Bridging the Identity Gap in Your Service Desk Support

Organizations are investing heavily in multi-factor authentication (MFA), conditional access policies, and other identity controls to prevent unauthorized account access. But those protections can be undermined when password resets and account recovery rely on weaker identity checks. Service desks that verify callers with easily discoverable information may give attackers a way around stronger login security, particularly as social engineering and AI-generated impersonation become more convincing.

Why knowledge-based validation is no longer reliable

When employees lose access to their accounts, service desk agents often handle password resets and recovery requests. In many cases, however, identity verification still depends on questions about an employee’s manager, department, office or other personal details.

Attackers can gather much of this information from LinkedIn profiles, company websites, social media accounts and leaked data. With enough preparation, they may be able to answer verification questions correctly and appear to be legitimate employees.

If passing these checks is sufficient to trigger a password reset or account recovery, an attacker could gain access without compromising the employee’s original credentials. This creates a weaker route into an account that is protected by stronger authentication controls during normal login.

The risks of knowledge-based authentication are well established. The NIST Digital Identity Guidelines no longer recognize security questions as an acceptable authentication method. In the 2026 threat landscape, knowing information about someone does not prove that person’s identity.

AI and social engineering increase the risk

Cybercriminal groups such as Scattered Spider have made service desks a priority target. Instead of trying to bypass MFA directly, attackers may impersonate employees and persuade service desk agents to reset passwords or register new MFA devices. In some cases, a convincing phone call may be enough to begin the process of taking over an account.

Generative AI makes these attacks easier to scale and more difficult to identify. Attackers can use AI to create credible stories, conduct natural-sounding conversations and impersonate employee voices. As a result, service desk agents may find it increasingly difficult to distinguish legitimate callers from attackers.

A 2025 Gartner survey found that 62% of organizations experienced a deepfake attack involving social engineering or automated processes during the previous year.

Meanwhile, Verizon’s 2026 DBIR found that social engineering through text messages or voice calls was 40% more successful than traditional email phishing.

Service desks therefore cannot rely solely on an agent’s ability to recognize a persuasive impersonation attempt. Identity verification should use secure, consistent checks rather than subjective judgments about how convincing a caller sounds.

Account recovery is also an operational issue

Restoring access is not only a security concern. Account lockouts generate service desk tickets, interrupt employees’ work and increase pressure on already busy IT teams. If an employee loses access outside business hours, even a routine reset can lead to several hours of downtime.

There are also direct financial costs. A single help desk password reset costs about $70. Across hundreds or thousands of requests, those expenses can quickly accumulate.

Secure self-service recovery can allow employees to regain access without contacting the service desk. For requests that still require assistance, streamlined identity verification can help agents process them securely and efficiently. With the right procedures, organizations can reduce support workloads without weakening account protection.

What secure service desk verification looks like

It is unrealistic to expect service desk agents to become experts at detecting every AI-powered social engineering attempt. Training remains important, and agents need the authority and confidence to deny or escalate requests that appear suspicious.

Organizations also need a reliable way to verify a caller’s identity before making sensitive account changes. Validation should be a required step in the workflow, not a judgment based on how convincing a person appears.

Specops Secure Service Desk is designed to support this process through four steps:

1. An employee contacts the service desk. For example, an employee named John Doe calls because he cannot access his account. The agent starts a recovery request through Specops Secure Service Desk.
2. The agent locates the account. The agent uses John’s details to find his account and begins the verification process.
3. The employee completes identity verification. Specops Secure Service Desk supports multiple verification methods, including email, SMS and third-party authentication systems such as Duo. This allows organizations to select an appropriate method based on the request and whether the caller has access to a smartphone.
4. The agent proceeds only after successful validation. Once John verifies his identity, the agent can perform the requested action, such as resetting his password.

The goal is to make secure identity verification a consistent part of the service desk workflow without adding unnecessary friction for employees or agents.

Account recovery should be as secure as login

Strong login security provides limited protection if an attacker can bypass it by making a persuasive call to the service desk. Password resets and account recovery therefore need verification controls that are as robust as the authentication systems they protect.

Replacing knowledge-based questions with consistent, secure verification can reduce the risk of account takeover without increasing the burden on employees and service desk teams.

To see how the process works, explore the interactive walkthrough of Specops Secure Service Desk, which demonstrates how service desk agents can verify identities before making sensitive account changes.

Interested in learning more about how Specops can support your identity security strategy? Contact us now.

Sponsored and written by Specops Software.

Source: www.bleepingcomputer.com