How to Train Help Desk Teams Against AI Vishing and MFA Reset Attacks

An attacker who never touches a keyboard can walk out of your environment with a working account. They call the service desk, explain that their phone died somewhere between two airports, and ask for their multi-factor authentication to be reset. The agent approves it. Forty minutes later, the attacker calls back, reaches a different agent, and collects a password reset too. Nothing was exploited. A support function did precisely what it exists to do.

Service desk social engineering is difficult to train against because the usual tells don’t apply. There’s no malicious attachment to spot and no lookalike domain to inspect. A persuasive caller reaches a privileged account unless the agent follows the verification procedure while a queue backs up behind them. Train agents on that procedure under queue pressure, then measure whether they follow it.

What You’ll Learn

• Why service desks became a primary initial-access route, and what an attacker learns about your verification procedure before they place a real call
• What identity proof to require before anyone touches an account, and which familiar checks no longer prove anything
• Separate verification standards for account recovery, MFA enrollment, and remote-access requests, tiered by what the account can reach
• What an agent should do the moment verification fails, and which attack patterns only your ticket queue can see
• How to rehearse the procedure so it holds up on a live call that is urgent, fluent, and convincing

Your Service Desk Is an Authentication System

Every password reset, MFA re-enrollment, and remote session your team performs is an authentication decision, made by a person on a phone with an average handle time to hit.

Attackers noticed. In M-Trends 2026, built from more than 500,000 hours of frontline investigations during 2025, Mandiant reported that highly interactive voice phishing rose to 11% of initial infection vectors, the second-most-common way intrusions began. Only exploitation of vulnerabilities ranked higher, at 32%. Mandiant’s hardening guidance on UNC3944, the cluster overlapping with the group widely called Scattered Spider, is specific about who gets picked: these actors deliberately target organizations with large help desk and outsourced IT functions, where shift rotations and contractors mean no agent can realistically recognize a colleague’s voice.

Regulators have started saying it plainly. A New York Department of Financial Services industry letter from February 2026 warned regulated firms about an ongoing vishing campaign and told them to stop treating caller ID as authentication.

What the attacker learns before the first real call

By the time someone calls your desk with a request, they’ve usually already called several times without asking for anything.

Mandiant’s technical analysis of vishing threats documents the reconnaissance loop. Attackers map the organization from public sources, then start probing the identification procedure itself. An operator will feign ignorance to see how far the call gets before anyone asks for proof, or supply a real employee ID attached to the wrong name purely to watch the reaction, since a helpful correction confirms both the ID format and the employee’s actual name. Calls come at different hours to reach different agents, with enough variation in delivery that repeat attempts don’t get connected. Out-of-office replies serve as a targeting list, since an employee on leave for two weeks can’t contradict anyone impersonating them.

The two-call split

These attacks are often designed so no single agent sees the whole sequence. Mandiant describes the standard approach: get an MFA reset approved on one call, hang up, then reach a different agent for the password reset. Each request looks like an ordinary ticket on its own. Together they produce a complete account takeover.

If two agents on different shifts each make a defensible decision, the attack still succeeds. The ticketing system has to correlate requests across calls, which puts ticket-level instrumentation inside this program rather than in a separate security backlog.

What AI actually changed

Voice cloning isn’t required for this attack. Generative AI changed its cost, volume, and fluency. A Harvard Kennedy School and Meta study that tested AI voice phishing against 4,100 US adults put the economics plainly: human-operated vishing isn’t profitable at US wage rates, while AI-operated vishing is economically viable for several current models.

Caller persuasiveness, not how human the voice sounded, was the strongest predictor of compliance in the same study. Neither general familiarity with AI nor regular use of voice assistants improved anyone’s ability to distinguish synthetic speech from real speech. A well-built pretext in a mediocre voice beats a flawless clone with a weak story, and your agents won’t hear the difference either way.

Request 1: The Caller Who Says They Are an Employee

The desk must establish who’s on the line before evaluating any request, even a seemingly harmless read-only lookup. Confirming details back to a caller helps attackers fill gaps in their reconnaissance.

Mandiant recommends requiring positive identity verification before modifying accounts or providing security-sensitive information, using methods such as:

• Live video verification, with the employee presenting a corporate badge or government-issued ID, checked against a current internal employee photo record
• Challenge questions built on internal-only knowledge, meaning details that exist inside your systems rather than anywhere a stranger can reach
• Confirmation through a channel already tied to the account, initiated by the desk rather than offered by the caller

Agents also need to know what no longer counts as proof. Mandiant’s UNC3944 guidance explicitly rejects date of birth and the last four digits of a Social Security number because these actors routinely already hold that data. Employee ID alone fails for the same reason: attackers harvest and validate ID formats during reconnaissance. Caller ID, fluency, and knowing a manager’s name prove nothing at all.

The lost, broken, or forgotten phone pretext is built to defeat these checks. Mandiant notes that impersonating an employee whose device is unavailable is a common way to sidestep device-based verification, usually paired with travel and urgency. Your fallback path therefore needs a higher standard than your primary path. If the normal route is a push to a registered device, the exception route should require video verification plus manager confirmation through directory-sourced contact details.

Write that inversion into the procedure explicitly, or agents under pressure will reach for the fastest remaining option, which is exactly what the pretext is engineered to produce.

Request 2: Account Recovery and Password Resets

Not every reset carries the same risk, and treating them identically means either over-verifying routine tickets or under-verifying dangerous ones. Tier the procedure by what the account can actually reach: standard user, elevated access, and administrative or privileged accounts each get a different bar.

For anything above the standard tier, out-of-band verification does the work. Mandiant recommends a callback to a registered phone number or confirmation through a known corporate email address belonging to the employee or their manager. The desk must initiate the contact using details from the internal directory, never a number the caller supplies during the conversation.

Notify managers even when their approval isn’t required. Mandiant recommends notifying them through verified channels when a sensitive-account password is reset, creating third-party awareness and a record outside the ticket.

• Give agents the account’s recent history before they act. Prior tickets, previous reset requests, and call records let an agent see that this is the third contact about one account this week. Obsidian Security’s analysis of real help desk attacks lists repeated resets for high-profile users, requests from unusual devices or locations, and deletion of security notifications from a user’s inbox among the recurring indicators.
• Treat session revocation as part of the reset. A password change alone doesn’t evict an attacker holding valid session tokens. Where compromise is suspected, sessions and tokens have to be revoked in the same action.

Request 3: MFA Enrollment and Resets

MFA enrollment is the highest-value transaction on your desk and deserves the strictest procedure you write, because what an attacker gains here is durable.

Google Threat Intelligence Group’s reporting on UNC6671, the cluster behind the BlackFile extortion activity, describes the pattern: after relaying credentials and a one-time code through a live adversary-in-the-middle page, the attacker registers their own MFA device. That registration converts a stolen moment into persistent access, and it survives the password change a suspicious employee might make later. Okta’s threat intelligence team has described phishing kits driven live by the caller, where the operator controls what appears in the victim’s browser in step with the spoken instructions, defeating any factor that isn’t phishing-resistant. We’ve covered how vishing bypasses Okta MFA in more detail separately.

Use four controls for MFA changes:

• Require strong authentication before authentication methods change. Someone should prove possession of an existing factor before a new one is enrolled, making the desk-assisted path an exception with its own scrutiny rather than the default route.
• Require manager approval through a verified channel, sourced from the directory rather than the caller.
• Restrict enrollment to trusted locations or compliant corporate devices where your identity platform supports it.
• Separate customer-facing support from internal account administration. Mandiant recommends that desks serving external customers shouldn’t hold permissions to modify internal employee accounts, which removes a large group of agents from the attack surface entirely.

Cross-ticket alerts expose the two-call split. Watch for a new MFA enrollment following a failed or abandoned authentication, the signature of a relay attack that needed help finishing. Also flag one phone number or authenticator registered across multiple accounts, and an MFA reset followed by a password reset on the same account within a short window, handled by different agents.

NIST SP 800-63B requires phishing resistance at AAL3. Moving privileged accounts to FIDO2 security keys limits what an attacker can gain from a successful desk-assisted reset.

Request 4: Remote Access and Screen Sharing

Remote sessions have a different blast radius from account recovery and need their own procedure.

Google Threat Intelligence Group reported a campaign against US law firms attributed to UNC3753, also tracked as Silent Ransom Group. The chain ran from an invoice-themed email to a follow-up call posing as IT support, then a remote support session, installation of a remote monitoring and management tool, and document harvesting. Extortion often began within about thirty minutes of the attacker leaving, and the whole sequence fit inside a single business day.

Four rules cover most of it:

• Allowlisted tooling only. The desk uses the organization’s remote support product. Nothing the caller suggests, sends a link for, or already has installed.
• No session before verification completes. Screen sharing is not a way to establish identity, and starting one “just to take a look” hands over context an attacker can use.
• Outbound contact goes through the directory. When the desk initiates a session, it dials the number of record.
• Cover the reverse direction in training. Attackers impersonate the help desk to employees, over spoofed phone numbers and increasingly through collaboration tools. Mandiant’s UNC3944 guidance notes impersonation via Microsoft Teams accounts posing as internal IT, and recommends monitoring for external accounts with display names containing terms like “helpdesk” or “support.”

Request 5: Escalation When Verification Fails

“Establish clear escalation procedures” is not enough. The desk needs the following decisions in advance.

What the agent says. A neutral, scripted line that ends the transaction without accusing anyone: the request needs additional verification, and someone will follow up through a channel already on file. Agents shouldn’t have to improvise a confrontation, and they shouldn’t explain which check failed, because that teaches the caller what to fix before the next attempt.

What happens to the ticket. A failed verification is logged as a security event, not closed as abandoned or resolved. If it disappears into a closed queue, the pattern spanning several calls disappears with it.

Who receives it, and how fast. Name the channel and the response time in minutes. M-Trends 2026 reported that the median hand-off from an initial access broker to the next threat group collapsed from more than eight hours in 2022 to 22 seconds in 2025. Escalating at the end of a shift isn’t escalating.

What the manager reviews. Some patterns are only visible above the individual call, so they need a standing review and a real-time alert wherever you can build one:

• Repeated reset requests for one user across different agents
• An MFA reset followed by a password reset on the same account within a short window
• Any credential or factor change on a privileged or executive account
• Requests originating from unusual devices, locations, or numbers
• Verification failures clustered around a small set of accounts

Make failure cheap. An agent who worries about being wrong will quietly resolve the ticket instead of escalating. Say explicitly that a false alarm is the correct outcome and carries no consequence, then behave that way the first time someone escalates a legitimate employee. How that first escalation is handled determines whether anyone brings you the second one.

Turning the Procedure Into a Trained Reflex

Rehearsal determines whether the procedure survives 4:40pm on a Friday with eleven tickets open.

Start by dropping detection from the curriculum. Teaching agents to listen for artifacts in synthetic speech spends training time on a skill that doesn’t transfer and gets less reliable with every model release. Build scenarios from the five request types above instead: the locked-out executive, the phone lost while travelling, the urgent MFA re-enrollment before a board meeting, the caller pushing for a quick screen share, and the follow-up call an hour after a colleague handled something for the same account.

The general workforce needs its own version of this, and our guide to training employees against AI voice scams covers that broader program. What the desk needs is narrower and harder.

• Run the desk as its own cohort, on a tighter cycle than the general workforce, since their exposure is constant and every transaction is high value.
• Measure behavior rather than opinions. Did the agent require the correct proof? Did they escalate? How long did it take? Those numbers move; awareness scores tell you little.
• Debrief without punishment. A failed simulation is worth more as a conversation about where the procedure was ambiguous than as a mark against an individual.
• Set honest expectations about residual risk. Cloudflare’s account of the smishing campaign that hit it in August 2022 remains the cleanest illustration: employees did fall for the messages, and the compromise failed anyway because hardware security keys were required for application access. Your agents will occasionally be fooled, and controls are what make that survivable.

Where This Gets Hard

Your metrics are fighting your policy. Callbacks, manager approvals, and video verification all add minutes to calls measured on average handle time and customer satisfaction. Tighten the procedure without changing the targets and the fastest compliant path wins. Adjust the scorecard in the same change.

Outsourced desks are a contract question. Where support is delivered by a BPO or managed provider, verification standards, privilege scope, and escalation authority are contractual terms rather than training topics. Mandiant lists large outsourced IT functions as a targeting criterion for a reason. Get the requirements into the statement of work, ask for evidence the provider runs these drills, and confirm which side of the boundary can reset MFA on your employees’ accounts.

Video verification raises the price without closing the door. Requiring a badge or ID on camera defeats most callers today, but real-time video manipulation exists, which is why it works best alongside out-of-band confirmation rather than as the single gate.

Executives are the hardest exception and the worst one to grant. They ask for speed most often, they escalate when refused, and their accounts are what attackers want. The workable answer is a pre-agreed process for senior accounts that’s faster in wall-clock terms but not weaker, plus visible executive backing for agents who follow it.

Rehearsing Help Desk Calls With Brightside

Brightside’s vishing simulator lets service desks rehearse these procedures under pressure.

Simulated calls are generated with AI voices and run from the Admin Portal inside the same campaign framework as email phishing simulations. You can target your service desk as its own group, so scenarios reflect the transactions they actually handle. Campaigns run one-time, quarterly, or yearly, letting you keep the desk on a tighter cycle than everyone else.

Scenarios are built in a five-step template builder where the attack goal is written in plain language, so the pretexts in this guide translate directly: the locked-out employee whose phone died while travelling, the urgent MFA re-enrollment, the caller pushing for a quick remote session. The review step includes a test call, so you can hear how a scenario sounds and how the AI adapts before it reaches anyone. Voice + BEC pairs a simulated call with a tracked phishing email, matching the multi-channel approach real campaigns use against support teams.

Custom voice cloning is self-service: admins upload a one to two minute recording and the platform produces a voice replica for simulated calls, including executive impersonation. Teams can test whether agents follow the exception process under executive pressure before a real call.

Desk-level reporting includes failed rate, answer rate, median call duration, and a failed-rate trend over 7, 30, or 90 days rather than organization-wide averages. A fuller walkthrough explains how the simulator runs a live call. Achievements use positive reinforcement only, with no punitive or “wall of shame” mechanics, which matters when agents need to escalate instead of quietly resolving.

Vishing simulations are available on the Pro plan or as a Voice add-on for teams of ten or more. Brightside trains and tests people. It doesn’t verify identities at your desk, detect synthetic audio on live calls, or provide detection and response.

Help Desk Vishing Defense FAQs

Can help desk agents be trained to recognize an AI-cloned voice?

No. The Harvard study of AI voice phishing found that neither general familiarity with AI nor regular voice-assistant use improved people’s accuracy at telling synthetic speech from human speech, and that a caller’s persuasiveness predicted compliance better than how realistic the voice sounded. Build the procedure so it produces the right outcome whether the voice is cloned, real, or a skilled human.

What identity verification should we require before an MFA reset?

At minimum, require proof of an existing authentication factor before any factor changes, a callback to the number on record in your directory, and manager approval through a verified channel. For privileged and executive accounts, add live video verification against an internal photo record. Never accept a callback number or an approver’s contact details supplied by the caller.

How do we verify someone whose phone is lost or broken?

Make the fallback path stricter than the primary path, since defeating device-based verification is the entire purpose of that pretext. Live video with a corporate badge or government ID checked against your employee photo record, plus manager confirmation through directory-sourced contact details. If neither is possible on the call, the request waits.

How often should help desk teams run vishing simulations?

More often than the general workforce. Agents field this attack constantly and every transaction they handle is high value, so quarterly is a reasonable floor for the desk cohort even when the rest of the organization runs annually. Rotate the pretexts so agents rehearse different request types rather than getting familiar with one scenario.

What should an agent do if they realize afterwards that they were social-engineered?

Report it immediately, with no penalty attached, and treat it as an incident rather than a mistake. Response should include revoking active sessions and tokens rather than only resetting the password, reviewing what the affected account touched, and checking for MFA devices enrolled during the window. Speed genuinely matters: Mandiant found the median hand-off from initial access to a second threat group had fallen to 22 seconds by 2025.