Help Desk Impersonation: How Attackers Talk Their Way Past MFA

Help Desk Impersonation: How Attackers Talk Their Way Past MFA

Multi-factor authentication stops most account takeovers, so attackers have stopped fighting it head-on. Instead, they call the help desk. They claim to be an employee who got a new phone, is locked out, and is about to miss a deadline — and they ask IT to reset the password and the MFA device. If the help desk says yes, the attacker registers their own authenticator and walks in through the front door. Some of the most damaging breaches of recent years, including the widely reported 2023 attack on MGM Resorts, started with a phone call like this.

The fix is not a better product. It is a verification procedure that the help desk follows every time, for every caller, no matter how urgent the story sounds.

How the con works

1. Research. LinkedIn, the company website, and press releases give the attacker names, job titles, managers, and who is traveling. Breached data often adds birthdays and employee IDs.
2. Pressure. The caller is senior, stressed, and short on time: a CFO at an airport, a sales rep about to present to a client. Urgency is the whole technique.
3. The ask. “Can you reset my password and clear my MFA? I’ll set up the new phone myself.” Caller ID may be spoofed to show the employee’s real number.
4. The takeover. With a fresh password and their own device registered for MFA, the attacker owns the account — and every system that trusts it.

The reverse version targets employees instead: someone calls or messages pretending to be IT, says there is a problem with the account, and asks the employee to read back the code that just arrived. Attackers increasingly do this through external Microsoft Teams chats that look like internal support.

Why small businesses are exposed

In a small company, the help desk is often one person or an outside provider who wants to be helpful, and who may genuinely know the caller’s name. There is rarely a written rule for what proves identity. “They knew their manager’s name and their employee number” feels like verification, but it is exactly the information an attacker collects first.

A verification procedure that works

• Never verify with facts an attacker can look up. Date of birth, employee ID, manager’s name, and the last four of a Social Security number are all for sale or on LinkedIn.
• Call back on the number on file. Hang up and call the number in the HR system or directory — not the number that called you, and not one the caller offers.
• Require a second approver for MFA resets. The employee’s manager confirms the request through a separate channel. For administrators and anyone who touches payments, make this mandatory with no exceptions.
• Issue a short-lived pass, not a reset. Microsoft Entra’s Temporary Access Pass lets the help desk give a verified user a time-limited code to register a new device themselves, instead of disabling MFA on the account.
• See a face for high-risk accounts. A quick video call with the person holding up a photo ID, compared against the HR file, is hard to fake for an executive or admin reset.
• Alert on every MFA change. When security methods change on an account, notify the user and their manager through a second channel, and have your monitoring flag new devices registered outside normal patterns.

Write the procedure down, train every person who answers support calls, and tell employees about it. A real employee who knows the rules will not be offended by a callback. An attacker will hang up.

Tell employees what IT will never ask

Close the reverse scam with one clear message to staff: IT will never ask you to read back an MFA code, approve a sign-in prompt you did not start, or install remote-control software because of an unexpected call or chat. If someone asks, hang up and call the help desk at the number you already know.

Reduce the blast radius with stronger MFA

Verification procedures stop the phone call; the right MFA limits what a mistake can cost. Passkeys and hardware security keys cannot be read over the phone, and conditional access can require a compliant company device before any sign-in succeeds — so even a successful reset does not hand over a usable account from an attacker’s laptop.

A help desk that verifies first

Equal Tech Solutions’ managed IT help desk verifies every password and MFA reset with call-backs and manager approval, and our cybersecurity team monitors for the account changes that follow a successful con. If your support process currently runs on “they sounded legitimate,” talk to us about tightening it before someone tests it.