In short: Help desk social engineering is when an attacker contacts an IT service desk pretending to be an employee, often senior or locked out, to get a password reset, an MFA reset or a new device registered. Training gives service desk staff a strict identity verification procedure, the red flags to watch for and permission to refuse.
How help desk social engineering works
The IT service desk exists to help people regain access quickly, which is exactly what an attacker wants. A typical approach:
- The attacker researches a target employee using LinkedIn, the company website and data from previous breaches, collecting names, job titles, managers and staff numbers where available.
- They phone or message the service desk as that employee, often claiming to be travelling, on a new phone, locked out or in a hurry for a board meeting.
- They answer basic security questions with the researched details, and apply pressure: seniority, urgency, frustration or flattery.
- They ask for a password reset, an MFA reset or a new authenticator device to be registered.
- Once in, they move quickly to email, files and, if the account is privileged, administrative systems.
After incidents affecting UK retailers in spring 2025, the NCSC advised organisations to review their help desk password reset processes, including how the help desk authenticates staff before resetting passwords, with particular attention to accounts with escalated privileges such as domain, enterprise and cloud administrators.
Red flags for service desk staff
- A caller who cannot or will not use the normal self-service reset route
- Urgency tied to seniority: "I am the finance director and I need this now"
- A request to reset MFA or register a new device, rather than just a password
- A call-back number that is not the one in the company directory
- Requests involving administrator, finance or executive accounts
- Calls outside normal hours, or claims of being abroad with a new phone
- Pressure to skip a step "just this once", or anger when asked to verify
- Several reset requests in a short period, possibly for different users
A caller showing one of these is not necessarily an attacker, but it is the signal to follow the full verification procedure without shortcuts.
A strong identity verification procedure
Knowledge-based questions alone are weak, because the answers can often be found online. A stronger procedure layers several checks, with the strictest for privileged accounts:
| Check | How it works | Notes |
|---|---|---|
| Call back on a known number | End the call and ring the employee on the number held in the directory or HR system | Never use a number the caller provides |
| Verify with existing MFA | Ask the user to approve a push or enter a code from a device already registered to them | Not possible if they claim to have lost the device, which is when to escalate |
| Manager confirmation | The user's line manager confirms the request through a known channel | Useful for MFA resets and new devices |
| In-person or video check | Identity confirmed face to face, or on a video call against a known photo | Treat video with caution now that deepfakes exist; see deepfake awareness |
| Time-limited, single-use access | Issue a short-lived temporary credential, such as Microsoft Entra Temporary Access Pass, instead of a reusable password | Limits the damage if verification was fooled |
| Notification | Alert the user and their manager by email or a known number whenever a reset happens | A genuine user who did not ask will raise the alarm |
Privileged and executive accounts should need two independent checks and a second engineer's approval. Every reset should be logged with the checks performed.
Training the service desk
Service desk staff are measured on resolving tickets quickly, so the procedure must make security the expected behaviour rather than an obstacle. Effective training includes:
- Clear scripts for verification, including polite wording for refusing or pausing a request
- Explicit permission to say no, backed by management, even when the caller claims to be a director
- Role-play and scenario drills using realistic pretexts: the travelling executive, the locked-out new starter, the angry contractor
- Briefings on current techniques, including MFA fatigue, SIM swap claims and AI voice cloning
- Inclusion of outsourced or out-of-hours desks, which must follow the same rules as the in-house team
- Regular refreshers, plus a debrief whenever a suspicious call is logged
The wider workforce needs to know the other half of the picture: IT will never ask for your password, and you should report unexpected contact from "IT". See Microsoft Teams phishing awareness for the reverse attack, where criminals pose as IT.
Technical controls that reduce the risk
- Self-service password reset with strong methods, so fewer resets need a human at all
- Phishing-resistant MFA, such as passkeys and security keys, and number matching for push approvals; see password and MFA training and Cisco Duo Push
- Conditional access that blocks risky sign-ins even with valid credentials
- Alerts on MFA method changes and new device registrations, reviewed by the security team
- Separate administrator accounts, with stricter reset rules than everyday accounts
These are covered in more depth on our Microsoft 365 security page.
How we help
We review your service desk reset procedure against current guidance, write verification scripts, run role-play training for in-house and outsourced desk staff, and add help desk awareness to the wider social engineering training programme. We can also help you introduce self-service reset and phishing-resistant MFA so fewer resets are needed.
Contact us to strengthen your service desk against social engineering.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is help desk social engineering?
It is an attack in which someone contacts an IT service desk pretending to be an employee, to get a password reset, an MFA reset or a new device registered. It bypasses technical defences by exploiting the desk's job of helping people regain access.
How should a help desk verify a caller's identity?
Use several checks rather than security questions alone: call back on the number in the directory, verify with an MFA device already registered to the user, get manager confirmation, and apply stricter checks to privileged accounts. Log every reset.
What did the NCSC recommend about help desk resets?
After incidents affecting UK retailers in 2025, the NCSC advised organisations to review help desk password reset processes, including how staff are authenticated before resetting credentials, especially for accounts with elevated privileges.
Can MFA stop help desk social engineering?
MFA helps, but an attacker who persuades the desk to reset MFA or register a new device can get around it. That is why MFA resets need the strongest verification, and why alerts on MFA changes matter.
Should outsourced service desks be trained too?
Yes. Any desk that can reset your users' credentials, including an MSP or out-of-hours provider, should follow your verification procedure and receive the same training.