Organizations are increasingly vulnerable to identity security gaps at the service desk, where traditional knowledge-based verification methods are being exploited by attackers to bypass multi-factor authentication, as first reported by Bleeping Computer.
While companies invest heavily in robust login protections, the account recovery process often remains a weak link. Cybercriminal groups, such as Scattered Spider, frequently target service desk agents by impersonating employees to request password resets or new device registrations. These social engineering attacks are becoming more sophisticated due to generative AI, which allows attackers to craft convincing narratives and mimic voices.
A 2025 Gartner survey revealed that 62% of organizations experienced deepfake-related attacks, while the 2026 Verizon Data Breach Investigation Report noted that voice-and text-based social engineering had a 40% higher success rate than traditional phishing. Because knowledge-based questions—such as asking for a manager's name—are no longer considered secure by the National Institute of Standards and Technology, organizations must adopt consistent, automated verification workflows.
Implementing secure identity verification tools ensures that agents can authenticate callers through reliable methods like SMS or third-party apps before performing sensitive account changes. This approach not only mitigates the risk of unauthorized access but also reduces the operational burden and costs associated with manual account recovery processes.
Source: Bleeping Computer
