How to Protect Help Desks and Employees From Impersonation Attacks

A routine IT support call might seem like an unlikely starting point for a major cyberattack. But in 2023, hackers reportedly gained access to MGM Resorts’ systems by impersonating an employee in a call to the company’s help desk. The resulting breach disrupted casino operations, hotel room access and payment systems, demonstrating how a seemingly ordinary support interaction can have serious business consequences.

The threat has since flipped direction: Instead of posing as employees to fool the help desk, attackers are now posing as the help desk to fool employees. In a series of 2026 extortion campaigns, callers impersonated IT support staff, sometimes spoofing the company’s real help desk number. They reached employees on personal phones, outside corporate security controls, and pressed them to complete an urgent passkey or multifactor authentication enrollment. Victims were steered to lookalike login pages that captured both their passwords and MFA tokens, giving attackers access to corporate cloud services from which they stole data for extortion.

Such attacks expose a troubling weakness: The more organizations train employees to cooperate with security changes, the easier it becomes for criminals to disguise an attack as a legitimate update. The challenge for businesses is to make sensitive support interactions more trustworthy without making assistance frustrating or time-consuming. Employees need confidence that requests are authentic, while IT teams need to resolve account problems and restore access without unnecessary delays. Members of the Senior Executive Cybersecurity Think Tank bring expertise in identity security, risk management and enterprise cyber defense to this challenge. Below, they explore how organizations can strengthen verification across help desk, identity enrollment and account recovery processes while keeping support efficient and accessible.

“Move recovery to self-service flows anchored in something the attacker cannot obtain by phone: a registered device, a hardware key, a biometric on an enrolled phone.”

– Harikrishnan Muthukrishnan, Principal IT Developer at BCBS FLORIDA

SHARE IT

Keep Credentials Out of the Help Desk

Harikrishnan Muthukrishnan, Principal IT Developer at BCBS FLORIDA, believes organizations should reconsider how much control support agents have over sensitive credentials.

“The strongest redesign is one where the help desk cannot hand over anything worth stealing,” Muthukrishnan says. “If support staff can read or reset a credential over a call, that capability will eventually be socially engineered, either through the employee or through the agent.”

He recommends a different division of responsibility between employees and IT support staff.

“Move recovery to self-service flows anchored in something the attacker cannot obtain by phone: a registered device, a hardware key, a biometric on an enrolled phone,” he says. “The help desk’s role becomes unlocking that flow, not performing it. Legitimate employees experience a familiar app prompt instead of a scripted interrogation, and speed improves because the agent no longer has to make judgment calls.”

Muthukrishnan sees this approach as a way to improve both safety and efficiency.

“Security and convenience stop competing once the human is removed from the credential path entirely.”

Set Firm Boundaries for Support Requests

Ken Grohe, President of LeverageGTM, Inc., draws on more than 35 years of experience in the SaaS, IT and security industries. He asserts that “organizations can block social engineering loops without introducing painful bottlenecks into legitimate IT workflows by deploying targeted strategies.”

Grohe goes on to outline two safeguards for routine support interactions.

“First, implement cryptographic and visual identity verification,” he says. “Second, establish a rule that the help desk will never process changes from a personal cell phone or an unverified chat platform.”

Grohe also recommends establishing a simple but clear protocol for employees who receive unexpected requests.

“If an urgent security migration call occurs, mandate that employees hang up and contact a pre-saved, officially published company hotline to confirm the request.”

“Organizations need to rethink their processes to ensure employees never rely on a phone call alone to verify a sensitive request.”

– Bhavya Bhandari, Cybersecurity Risk Management Leader, Financial Services at Ernst & Young US LLP

SHARE IT

Take Urgency Out of Verification

Bhavya Bhandari, Cybersecurity Risk Management Leader, Financial Services at Ernst & Young US LLP, has more than 15 years of experience leading security, regulatory and risk transformation initiatives. He points to an ever-present area of concern in cybersecurity: human error.

“In many of these attacks, the attackers are not breaking technology; they are exploiting trust and urgency,” he says.

The danger is evident in the 2025 cyberattack against British retailer Co-op, in which attackers impersonated an employee, answered security questions and convinced support staff to reset an account’s credentials. The incident illustrates how even established verification procedures can be undermined by convincing impersonation.

“Organizations need to rethink their processes to ensure employees never rely on a phone call alone to verify a sensitive request,” Bhandari says. “Effective approaches use trusted corporate channels, built-in verification and clear escalation paths. This helps employees quickly validate legitimate support requests while making it harder for attackers to impersonate the help desk.”

Make Secure Support Predictable

Kumar Ritesh, Founder, Chairman and CEO of CYFIRMA, brings experience spanning national cyberintelligence operations and enterprise cybersecurity leadership. He says the fix for impersonation attacks isn’t more training; it’s removing an employee’s ability to be socially engineered in the first place. He describes how organizations can put that principle into practice.

“Route help desk and account recovery through pre-verified, out-of-band channels employees already trust—never inbound calls or texts claiming urgency, even when they come to personal phones,” Ritesh says. “For high-risk actions like credential resets, require the kind of verification an attacker can’t spoof: manager attestation, hardware token or a callback to a number on file, not one the caller provides.”

Drawing on his cyberintelligence background, Ritesh also emphasizes the importance of preparing employees for the tactics attackers are currently using.

“Layer in threat-led awareness: Use real, current extortion and impersonation campaigns, not generic modules, so employees recognize the pattern instinctively, rather than reasoning through urgency in the moment,” he says. “Predictable, branded IT communication makes anything outside that pattern instantly suspicious.”

His bottom line: “Speed comes from prebuilt verification paths, not judgment calls under pressure.”

Closing the Gaps: Practical Ways to Stop Help Desk Impersonation

• Remove sensitive credentials from help desk workflows. Don’t give support agents the ability to disclose or directly reset credentials over the phone, where they can be manipulated by impersonators.
• Make secure self-service recovery the default. Use registered devices, hardware keys or enrolled phone biometrics to let employees verify their identities without relying on an agent’s judgment.
• Require reliable identity verification for support requests. Incorporate cryptographic and visual verification methods, and prohibit sensitive account changes through personal phone calls or unverified chat platforms.
• Give employees a trusted way to confirm unexpected requests. Publish an official IT support hotline and instruct employees to hang up and call that number if they receive an unsolicited request for an urgent security update.
• Build verification into routine support processes. Use trusted corporate channels and established identity checks so employees don’t have to decide whether a convincing caller is legitimate.
• Establish clear escalation paths for suspicious requests. Give employees a straightforward way to flag and verify questionable communications without creating unnecessary delays in legitimate support.
• Strengthen verification for high-risk account changes. Require manager confirmation, hardware tokens or callbacks to numbers already on file before authorizing sensitive actions such as credential resets.
• Make legitimate IT communications familiar and recognizable. Standardize support communications and use examples from current impersonation campaigns to help employees recognize suspicious deviations.

Making Secure Support the Path of Least Resistance

Protecting employees from IT support impersonation attacks requires more than reminding them to be skeptical of unexpected requests. Organizations need to reduce opportunities for deception by removing credentials from vulnerable support interactions, establishing dependable verification methods, and making secure account recovery easy to navigate. Clear communication standards and practical, threat-focused awareness can further reinforce these safeguards.

As attackers become more convincing in their impersonation tactics, the design of everyday support processes will play an increasingly important role in enterprise security. Businesses that make legitimate assistance both easy to access and difficult to impersonate will be better positioned to prevent costly breaches without sacrificing employee productivity.