Some companies see cybersecurity as a cost center. We see things a little different. LEARN MORE >
Experiencing a Breach?
BLOG
Threat Brief: Service Desk Social Engineering
MFA and Password Reset Fraud
Key Takeaways
- Attackers are calling IT service desks. They pose as employees and talk agents into resetting passwords and MFA.
- MFA alone doesn’t stop it. The attack targets the reset process and the people who run it.
- One approved reset is enough. Attackers can take over the account within minutes, leading to payroll fraud, data theft and phishing from a trusted address.
- Detection starts with the reset. A password reset followed within minutes by a new MFA device registration is the main sign of a takeover.
- Prevention means a process callers can’t talk past. Call back on numbers already on file, deliver temporary access passes and limit access to company-managed devices.
- Inversion6 can help. MDR and IR clients can have their recent resets and sign-in activity reviewed.
Here at Inversion6, we’re tracking an uptick in social engineering attacks on our client’s IT service desks.
Criminals are calling IT service desks, pretending to be employees, and talking agents into resetting the employee’s password and multi-factor authentication (MFA).
This attack relies on persuading a person. That means strong passwords and MFA alone do not stop it.
One approved reset hands the attacker the account, often within minutes. From there, they can read email, open files, change payroll bank details, and send phishing emails from the victim’s trusted address. We’re seeing this across multiple organizations right now.
We’ve put together this threat brief to help security teams and leadership understand how these attacks work, spot the warning signs, harden service desk processes, and communicate the risk across the organization.
Read the full Service Desk Social Engineering Threat Brief below.
Executive Summary
Service desk social engineering is an account takeover technique. Attackers call an organization’s IT service desk, pose as an employee, and persuade an agent to reset that employee’s password and MFA.
The attack targets the reset process and the people who run it. Attackers research their target ahead of time, arrive with a plausible reason for the reset (often a new or lost phone), and apply pressure to act quickly. They are able to answer most common identity validation questions.
Once a reset is approved, the attacker registers their own device and operates on the employee’s access. That can lead to payroll fraud, theft of sensitive email and files, and phishing sent to customers and partners from a trusted company address.
| Attack Type | Social engineering via phone impersonation |
|---|---|
| Entry Point | IT service desk password and MFA reset process |
| Objective | Full account takeover |
| Speed | Attacker device often registered within minutes of a reset |
| Controls Bypassed | Strong passwords and MFA |
| Most Likely Targets | Executives, finance, HR, and payroll staff |
Organizations may face higher risk if they:
- Approve password and MFA resets based on information a caller provides
- Use outsourced, offshore, or after-hours service desk providers
- Allow new MFA methods to be registered from any network or device
- Let employees reach email, files, and payroll systems from unmanaged devices
Key Recommendations
- Confirm every recent reset. Review all password and MFA resets from the last 30 days and verify each one with the employee through a separate channel.
- Verify callers through channels they can’t control. Call employees back on a number already on file, and require a second confirmation for MFA resets.
- Change how resets are delivered. Issue a one-time temporary access pass and notify the employee and their manager through a separate channel.
- Limit what a reset account can reach. Restrict MFA registration and access to sensitive systems to company-managed devices, and move high-risk users to phishing-resistant MFA.
- Prepare your people. Brief every service desk team, including outsourced and after-hours providers, and test them with simulated impersonation calls.
How the Attack Works
Attacks we’ve seen have worked as follows:
| Stage | What Happens |
|---|---|
| 1. Research the target | The attacker picks an employee and may try the self-service password reset page to confirm the account exists and see which recovery methods it has. |
| 2. Call the service desk | Posing as the employee, the attacker asks for a password and MFA reset, often with a plausible reason such as a new or lost phone, and pressure to act quickly. |
| 3. Get the reset approved | Attackers are able to answer most common identity validation questions. After this happens, the agent resets the password and removes the employee’s MFA. |
| 4. Take over the account | The attacker registers their own phone as the employee’s sign-in device, often within minutes, and the account is now theirs. |
| 5. Use the access | From there the attacker reads email, opens files, signs in to company apps, changes payroll bank details, and sends phishing emails to customers and partners from the victim’s trusted address. |
| 6. Cover their tracks | Attackers often delete the reset ticket notices and other alert emails so the employee doesn’t notice what happened. |
One approved reset gives the attacker a working account; everything after it runs on the employee’s own access. That’s why detection focuses on the reset itself and what happens in the minutes after it.
Detection Actions (Next 24 Hours)
Organizations should take steps to detect social engineering attempts against their service desks. The steps below follow the patterns seen in recent cases.
Review Recent Credential Resets
- Pull every password and MFA reset the service desk performed in the last 30 days, and confirm each one with the employee through a channel other than the one used to request it.
- Look for a password reset followed within minutes by a new MFA device registration on the same account. That combination is the main sign of a takeover.
- Check whether any reset tickets were raised and then quickly closed, and whether the ticket notification emails were deleted from the user’s mailbox. Attackers delete these to hide the reset.
Watch for Warning Signs in Sign-in and Audit Logs
| Warning Sign | Action |
|---|---|
| New MFA registration | Alert on new MFA methods registered from outside the corporate network, from a new device type, or within an hour of a reset. |
| Mismatched device type | Examine new MFA registrations for devices outside the user’s normal type. For example, an iPhone registered when the user normally uses Android. |
| Abandoned self-service resets | Review self-service password reset attempts that stop after the user is shown their verification options. Attackers use this to confirm an account exists and see which recovery methods it has, sometimes hours before calling the service desk. |
| Unusual sign-in properties | Flag sign-ins with no registered device, from hosting providers or unfamiliar internet providers, or with browser versions that don’t exist (for example, version numbers ending in .1.1). |
| Simultaneous locations | Watch for one account signed in from several unrelated locations at the same time. |
Check Mailboxes and Business Systems
- Search all mailboxes for new inbox rules, forwarding to external addresses, and bulk deletion of emails.
- Ask payroll and HR to review direct deposit and bank detail changes made in the last 30 days, and confirm any recent change directly with the employee.
- Check for unusual outbound email from internal accounts, especially messages with many recipients in the BCC field.
- Look for unusual email patterns, such as a large spike in sent emails in a short time period.
Brief the Service Desk
- Tell all service desk staff, including outsourced or after-hours providers, that these calls are happening now.
- Ask them to report any caller who pushed for an urgent reset, could not answer verification questions, or called from an unfamiliar number.
- Be wary of reset calls that come into offices or regions the user does not work at. This could be the threat actor using the service desk’s unfamiliarity with the user to their advantage.
Prevention Actions
The most effective fix is a service desk process that a convincing caller cannot talk their way through. Technical controls then limit the damage if one does.
Harden Service Desk Identity Verification
- Treat information a caller provides as unverified. Names, employee IDs, managers, birth dates, hire dates, and the last four digits of a phone number are easy to find or guess, and should never be enough on their own to approve a password or MFA reset.
- Call the employee back on a phone number already on file in HR or the directory, never a number the caller gives. If the number on file is the one being changed, escalate.
- Require a second confirmation for MFA resets: approval from the employee’s manager, reached independently, or a live video call where the agent compares the employee to their ID or HR photo.
- Where available, verify identity through a push or code sent to a device the employee has already registered, or through an identity verification service.
- Give agents explicit permission to refuse and escalate, without penalty, when a caller is pushy, claims urgency, or can’t pass verification. Attackers rely on pressure.
- Apply the same rules to outsourced, offshore, and after-hours service desks, and include them in testing.
- Require stricter checks, such as two approvers, for executives, finance, HR, payroll, and IT administrators.
Change How Resets Are Delivered
- Issue a one-time temporary access pass instead of setting a new password and clearing MFA. The employee then registers their own device.
- Notify the employee and their manager through a separate channel, such as SMS or Teams, whenever MFA or a password is reset, so a fraudulent reset is noticed quickly.
Limit What an Attacker Can Do with a Reset Account
- Allow new MFA methods to be registered only from the corporate network or a company-managed device.
- Require a company-managed device to reach email, file storage, and HR and payroll systems. In recent cases, every attacker session came from an unregistered device.
- Move high-risk users to phishing-resistant MFA, such as FIDO2 security keys or passkeys.
- Put HR and payroll systems behind single sign-on, and require a waiting period or call-back confirmation before a new bank account receives pay.
- Block employees from saving passwords to company systems in their browser, or turn off browser sync for corporate accounts. Synced passwords can give an attacker access to systems outside single sign-on.
Test and Train
- Run a simulated impersonation call against the service desk within 30 days and repeat it each quarter.
- Give service desk staff short, scenario-based training on recognizing pretext calls.
Communication Points
Clear communication helps leadership support stricter controls and helps employees recognize an attack in progress. Use the points below as a starting point.
For Executive Leadership
- Attackers are impersonating employees on calls to IT service desks to get passwords and MFA reset. We are seeing this across multiple organizations right now.
- The weakness is in our reset process. A convincing caller can bypass MFA if the service desk is willing to reset it.
- A successful attack can lead to payroll fraud, theft of sensitive email and files, and phishing sent to customers and partners from a trusted company address.
- We are reviewing recent resets and sign-in activity today, and tightening how the service desk verifies callers.
- Stricter verification will make some legitimate resets slower. That is intentional, and we ask leadership to support it, including when executives themselves need a reset.
- Executives, finance, HR, and payroll staff are the most likely targets, and will be asked to use stronger sign-in methods.
For End Users
- Criminals are calling our IT service desk pretending to be employees, to take over their accounts.
- IT will never ask for your password or an MFA code. Keep them to yourself, even if someone says they are from IT.
- If you get an MFA prompt, a password reset notice, or a new sign-in alert you didn’t expect, report it to IT immediately.
- If someone calls claiming to be from IT and asks you to approve a prompt or share a code, hang up and call the service desk on the number you already know.
- Expect stricter identity checks when you ask for a password or MFA reset, such as a call back to your phone number on file or a manager confirming your request. These checks protect your account.
- Check your pay stub, and tell HR or payroll straight away if your bank details look different.
- Be aware of what information you make publicly available. For example, LinkedIn makes it easy to find a hire date, so restrict your profile information to your connections.
How Inversion6 Can Help
Managed Detection and Response (MDR) and Incident Response (IR) clients: contact your Inversion6 team through your usual channel. We can review recent service desk resets and sign-in activity in your environment, help tune alerts for the warning signs above, and investigate any account you suspect has been taken over.
Not an Inversion6 client? If you suspect an account in your environment has already been taken over, contact our Incident Response team.
