When Password Resets Become the Front Door: The Rise of Help Desk Attacks

Key points

• Attackers are shifting from cracking multi-factor authentication, the second login step that asks for a code or app approval, to tricking the service desk staff who reset it.
• Social engineering calls to IT help desks let criminals reset passwords and MFA devices without ever touching the victim's real credentials.
• Recent high-profile intrusions at large hotel and casino operators started with a phone call to the help desk, not a technical exploit.
• Stronger identity checks at the point of recovery, not just at the point of login, are the fix most companies still have not made.
• Training help desk staff to expect and refuse these calls is as important as any software control.

For years, the security advice has been simple: turn on multi-factor authentication. Add a code from your phone, a tap on an app, a hardware key. Make stolen passwords useless on their own.

It worked. So the criminals moved.

They are now going after the process you use when you lose your phone or forget your password: account recovery. Ring the IT help desk, sound convincing, and a helpful agent will reset the account for you. No hacking required.

What is actually happening?

Attackers are calling company help desks, pretending to be an employee locked out of their account, and asking staff to reset the password and register a new MFA device. If the agent agrees, the criminal now owns the account outright, with a fresh second factor pointing at their own phone.

This is not a software flaw. It is a people-and-process flaw. The login system is doing exactly what it was built to do. The recovery system is the weak spot, and it usually sits with a human under pressure to be helpful and fast.

BleepingComputer flagged the pattern in a recent explainer with password-security vendor Specops, and the shift lines up with what incident responders have been seeing all year.

Who has been hit this way?

The attack style got its most famous outing in the 2023 breaches at MGM Resorts and Caesars Entertainment, where intruders reportedly called the help desk, posed as employees, and walked out with access that eventually cost the companies hundreds of millions of dollars. Similar tactics have hit retailers, insurers and tech firms since.

The common thread is boring. Not zero-days. Not exotic malware. A phone call.

Why is the help desk such a soft target?

Help desk agents are measured on speed and customer satisfaction. Their job is to unblock people. A caller who sounds stressed, knows the employee's name, department and manager, and rattles off a plausible reason for needing a reset is exactly the kind of person they are trained to help.

Attackers know this. They scrape LinkedIn for names and reporting lines. They spoof internal phone numbers. Some now use AI voice cloning to sound like a specific employee whose voice appears in a podcast, a webinar, or a company video.

In web-security terms, think of it as the identity equivalent of a password-reset link that never checks who clicked it. The front door is bolted. The side gate is on the latch.

What should companies actually change?

The fix is to treat account recovery with the same suspicion as a new login from an unknown country. That means verifying the caller through something the real employee has, not something an attacker can guess or find online.

Options include a one-time code sent to a manager for approval, a video call with ID check for sensitive accounts, callbacks to the number on file rather than the number that called in, and knowledge questions based on HR data rather than public information. Some organisations require a second agent to approve high-risk resets.

And the humans need practice. Help desk staff should be drilled on refusing plausible-sounding requests, the same way finance teams are drilled on fake invoice emails.

What can ordinary employees do?

If your company sends a message saying your password or MFA was reset and you did not ask for it, report it immediately. That alert is often the only sign that someone else has just taken your account. Do not assume it is a glitch.

MFA is still worth having. It just is not the finish line anyone once hoped it was.