A help desk scam is a social engineering attack in which a criminal impersonates an employee — sometimes in person, more often by phone, email or chat — to convince your IT help desk to hand over access: a password reset, an MFA enrolment, a security code, or approval of a login the real employee never made. The attacker does not need to hack anything. They need your service desk to do its job for the wrong person. The FBI and CISA documented the Scattered Spider criminal group running exactly this play against organisations worldwide — calling help desks, posing as staff, and walking away with valid credentials (CISA advisory AA23-320A). For a small business, the help desk is one person or an outsourced team — and the same scam works just as well against a two-person IT function as a two-hundred-person one.
TL;DR
- A help desk scam is identity fraud aimed at your IT support: impersonate an employee, get a password reset or MFA approved.
- It defeats MFA entirely — the attacker never needs the employee's device or code, only the reset process.
- The Scattered Spider criminal group runs it as a standard first step against real organisations, as documented by the FBI and CISA.
- The fix is identity verification built into the reset process, plus training for the people who answer the phone.
- Voice cloning makes the classic "the boss is in a meeting" call far harder to spot — verification must not depend on a familiar voice.
What a help desk scam looks like, step by step
- Research. The attacker gathers names, roles, email formats and schedules from LinkedIn, your website and breach dumps. They learn who is travelling, on leave, or new — anyone hard to reach for a confirmation.
- Contact. They call, email or chat the help desk as that person. A phone number that reaches reception, a display name that matches a real employee, or a chat request from an email address one character off the real one.
- The story. Urgency plus a plausible barrier: "I'm about to board a flight", "my phone died and I have a client demo", "the code isn't arriving". Sometimes they fumble the first attempts on purpose so the reset looks like the employee's fault, not the attacker's.
- The grant. The help desk resets the password, enrolls a new MFA method the attacker controls, or reads out a security code. The attacker now owns a legitimate account with legitimate access.
- The move. Within minutes they register their own MFA device, create inbox rules to hide their tracks, and move toward the real goal: payments, client data, or the next account up the chain.
Why it defeats MFA and every other technical control
Multi-factor authentication assumes the request comes from the real person. A help desk scam breaks that assumption at the weakest point: the identity-verification step in front of the reset. The employee's phone, their fingerprint, their authenticator app — none of it is involved, because the attacker replaces the employee in the conversation. MFA fatigue attacks and credential stuffing both target the login flow; the help desk scam targets the recovery flow, which every business must keep usable for genuine staff.
The FBI-CISA advisory describes the pattern across dozens of organisations: the attackers call the help desk, obtain credentials, enroll their own MFA, and in some documented cases escalated to network-wide access within days. The technical defences held; the human process was the door.
The verification checklist for help desk staff
| Verify | How | Catches |
|---|---|---|
| The person | Video call or a scheduled callback to the number already on file — never a number supplied in the request | Impersonation, voice cloning, caller-ID spoofing |
| The knowledge | Internal details only a genuine employee knows (recent project, manager, device) | Read-off-the-website impersonators |
| The context | Check the ticket against HR records: is the person employed, on leave, travelling? | Stolen employee lists from breach dumps |
| The pattern | Escalate anything unusual — first request, rushed, refused callback, new device enrolment | Everything the first three miss |
One rule outweighs the rest: a password reset or MFA change is never granted on the strength of a single phone call or chat message. Voice cloning has ended the era when a familiar voice was verification — the same reasoning that stops deepfake payment scams applies to IT support calls.
What management must put in place
- A written reset procedure. Every password reset and MFA change follows the same verification steps, with no exceptions for executives or urgency. The procedure is the defence — not the judgement of whoever picked up the phone.
- A manager approval path. New MFA device enrolments require confirmation from the employee's manager, especially when the employee has not opened a ticket themselves.
- Alerting on the sensitive actions. Password resets, MFA enrolments and privilege changes should generate a notification to the real employee and to IT — so a fraudulent reset is visible in minutes, not days.
- Training for the help desk team. They are the targets, and they need the scenarios rehearsed: the rushed call, the travelling employee, the "security team" caller who cites policy. Security awareness training should include a dedicated module for IT support roles, not just general staff.
- The same discipline everywhere else. A help desk scam is pretexting aimed at IT instead of finance — the same verify-by-second-channel habit that stops vendor impersonation stops help desk fraud too.
How the scam reaches small businesses differently
A small business may have no formal help desk at all — the "IT department" is an owner, an office manager, or an outsourced provider's ticket queue. That changes the scam's shape, not its danger:
- The outsourced provider's queue is the front door. Whoever answers it sees dozens of requests a day and knows your staff only by name and email address. Ask the provider what identity checks sit in front of a password reset — if the answer is "we email the address on file", the verification is exactly one breach dump away from worthless.
- The office manager wears two hats. The person who resets passwords may also be the person who pays invoices — which means one convincing phone call can yield both an account and a payment. Split the duties, or at minimum require a second approver.
- Small teams know each other's voices. That comfort is the vulnerability. With voice cloning, familiarity is no longer evidence — write the procedure so it does not depend on recognition.
A security gap assessment should include the reset process as a named control, and human risk reporting can track whether IT and admin staff complete the verification training the rest of the workforce gets.
FAQ
What is a help desk scam in simple terms? An attacker pretends to be your employee and convinces IT support to reset a password, approve a login or enroll a new MFA device — handing over access without any hacking.
How is a help desk scam different from phishing? Phishing targets the employee with a fake message. A help desk scam targets your IT support with a fake identity. Both are social engineering — the direction of the deception is what differs.
Does MFA stop a help desk scam? No. MFA protects the login flow; the scam targets the recovery flow, where a reset is granted after an identity conversation. A new MFA enrolment controlled by the attacker makes the stolen access permanent.
How do we verify identity for a password reset? Callback to a number already on file (video preferred), knowledge checks against internal records, and manager confirmation for any new MFA device. Never rely on caller ID, email display names or a familiar voice.
Are help desk scams actually used by real attackers? Yes — the FBI and CISA documented the Scattered Spider group using help desk impersonation as a standard entry step: spearphishing calls convincing IT help desk personnel to reset passwords and MFA tokens, followed by account takeover.
What should a help desk worker do if they suspect a scam? Grant nothing, end the conversation politely, and report the attempt immediately. A suspected impersonation is an incident signal: the caller probably holds breached data about your staff.
One last thing
Ask your help desk — internal or outsourced — one question this week: "What do you check before resetting a password?" If the answer involves only an email address or a caller ID, the reset path is open, and the fix is a one-page written procedure that every reset follows, no exceptions.