When the help desk is the way in
Apr 30th, 2025 by Jesper Kråkhede
This spring several large British retailers were hit hard by cyberattacks. One had to stop online sales for weeks, another saw empty shelves in its stores. According to reporting, the attackers got in by calling the IT help desk, pretending to be employees and convincing staff to reset passwords and MFA.
No zero-day. No advanced malware. A phone call.
This is a business problem more than a technical one. Help desks are measured on speed and customer satisfaction. Their job is to help people who are locked out, quickly and politely. That is exactly what the attackers exploit. And many help desks are outsourced, sometimes with staff who don´t know the people they are helping.
So for management: look at the process, not just the technology. How does your help desk verify who is calling before resetting a password or MFA? Is it enough to know a name, an employee number and a manager´s name, all of which can be found online? Is there a stricter process for admins and executives? Are outsourced help desks held to the same standard?
Better processes exist. Verification through a known channel, like a call back to a registered number or a video call with ID. Requiring a manager to approve a reset. Temporary access passes instead of resetting everything. And extra checks for privileged accounts.
They will feel slower. That is the point.
The friendliest person in your company is also the easiest to fool. Give them a process that protects them.