When Password Resets Become the Front Door: The Rise of Help Desk Attacks

Key points

• Attackers are shifting from cracking multi-factor authentication (the second login step that asks for a code or app approval) to tricking the service desk staff who reset it.
• Social engineering calls to IT help desks let criminals reset passwords and MFA devices without ever touching the victim's real credentials.
• High-profile 2023 intrusions at large hotel and casino operators started with a phone call to the help desk, not a technical exploit.
• Stronger identity checks at the point of recovery, not just at the point of login, are the fix most companies still haven't made.
• Drilling help desk staff to refuse these calls matters as much as any software control.

For years, the advice has been simple: turn on multi-factor authentication. Add a code from your phone, a tap on an app, a hardware key. Make stolen passwords useless on their own.

It worked. So the criminals moved.

They're now going after the process you use when you lose your phone or forget your password: account recovery. Ring the IT help desk, sound convincing, and a helpful agent will reset the account. No hacking required.

What is actually happening?

Attackers call company help desks, pretend to be an employee locked out of their account, and ask staff to reset the password and register a new MFA device. If the agent agrees, the criminal owns the account outright, with a fresh second factor pointing at their own phone.

This isn't a software flaw. It's a people-and-process flaw. The login system does exactly what it was built to do. The recovery system is the weak spot, and it usually sits with a human under pressure to be helpful and fast.

BleepingComputer flagged the pattern in a recent explainer with password-security vendor Specops, and it lines up with what incident responders have seen all year. We first covered help-desk identity exploitation on 25 August, when criminals were already using the same logic against hiring desks.

Who has been hit this way?

The attack style got its most famous outing in the 2023 breaches at MGM Resorts and Caesars Entertainment, where intruders reportedly called the help desk, posed as employees and walked out with access that eventually cost the companies hundreds of millions of dollars. Similar tactics have hit retailers and insurers since.

The common thread is boring. Not zero-days. A phone call.

Why is the help desk such a soft target?

Help desk agents are measured on speed and customer satisfaction. Their job is to unblock people. A caller who sounds stressed, knows the employee's name and manager, and rattles off a plausible reason for needing a reset is exactly the kind of person they're trained to help.

Attackers know this. LinkedIn gets scraped for names and reporting lines; internal phone numbers get spoofed. Some now use AI voice cloning to impersonate a specific employee whose voice appears in a company video or podcast.

Think of it as the identity equivalent of a password-reset link that never checks who clicked it. The front door is bolted, and the side gate is unlatched.

What should companies actually change?

Treat account recovery with the same suspicion as a new login from an unknown country. Verify the caller through something the real employee has, not something an attacker can find online.

Options include a one-time code sent to a manager for approval, a video call with ID check for sensitive accounts, callbacks to the number on file rather than the number that called in, and knowledge questions drawn from HR data rather than public information. Some organisations require a second agent to approve high-risk resets.

The humans need practice too. Help desk staff should be drilled on refusing plausible-sounding requests, the same way finance teams are drilled on fake invoice emails.

What can ordinary employees do?

If your company sends a message saying your password or MFA was reset and you didn't ask for it, report it immediately. That alert is often the only sign that someone else has just taken your account. Don't assume it's a glitch.

MFA is still worth having. It just isn't the finish line anyone once hoped it was.

Should you worry?

The pattern here is straightforward and that's exactly what makes it dangerous. Attackers don't need novel malware when a confident phone call will do. The MGM and Caesars incidents showed what the bill looks like when recovery processes get no scrutiny. Every org that hardened its login page and left its help desk on the latch is making the same bet those companies lost.