Help desk social engineering: what controls stop payment diversion?

TL;DR: A routine help desk password reset in a healthcare scenario let a threat actor move through internal systems and change payment information, ultimately diverting $24 million in insurance payments, according to Cowbell's Behind the Breach episode. The case shows identity verification and portal controls must be treated as financial-risk controls, not just service-desk hygiene.

Editorial analysis by NHI Mgmt Group, based on content published by Cowbell: “Behind the Breach, Episode 3: The Help Desk Call That Cost $24 Million”.

By the numbers:

• $24 million in insurance payments went to the wrong account after the attack chain completed.

Key questions

Q: What breaks when help desk resets are treated as low-risk support tasks?

A: The reset path becomes a privileged access channel that attackers can target through social engineering.

Q: Why do account recovery workflows create authentication risk?

A: Account recovery creates risk because it often reintroduces weaker trust checks such as personal knowledge, help desk scripts, or socially discoverable information.

Q: What are the signs that a retail help desk is being abused for account takeover attempts?

A: Common warning signs include repeated password reset requests, urgency or pressure from callers, requests for privileged accounts, and identity details that do not quite align with normal employee patterns.

Practitioner guidance

• Strengthen help desk identity proofing Require higher-assurance verification for password resets, account unlocks, and callback requests when the request can lead to financial or administrative access.
• Separate recovery from transaction authority Do not let a successful account recovery automatically permit payment-detail changes, beneficiary updates, or banking edits inside downstream portals.
• Add approval friction to high-risk portal changes Force independent approval, dual review, or out-of-band confirmation before any change to bank details, settlement accounts, or payment destinations.

Bottom line: The episode shows that a help desk reset can become the first step in payment diversion when recovery assurance is too weak for the access it restores.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →