Attackers are phoning IT help desks, posing as staff and getting passwords reset, which skips the strong login protections many companies spent years building.
Scammers have found an easy way around strong login security: they call the IT help desk and pretend to be an employee. If the agent believes them, the attacker gets a password reset or a new device registered on the account. No hacking is needed. The warning comes from a BleepingComputer article sponsored and written by Specops Software, a company that sells help desk security tools.
Many companies protect logins with multi-factor authentication, which asks for a second proof of identity, such as a code on a phone. But when someone is locked out, the help desk often steps in. Too often it checks identity with questions like the name of the person's manager or their department. Attackers can skip the login protections by passing that weaker check. Groups such as Scattered Spider have made the service desk a preferred target.
Attackers can learn a lot before they dial. LinkedIn profiles, company websites, social media and leaked data can reveal job titles, colleagues, office locations and personal details. That is enough to answer the usual questions correctly. NIST, the US standards body, no longer accepts security questions as a proper way to prove identity. Knowing facts about someone is not proof of who is calling.
AI makes it worse. Attackers can use it to write believable stories, hold natural-sounding conversations and even imitate an employee's voice. The article says agents can no longer rely on how convincing a caller sounds.
Any organization whose help desk verifies callers with personal or workplace questions is exposed. That includes small and midsize businesses that handle resets by phone. Companies that already require a stronger, consistent check before any reset are in a better position. Ordinary employees do not need to change anything, but they should know that a call or text claiming to be from IT can be part of a scam.
The alert box above lists the steps. The core idea is to make identity checks a required step, not a judgment call. Agents should also feel free to refuse or escalate anything that feels off. Secure self-service recovery can mean fewer people need to call at all.
The article does not name any specific company that was breached this way. It also comes from a vendor with a product to sell, so the cost figures and the pitch for its tool are the company's framing. The basic risk is still clear: a convincing voice on the phone should never be enough to unlock an account.
If your help desk resets passwords by phone, replace questions like a manager's name with a required identity check before any reset or new device.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
