IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Fake help-desk calls
At 9 p.m. a caller phones the help desk: "I am Priya from finance. I lost my phone. Please move my MFA to my new one." The voice is calm. The employee ID and the birthday are right. Your goal: see why a kind help desk is a door for attackers, and name the rules that keep it shut.
- Attackers phone the help desk and pose as a locked-out employee.
- What a caller knows is not proof. IDs and birthdays are easy to find.
- Verify on a channel you choose, never one the caller gives you.
- Give real staff a safe way back, and bend no rule for rank or hurry.
Why attackers call
A locked-out person is stressed and wants a fast answer. Attackers know this. They do not need malware, only one thing: the help desk moving Priya's MFA to a phone that they hold. After that, they sign in as Priya.
This is social engineering: tricking a person, not a computer. A passkey does not help if a phone call can reset it. See recovery attacks.
Why a good voice is not proof
Before they call, the attacker does homework. The employee ID comes from an old email signature. The birthday comes from social media. The number on the screen can be faked, so it looks like Priya's own. Each piece looks like proof to a tired agent. Even a voice can be copied by software, so "it sounds like her" proves nothing.
a school exam hall. A student says, "I lost my hall ticket, but my roll number is 4521." The invigilator does not decide alone. The student goes to the school office, which checks its own admission record and issues a new ticket. The check uses the school's records, not the student's words, and the student still sits the exam.
Rules that do not bend
Do not rely on a brave agent. Give the whole desk rules that are the same on every call.
- What the caller knows is not proof. Never use knowledge questions such as birthday, ID or mother's maiden name.
- Verify on a channel you choose. Push to the enrolled device, or call back a number already on file, or reach the manager through the directory. Never use a number the caller gives, and never text a code to the number on the account: it may be the swapped one.
- Risky resets need a stronger check. For an admin account, ask for a second approver. A video call with an ID can help. But video can be faked, so add a second approver or an in-person check.
- No exceptions for rank or hurry. A real executive can wait ten minutes. Pressure is the tell.
- Make it slow and loud. Add a cooling-off delay before the new device can do sensitive acts. Tell the owner on every channel. Log it.
- Keep a safe way back. A real employee with a lost phone still gets help the same day. A rule that only says "no" gets bent.
The agent resets nothing. The agent sends a push to Priya's enrolled phone and calls her manager on the directory number. At home, the real Priya sees the push. She taps Deny and calls Zara. Zara locks the account.
Refusing is part of the job. Say: "I will check on our own channel." Never blame an agent who refuses, even when the caller was real. Staff who fear blame bend the rules.
🧪 Interactive lab — enable JavaScript to play with this one.
Go deeper: A real campaign
Real groups use this call. For the group known as Scattered Spider, see the CISA notes in recovery attacks.
In May 2025 the UK's NCSC told organizations to check how their help desk proves identity before password resets, most of all for staff with extra powers. This followed attacks on UK retailers where help-desk social engineering was suspected.
Go deeper: What to watch in the logs
A help-desk reset leaves a trail. Zara can write rules for these signs:
- An MFA reset followed within hours by a sign-in from a new device.
- A recovery email or passkey added soon after a reset.
- One agent doing many resets in a short time.
- Any reset on an admin account.
See Detection engineering and Account recovery.
Your best defense is a recovery route that needs no phone call. Grade your WebAuthn and passkey setup, including backup keys, with Passkey Check.