Fake IT Helpdesk Credential Scams
Attackers impersonate internal IT support to trick employees into resetting passwords, sharing credentials, or installing remote-access tools.
Last reviewed: 1 June 2026
What this scam is
Fake IT helpdesk scams target employees by impersonating an organisation's internal technology support team. The attacker contacts a staff member — by email, phone, or messaging platform — claiming to be from IT and citing a pressing technical reason to take an action: resetting a password, confirming credentials, clicking a 'system update' link, or installing a remote-access tool to 'fix' an issue.
These attacks are a form of vishing (voice phishing) and spear-phishing, and they sit at the boundary between cybercrime and social engineering. They require no technical sophistication to execute — only research into the organisation's structure, the names of IT staff, and enough plausibility to prompt a busy employee to comply without questioning.
Fake IT helpdesk attacks have been responsible for significant data breaches and financial frauds at organisations of all sizes. Employees who would never click an external phishing link may readily act on what appears to be a routine internal IT request.
How it works
The attacker first researches the target organisation. LinkedIn and company websites typically reveal the names of IT staff, department structures, and the names of business tools in use. This information is used to craft a convincing impersonation.
Contact is made by phone, email from a spoofed or look-alike domain, or through a messaging platform used by the organisation. The IT 'staff member' presents a plausible reason for the contact: a security update is being pushed, a compliance requirement must be met before the end of the day, there is suspicious activity on the employee's account, or a systems upgrade requires a password reset.
The employee is asked to click a link to a 'password reset portal' (which captures their current credentials), to install a 'diagnostic tool' (which is remote-access malware), or to read out a verification code they have received by SMS or authenticator app (which the attacker uses to access the account in real time).
In some cases, the attacker gains sufficient access to escalate privileges, access financial systems, or move laterally through the organisation's network before being detected.
Why this scam works
Fake IT helpdesk attacks succeed because employees are conditioned to comply with IT requests. IT does legitimately contact staff about system updates, password resets, and security issues. The frame of an internal support request bypasses the scepticism that an obviously external phishing email might trigger.
Authority and helpfulness combine to lower resistance: the IT staff member appears to be working for you, on your behalf, to fix a problem. Refusing to cooperate feels obstructive. Urgency prevents the pause needed to verify.
Remote working has amplified the vulnerability: employees who rarely see IT colleagues in person cannot verify identity through familiarity and may be more reliant on messaging and email, which are easier to impersonate.
Common red flags
- Unsolicited IT contact asking for a password or credential confirmation
- Request to click a link to a password reset portal you did not request
- Instruction to install software or a 'diagnostic tool' sent by a helpdesk contact
- Caller asks you to read out a code that has just arrived on your phone
- IT contact does not appear in your company directory or uses an external email
- Urgency: a compliance deadline, system failure, or security event must be resolved immediately
- Request to keep the action confidential from your manager or security team
Sanitized example messages
Illustrative, sanitized examples. Personal details are replaced with placeholders such as [phone number] and [fake link].
This is [IT team name]. We are migrating accounts today and need you to reset your password via this link to avoid being locked out: [fake link].
Hi [name] — IT here. Your device is flagging a security certificate issue. Can you install this diagnostic agent so we can push the fix remotely? [fake link].
We've detected suspicious login attempts on your account. To lock out the attacker, please read me the code that just appeared on your phone.
All staff need to verify their identity before the system update tonight. Please log in here and confirm your current password: [fake portal].
Common variations
- Email-based spear-phishing using spoofed IT domain to collect credentials
- Slack or Teams message impersonating a named IT colleague for a quick password check
- Phone call from a 'helpdesk' requesting remote access via a commercial tool like AnyDesk
- SMS pretexting: 'our systems show your account is expiring — reset here'
How to verify before you act
Establish a verification culture in your organisation: any IT request involving credentials, software installation, or code-sharing should be verified by calling the IT team on the number listed in the company's internal directory — not the number that contacted you.
Legitimate IT helpdesks never ask for your current password. They reset passwords; they do not need to know the existing one. Any request for your password should be treated as an automatic red flag regardless of how the request is framed.
For code-reading requests: no legitimate IT process requires you to read an authentication code to a helpdesk agent. These codes are generated by your devices and apps to authenticate you — passing them to someone else defeats their purpose entirely.
Payment methods used
- Credential theft used for financial access
- No direct victim payment required
Who is usually targeted
- Employees at all levels, particularly those with access to financial or sensitive systems
- Remote workers less familiar with internal security colleagues
- New employees unfamiliar with standard IT procedures
- Staff who respond quickly to authority-framed requests
What to do immediately
- Do not comply with any IT request that arrives unexpectedly — verify it through a separately confirmed channel
- Call the IT helpdesk using the internal number from your company directory, not any number in the message
- If you have clicked a link, shared a credential, or installed software, report to your IT security team immediately
- Change any compromised passwords immediately
- Do not read authentication codes out to anyone — legitimate IT staff do not need these from you
- If accounts have been accessed, report to your security team and, if financial accounts are involved, to your bank
How to prevent it
- Verify all unexpected IT contact by calling back on the number in your internal directory
- Know that legitimate IT staff will never ask for your password or a read-out authentication code
- Establish a clear internal verification process for IT credential requests and enforce it consistently
- Train staff regularly on vishing and spear-phishing techniques with simulated exercises
- Enable email domain authentication (DMARC, SPF, DKIM) to reduce spoofing of your own domain
- Use phishing-resistant MFA (hardware keys or passkeys) for high-privilege accounts
Evidence to preserve
- The original email, message, or call details
- Screenshots of any portal or link you were directed to
- The name and contact details used by the caller or sender
- Any software you were asked to install
Where to report it
- Action Fraud (UK) — UK national fraud & cybercrime reporting centre
- FTC ReportFraud (US) — US Federal Trade Commission fraud reports
- FBI IC3 (US) — US Internet Crime Complaint Center
- Scamwatch (Australia) — Australian competition & consumer reporting
- Your bank's fraud line — Use the number on the back of your card or in your banking app — never a number the caller gives you
Always verify reporting routes and emergency contacts on the official government or agency website for your country.
Frequently asked questions
How do I verify whether an IT contact is genuine?
Look up the IT helpdesk number in your company's internal directory (not from a message or email) and call it directly. Ask whether the contact who reached out actually works there and whether the request was made on behalf of IT. This takes under two minutes and will expose most fake helpdesk attempts.
What if I have already given my password to someone claiming to be IT?
Change your password immediately, then report the incident to your real IT security team. They need to check whether your account was accessed, what was accessed, and whether any privilege escalation occurred. Act quickly — the window before an attacker moves laterally is often short.