{
"slug": "scattered-spider-help-desk-mfa-reset-prevention",
"topic_id": "TOPIC-025",
"cluster": "Privileged Identity & Help-Desk Takeover",
"tier": "Tier A",
"title": "Making help-desk MFA resets social-engineering-proof",
"summary": "The most effective intrusion technique in enterprise security is a phone call. It works because the reset procedure asks a technician to make a judgement call, and judgement can be argued with.",
"lede": "A caller says their phone is broken and they cannot get into email before a board meeting. Every detail they offer checks out, because every detail is available. Four minutes later the attacker holds a registered authenticator on a real executive account.",
"date": "2026-04-06",
"category": "AEO",
"author_id": "solene-beaumont-adjei",
"tags": [
"help desk",
"MFA reset",
"social engineering",
"account recovery",
"identity",
"Scattered Spider"
],
"image_title": "Help Desk MFA Reset Proof",
"schema": "FAQPage",
"key_takeaways": [
"Help-desk verification fails because it asks a technician to judge whether a caller is genuine, using facts the caller can obtain.",
"Every knowledge-based check has the same defect: the answer is either discoverable or guessable, and the caller controls the framing.",
"The only check that survives is one the caller cannot satisfy by talking — a signature from a credential already enrolled to the real employee."
],
"body": [
{
"type": "h2",
"text": "Why the phone call beats the firewall"
},
{
"type": "diagram",
"kind": "chain",
"alt": "A vishing call to the help desk yields an MFA reset, then domain access, then ransomware",
"caption": "MGM Resorts, September 2023. The whole chain starts with a phone call and a technician's judgement.",
"nodes": [
{
"label": "Profile built",
"sub": "public sources",
"note": "minutes"
},
{
"label": "Call to help desk",
"sub": "“broken phone”",
"note": "~10 minutes"
},
{
"label": "MFA reset granted",
"sub": "technician judgement",
"note": "the control",
"bad": true
},
{
"label": "Privileged access",
"sub": "identity platform",
"note": "hours"
},
{
"label": "Ransomware",
"sub": "estimated $100M impact",
"note": "10 days",
"bad": true
}
]
},
{
"type": "p",
"html": "Credential resets exist because people genuinely lose access. A locked-out employee costs the business money every hour, and the help desk is measured on resolution time."
},
{
"type": "p",
"html": "That creates a procedure whose default is to restore access, staffed by people rewarded for doing so quickly, reachable by anyone with a phone number. An attacker does not need to defeat any technical control; they need to be convincing for four minutes."
},
{
"type": "h2",
"text": "Every verification question, and why it fails"
},
{
"type": "table",
"head": [
"Check",
"Why an attacker passes"
],
"rows": [
[
"Employee ID",
"Printed on badges, present in breached HR data, guessable from a sequence"
],
[
"Manager's name",
"Public on professional networks"
],
[
"Date of birth, last four of SSN",
"Available in breach compilations"
],
[
"Read back a code sent to the phone on file",
"The phone is what they are claiming to have lost — or SIM-swapped"
],
[
"Callback to a number on file",
"Defeated by call forwarding or a prior number change"
],
[
"Video call with ID document",
"Injected video and synthetic documents; also takes 20 minutes"
],
[
"Manager confirms by email",
"The manager's account may be the one compromised; also phishable"
]
]
},
{
"type": "p",
"html": "The table has one pattern. Each check is a question with an answer, and answers can be obtained. The attacker's advantage is that they choose the moment, the framing and the pressure."
},
{
"type": "h2",
"text": "What a working check looks like"
},
{
"type": "p",
"html": "Invert the requirement. Instead of asking the caller for information, require an action only the real employee's enrolled credential can perform."
},
{
"type": "code",
"text": "Reset request received for: alex.rivera@example.com\n\nSystem sends a signing challenge to every credential enrolled\nto that account, on devices registered before today.\n\nStatement shown on the device:\n \"Register a new authenticator on your account.\n Requested 14:22 UTC from Denver, CO.\n This will allow sign-in from a new device.\"\n\nRequired: user verification (biometric or PIN) on the device.\n\nNo valid signature → no reset. The technician has no override."
},
{
"type": "p",
"html": "The caller with a broken phone cannot produce this. Neither can the caller who is lying about the broken phone. The distinction the help desk was being asked to draw is no longer theirs to make."
},
{
"type": "h2",
"text": "The obvious objection"
},
{
"type": "p",
"html": "If the employee has genuinely lost every enrolled device, this blocks them too. That is correct, and it is the point: the recovery path must be harder than the attack path, or it is the attack path."
},
{
"type": "p",
"html": "Two things make it workable."
},
{
"type": "ol",
"items": [
"Enrol more than one credential. A second authenticator — a security key in a drawer, a credential on a second device — makes total loss rare. This is the highest-leverage change most organisations can make and it is entirely unglamorous.",
"Make total loss slow and in-person. When every credential is genuinely gone, the path is a scheduled in-person verification, not a phone call. Slow is acceptable for a rare event; it is not acceptable as the default."
]
},
{
"type": "h2",
"text": "Tiering by what the account can reach"
},
{
"type": "table",
"head": [
"Account tier",
"Reset path"
],
"rows": [
[
"Standard employee",
"Signature from an enrolled credential; fallback to manager-attested in-person"
],
[
"Elevated access",
"Signature required, no fallback short of in-person with ID"
],
[
"Administrative",
"Signature plus a second named approver's signature"
],
[
"Executive or finance-authorising",
"As administrative, plus a mandatory delay before the new credential can authorise payments"
]
]
},
{
"type": "p",
"html": "The last row addresses the pattern where account recovery is the first step and a fraudulent payment is the second. A delay costs the legitimate user little and removes the attacker's whole timeline."
},
{
"type": "h2",
"text": "What the technician's job becomes"
},
{
"type": "p",
"html": "Better. They stop being the control and start operating a process whose outcome does not depend on their judgement about a stranger's sincerity."
},
{
"type": "p",
"html": "This matters for retention as well as security. Help-desk staff who have been socially engineered generally describe it as the worst experience of their working life, and the procedure put them in that position deliberately."
},
{
"type": "h2",
"text": "Deployment order that does not break the business"
},
{
"type": "ol",
"items": [
"Push second-credential enrolment across the population. Measure coverage; this is the gate on everything else.",
"Enable signature-required reset for administrative and finance-authorising accounts first — small population, highest consequence.",
"Establish the in-person path and staff it before removing the phone path.",
"Extend to the general population once second-credential coverage is high enough that the in-person path stays rare.",
"Remove technician override. An override that exists will be socially engineered."
]
},
{
"type": "p",
"html": "Step five is the one organisations skip, and skipping it leaves the original vulnerability in place with extra steps."
},
{
"type": "h2",
"text": "The September 2023 case, in sequence"
},
{
"type": "p",
"html": "Scattered Spider — tracked as UNC3944 and G1015 — identified a current MGM Resorts employee from a public professional profile, assumed their identity and telephoned the IT help desk asking for help signing in. Reporting on the incident puts the call at roughly ten minutes. It produced administrative access to MGM's identity platforms, a ten-day ALPHV ransomware incident, and a loss MGM estimated at about $100 million."
},
{
"type": "p",
"html": "Caesars Entertainment was attacked in parallel by the same crew and the same method, and reportedly paid roughly $15 million. Two Fortune 500 companies, the same week, through a procedure neither of them thought of as an attack surface."
},
{
"type": "table",
"caption": "Cost of the two 2023 casino incidents, as reported",
"head": [
"Organisation",
"Reported outcome",
"Entry point"
],
"rows": [
[
"MGM Resorts",
"~$100M impact, 10-day disruption, class actions",
"Help-desk vishing"
],
[
"Caesars Entertainment",
"~$15M ransom reportedly paid",
"Help-desk vishing"
]
]
},
{
"type": "h2",
"text": "Objections and honest limits"
},
{
"type": "p",
"html": "“Our technicians are trained for this.” MGM's were too. Training raises the bar for a mediocre attacker and does nothing against a competent one who chose the moment, the framing and the pressure. The control cannot be a person's judgement about a stranger's sincerity."
},
{
"type": "p",
"html": "“We already require a manager to confirm.” The manager confirms by email or chat, on an account that may itself be the compromised one, and under the same time pressure. It adds a step, not a different kind of evidence."
},
{
"type": "p",
"html": "What this does not stop: an employee who is genuinely coerced, an attacker who has already compromised an enrolled device, or an insider acting deliberately. It removes the telephone as an attack surface and leaves those."
}
],
"faq": [
{
"q": "What if the employee lost all their devices?",
"a": "Then they use a slow, in-person path. That is acceptable because it is rare — provided most people have a second credential enrolled, which is the prerequisite for the whole design."
},
{
"q": "Why don't knowledge-based questions work?",
"a": "Every answer is either in a breach compilation, on a public profile, or guessable. The attacker also controls the timing and the pressure, which the employee does not."
},
{
"q": "Can a technician override in an emergency?",
"a": "An override that exists will be the target. If you need a break-glass path, make it require two named signatures and log it as an incident."
},
{
"q": "Does this stop SIM swapping?",
"a": "For the reset path, yes — there is no code sent to a phone number to intercept. The signature comes from a credential bound to hardware, not to a telephone account."
},
{
"q": "What did the MGM help-desk attack cost?",
"a": "MGM Resorts estimated roughly $100 million in impact from the September 2023 incident, alongside ten days of operational disruption and subsequent class actions. Caesars was attacked the same week by the same method."
},
{
"q": "How long did the call take?",
"a": "Reporting on the MGM incident describes a vishing call of roughly ten minutes, after which the attackers obtained credentials and then administrative access."
},
{
"q": "Is this only a casino problem?",
"a": "No. The same crew and method have been used against telecommunications, retail, insurance and business process outsourcing. The target is the reset procedure, which is near-identical everywhere."
}
],
"sources": [
{
"t": "CISA cybersecurity advisories",
"u": "https://www.cisa.gov/news-events/cybersecurity-advisories"
},
{
"t": "CISA — Scattered Spider joint advisory",
"u": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"
},
{
"t": "NIST SP 800-63B — Authentication and authenticator management",
"u": "https://pages.nist.gov/800-63-4/sp800-63b.html"
},
{
"t": "W3C Web Authentication: An API for accessing Public Key Credentials Level 3",
"u": "https://www.w3.org/TR/webauthn-3/"
},
{
"t": "MITRE ATT&CK — Scattered Spider (G1015)",
"u": "https://attack.mitre.org/groups/G1015/"
},
{
"t": "The Register — Scattered Spider and the 2023 casino intrusions",
"u": "https://www.theregister.com/2023/09/15/scattered_spider_snares_100_victims/"
}
],
"related": [
{
"slug": "help-desk-mfa-reset-attack",
"title": "The help desk can be fooled. The signature can't.",
"category": "Security"
},
{
"slug": "session-hijacking-via-infostealers-mfa-login-protect-post",
"title": "Why MFA at login does not protect post-login actions",
"category": "Developer"
},
{
"slug": "failure-sms-voice-otp-mathematical-postmortem-telecom",
"title": "The failure of SMS and voice OTP",
"category": "Developer"
},
{
"slug": "privileged-access-management-pam-under-attack-gating-just",
"title": "Gating just-in-time escalation",
"category": "Developer"
}
],
"image": "https://cdn.twc.sh/images/igcache/Help%20Desk%20MFA%20Reset%20Proof/1200_630/blog.jpg",
"wordcount": 1242,
"url": "/blog/scattered-spider-help-desk-mfa-reset-prevention.html",
"reading_time": "6 min read",
"meta_description": "The most effective intrusion technique in enterprise security is a phone call, because the reset procedure asks a technician to judge a caller.",
"hub": {
"slug": "topics/privileged-identity",
"title": "Privileged identity and account recovery"
},
"pair": {
"slug": "help-desk-mfa-reset-attack",
"title": "The help desk can be fooled. The signature can't.",
"mode": "DIFF"
},
"answer": "Stop asking the technician to judge the caller. Require a signature from a credential already enrolled to the employee, on a device registered before today, with user verification. A caller who cannot produce it does not get a reset, and the technician has no override to be talked past.",
"answer_q": "How do you stop a help desk being social-engineered into resetting MFA?",
"entities": [
{
"name": "Scattered Spider",
"type": "Organization",
"url": "https://attack.mitre.org/groups/G1015/",
"primary": true
},
{
"name": "MGM Resorts International",
"type": "Organization",
"url": "https://www.mgmresorts.com/"
}
],
"glossary": [
{
"term": "Vishing",
"def": "Voice phishing: social engineering conducted by telephone, typically impersonating a known person to a support function under time pressure."
},
{
"term": "Account recovery",
"def": "The procedure restoring access when a credential is lost. It is by design the weakest authentication path in any system, and therefore the one attackers target."
},
{
"term": "User verification",
"def": "A local gesture — biometric or PIN — performed on the authenticator itself, asserted in a flag the authenticator signs. Software on the host cannot set it."
}
],
"checklist": {
"title": "Hardening the reset path",
"id": "harden",
"desc": "The order that closes the help-desk vector without stranding legitimate users.",
"steps": [
{
"name": "Measure second-credential coverage.",
"text": "Everything else depends on most people holding more than one enrolled authenticator. Report the percentage before you change anything."
},
{
"name": "Gate the small, high-consequence population first.",
"text": "Administrative and finance-authorising accounts, where the population is small and the loss is large."
},
{
"name": "Stand up the in-person path before removing the phone path.",
"text": "Genuine total device loss needs somewhere to go, and it needs to be staffed."
},
{
"name": "Delay payment authority after a reset.",
"text": "A new credential on a finance account should not be able to release funds for a defined period."
},
{
"name": "Remove the technician override.",
"text": "An override that exists will be the thing the attacker talks their way into."
}
]
},
"cta": {
"title": "Where this fits in Manav",
"html": "Manav turns the reset into a signature request: a statement describing the reset is rendered on the employee's enrolled device, signed with user verification, and verified before the reset executes. There is nothing for a caller to talk their way past.",
"href": "../docs.html",
"label": "See the step-up flow"
}
}