The help desk can be fooled. The signature can't.
Talking the IT help desk into resetting MFA was the entry point for the MGM breach (~$100M) and is now the dominant enterprise ransomware vector. You can train the help desk forever; the process itself is the hole. Close the process.
The attack
A caller reaches the IT help desk, impersonates an employee with real personal details, claims a lost phone, and asks for an MFA or password reset. The help desk — built to be fast and helpful — obliges. That reset hands the attacker a valid login, and from there, the network. This is the Scattered Spider playbook: it opened MGM Resorts (estimated ~$100M impact) and Caesars ($15M ransom), and it has since spread into impersonation over Slack and Teams.
Why training the help desk fails
The help desk is measured on speed and empathy, and attackers arrive with accurate PII and a convincing story. You're asking an underpaid human, on a clock, to out-interrogate a professional social engineer. Worse, the vulnerability isn't a mistake — it's the reset process working as designed. The reset doesn't require proof it's the real employee; it requires the agent to believe it is.
Make the reset require a signature
Put a cryptographic gate on the action itself. A credential or MFA reset — and any privilege elevation — requires a fresh signature from the employee's enrolled device, or a co-signature from their manager's. The social engineer on the phone can be infinitely persuasive and still can't produce the signature, so the reset never completes. The help-desk agent is no longer the security boundary; the cryptography is.
For a real employee who genuinely lost a device, recovery runs through the other authenticator they enrolled, or a manager co-sign — friction measured in seconds, only when it matters.
Honest limits
The hard case is the employee who has lost every enrolled factor; the answer is to enroll at least two up front so this is rare, and to define a high-assurance break-glass path (in-person, manager-attested) rather than a phone call. This is an account-recovery and privilege control — it won't stop a malicious insider who still holds their device, which is what your behavioral and least-privilege controls are for. But it removes the single most-exploited enterprise entry point in 2026.
Frequently asked questions
Doesn't MFA already solve this? MFA is exactly what the attacker resets. The gap is the recovery path — the moment MFA is removed and re-issued. That's the action this control gates.
What if someone really loses their phone? They recover through a second enrolled authenticator or a manager co-signature. Enrolling two factors up front makes total loss rare and keeps a clean, high-assurance path when it happens.
How is this different from our PAM tool? PAM manages privileged sessions; it generally trusts the identity once granted. This binds the high-risk action — reset, elevation — to a fresh human signature, so a social-engineered grant can't happen in the first place.
The help desk's job is to be helpful. Stop making it also be the firewall. A signature can be both.