarely know the end users, the SLA rewards closing tickets quickly, and every client's users come in through the same door. A process gap at the MSP is a gap at every client.

MSP technicians also hold the accounts attackers want most. Microsoft notes that Octo Tempest "commonly launches social engineering attacks targeting technical administrators, such as support and help desk personnel." A technician account with standing admin rights across client tenants is the prize, not the side effect.

Why knowledge-based questions don't verify anyone

Date of birth, employee ID, manager's name, the last four digits of anything. Mandiant's 2025 hardening guidance for this threat actor says to avoid relying on publicly available personal data "as UNC3944 often possesses this information." If the caller can recite it, you have confirmed they did their homework, not who they are.

NIST's current digital identity guidelines (SP 800-63B-4) take the same line on authentication: verifiers "SHALL NOT" prompt people to use knowledge-based authentication or security questions.

Control one: verify the caller

The guidance from Mandiant, Okta and Microsoft points the same way. A procedure that holds up has these parts:

• Verify by possession or presence. Push a verification request to the user's already-registered authenticator, or verify on camera against a photo ID. Okta recommends "visual checks, MFA challenges, and manager approvals."
• Go out of band for anything sensitive. Mandiant recommends "a call-back to a registered number or confirmation via a known corporate email before proceeding with any sensitive request." You start the call back, to a number you already hold, never one the caller gives you.
• Treat admin accounts differently. Resets for admins and executives need a second technician's approval. Mandiant adds that administrative users shouldn't be able to register or use legacy MFA methods such as SMS, even if regular users can.
• Apply it the same way to everyone. Urgency and seniority are what the attacker is counting on. The CFO gets verified like the intern.
• Record it. Who asked, how they were verified, which technician acted, in which tenant. Without that you can't show a client, an auditor or an insurer that the control exists.

Resetting safely when a user really has lost their device

Verify through a known second person, such as the user's manager, using contact details you already hold. Then, in Microsoft Entra ID, issue a Temporary Access Pass rather than setting or reading out a password.

A Temporary Access Pass is a time-limited passcode the user signs in with to register a new authentication method. Its lifetime can be set from 10 minutes to 30 days, and the tenant policy can force one-time use. Keep the lifetime short and use one-time passes for recoveries. Authentication Administrators can issue passes for regular users; issuing one for an admin takes a Privileged Authentication Administrator.

Control two: leave nothing standing to steal

Verification will fail eventually. A technician will be tired, a step will be skipped, a cloned voice will sound right. Plan for the reset that gets through.

What the attacker holds afterwards depends on what that account could do. A regular user account limits the damage to one user. A technician account with standing admin rights across client tenants turns one phone call into access to every client.

That is why help desk security belongs in the same conversation as privileged access. Three phases of the PAM journey do most of the work here:

• Enforce MFA and secure access (phase 5): phishing-resistant MFA on every admin account, with no SMS fallback.
• Just-in-time access (phase 6): technician admin accounts stay disabled until a task needs them, with approval for sensitive work, so a hijacked everyday account has no admin rights on it.
• Audit and alerting (phase 7): an alert when an admin account is reset, re-enrolled or used outside the normal process.

How CyberQP handles it

CyberQP's QDesk handles help desk identity verification today. In Panthera, technician access runs through dedicated just-in-time accounts that are disabled by default, can require a second approver and are tied to a PSA ticket, and every privileged action is logged. Identity verification is coming to Panthera, so caller verification and privileged access will run from the same place.

A help desk verification checklist

1. Open a ticket before acting, even for a quick reset. It creates the record and slows the urgency play.
2. Verify with a push to the user's registered authenticator, or on camera against photo ID.
3. If the device is lost, call back a number you already hold, or verify through the manager on file.
4. Never accept a callback number, email address or new device from the caller.
5. Reset with a short, one-time Entra Temporary Access Pass, never a password read aloud.
6. Don't reset both password and MFA in the same interaction without step 2 or 3.
7. Send admin and executive resets to a second technician for approval.
8. Block SMS and voice as MFA methods on admin accounts.
9. Log the verification method on the ticket.
10. Review resets on privileged accounts weekly.

What done looks like

• Every reset request, across every client, is verified by possession or presence, and the method is on the ticket.
• No technician account holds standing admin rights in client tenants.
• Admin and executive resets need a second person.
• You can answer your insurer's help desk and MFA questions with records, not a policy document.

Frequently asked questions

What is help desk social engineering?

An attacker contacts the service desk while impersonating a user and persuades a technician to reset a password, reset or add an MFA method, or grant access. It targets the process, not the software.

How did Scattered Spider use help desks?

According to CISA's advisory AA23-320A, the group convinced IT help desk staff to reset passwords and MFA tokens, posed as IT staff to get credentials from employees, and used SIM swapping and repeated MFA prompts. Microsoft and Mandiant describe the same pattern.

Are security questions enough to verify a caller?

No. The answers are usually available online or in breach data, and attackers research them before calling. Use something the real user has or can show.

What should an MSP do when a user has lost their MFA device?

Verify through a known second person using contact details you already hold and a call you start. Then issue a short, one-time Temporary Access Pass so the user can register a new method.

Does zero standing privilege help against social engineering?

Yes. It doesn't stop the reset, but it limits what the attacker gets. If admin accounts are disabled until a task needs them, a stolen everyday account carries no admin rights.

Sources: CISA AA23-320A; Mandiant, Defending Against UNC3944 (May 2025); Microsoft, Octo Tempest (2023); BleepingComputer on Okta's warning (Sept 2023); The Register on MGM's 8-K; NIST SP 800-63B-4; Microsoft Entra Temporary Access Pass.

Related: zero standing privilege and the PAM journey, QDesk help desk identity verification, book a demo.