Attackers are increasingly targeting IT service desks as a way to bypass multi-factor authentication (MFA), by impersonating employees and persuading support staff to reset passwords or enroll new authentication devices. The development is relevant for European businesses because it shifts attention from technical controls alone to the operational processes around identity verification and account recovery.

What happened

The source article highlights a security problem that has become more visible across enterprise IT environments: attackers do not always try to break MFA directly. Instead, they may call or contact the service desk, pretend to be a legitimate employee, and request help regaining access to an account.

If the service desk accepts weak verification methods, such as easily found personal details or basic employee information, support staff may unknowingly help an attacker reset a password or register a new MFA device. In practice, that can give the attacker access to corporate systems without needing to defeat the original authentication controls.

The warning comes from Specops Software, which argues that traditional identity checks at the help desk are no longer sufficient against modern social engineering tactics. This reflects a vendor assessment rather than an independent regulatory or government finding, but the underlying attack pattern is widely recognised in cybersecurity.

Why it matters for European businesses

For many organisations, MFA is treated as a key defence for email, cloud applications, internal systems and administrative accounts. However, if account recovery and support processes are not equally secure, the overall protection can be undermined by a phone call, ticket or chat session.

This matters particularly for businesses using Microsoft 365, Google Workspace, SaaS platforms, VPNs, HR systems and other services where service desk teams can trigger credential resets or device re-enrolment. A successful impersonation attempt may lead to data exposure, business email compromise, internal fraud, ransomware deployment or broader unauthorised access.

For European companies, there is also a governance and compliance angle. A preventable account takeover can create operational disruption, incident response costs and potential data protection consequences if personal data is accessed. For organisations in regulated or security-sensitive sectors, identity verification at the service desk may also form part of broader internal control and cybersecurity obligations.

Who may be affected

The issue is relevant beyond large enterprises. Small and medium-sized businesses can be exposed when they have:

• internal IT support teams handling password resets and MFA re-enrolment
• outsourced managed service providers or shared service desks
• remote or hybrid staff who frequently need account recovery support
• high staff turnover, making employee identity harder to verify consistently
• privileged users with access to finance, customer data, e-commerce systems or cloud administration

Companies with limited security staff may be especially vulnerable if support teams are trained primarily on speed and user experience rather than social engineering resistance.

What companies should consider

Businesses do not need to assume their MFA deployment is enough on its own. They should review how identity is verified when users request password resets, account unlocks or new authenticator registration.

• Review account recovery procedures: identify which support actions can lead directly to account takeover and apply stronger controls to those actions.
• Reduce reliance on weak verification: avoid depending only on public or easily obtained personal information, employee IDs, manager names or other details that may be guessed or sourced online.
• Use stronger step-up verification: where possible, require additional proof of identity through approved channels before resetting credentials or enrolling a new MFA device.
• Train service desk staff: ensure IT support teams can recognise social engineering tactics, urgency pressure and impersonation attempts.
• Separate high-risk approvals: for privileged accounts or sensitive systems, consider secondary approval or additional review before making recovery changes.
• Log and monitor help desk recovery events: password resets, MFA changes and unusual support requests should be auditable and reviewed for suspicious patterns.
• Assess third-party support providers: if account recovery is handled by an MSP or external provider, verify that identity checks meet your security requirements.

For European SMEs, the main lesson is practical: MFA remains important, but the service desk can become the real control point during account recovery. If identity verification is weak at that stage, attackers may not need to defeat technical protections at all.