Helpdesk Social Engineering

Helpdesk social engineering targets the human element of identity verification processes. Attackers impersonate employees, contractors, or customers and contact helpdesk or customer service personnel with a plausible story — locked out of an account, travelling abroad, urgent deadline — to pressure staff into resetting passwords, disabling MFA, or providing account access without proper verification.

Helpdesks are attractive targets because their primary function is to assist users quickly, creating cultural and operational pressure to resolve issues with minimal friction. Attackers research targets via LinkedIn and social media to provide convincing personal details that pass basic identity checks, and may invoke urgency or authority to short-circuit verification procedures.

Organisations should enforce strict identity verification protocols for all account recovery actions, require out-of-band confirmation for sensitive changes, implement separation of duties (no single helpdesk agent should be able to disable MFA and reset a password in one call), and train staff to recognise and resist social pressure tactics.