Service desk account recovery can bypass stronger login controls
Original title: Closing the Identity Gap at the Service Desk
A Specops explainer cites Scattered Spider, deepfakes and voice phishing as reasons to drop knowledge-based checks.
A Specops explainer argues that password resets and account recovery at the service desk can bypass MFA when agents rely on knowledge-based questions. It says attackers can answer those questions using public and leaked information, and names Scattered Spider as a group that targets service desks to reset passwords or register new MFA devices. The piece cites a 2025 Gartner survey and Verizon's 2026 DBIR on deepfakes and voice or text social engineering, then promotes Specops Secure Service Desk verification by email, SMS or authenticators such as Duo.
Unconfirmed: The Gartner and Verizon figures are cited by the vendor explainer and are not independently verified here.
- NIST guidelines no longer treat security questions as acceptable authentication, the piece says.
- Gartner found 62% of organizations experienced a deepfake social-engineering or automated-process attack.
- Verizon's 2026 DBIR reported 40% higher success for text and voice social engineering than email phishing.
- The piece puts a help-desk password reset at about $70.
- Specops verification options named include email, SMS and Duo.
- ATT&CK
- T1566 Phishing
- Vendors
- Specops
- Products
- Specops Secure Service Desk
- Threat actors
- Scattered Spider
From the original article
4 min read at bleepingcomputer.com
Attackers target IT service desks to bypass MFA by impersonating employees and convincing staff to reset passwords or register new authentication devices. Specops Software explains why traditional identity verification methods are no longer sufficient and how organizations can secure account recovery against social engineering risks. [...]
By Sponsored by Specops Software · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.