Topic starter
06/11/2026 6:40 pm
TL;DR: AI-powered impersonation is making help desk social engineering faster, more precise and harder to spot, according to imper.ai, with attackers using scraped personal, behavioural and workplace data to sound convincing enough for password resets and account recovery. The trust model behind help desk verification is collapsing under machine-assisted pretexting, not under technical compromise.
Editorial analysis by NHI Mgmt Group, based on content published by imper.ai: “The rise of fake help desk calls”.
By the numbers:
- Around 60% of social engineering attacks involve impersonation, according to imper.ai.
Key questions
Q: How should teams verify help desk reset requests without relying on voice recognition?
A: Verify help desk reset requests with out-of-band confirmation through a separate channel, such as a known mobile number, authenticated portal, or supervisor approval, rather than relying on voice recognition alone.
Q: Why do collaboration platforms make impersonation easier for attackers?
A: Collaboration platforms make impersonation easier because display names are often easier to copy than the underlying account identity, so attackers can mimic a trusted person in chat or call workflows.
Q: What should teams do first when a help desk reset looks suspicious?
A: First review active sessions to see whether the account is already being used from unfamiliar devices, locations, or browser sessions before completing the reset.
Practitioner guidance
- Strengthen help desk recovery verification Require step-up checks that are independent of the caller's tone, urgency or channel, and make high-risk resets contingent on out-of-band confirmation.
- Separate channel trust from identity trust Do not allow Slack, Teams, email or phone familiarity to satisfy identity proofing for password resets, MFA changes or device recovery requests.
- Detect impersonation signals before approval Use device fingerprints, network consistency and behavioural baselines to flag requests that do not match the genuine user's normal environment.
Bottom line: AI-assisted impersonation turns help desk recovery into a governance problem, not just a training problem, because attackers can now manufacture convincing context at scale.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
AI has shifted impersonation from a craft problem to an industrialised access problem. The controlling issue is no longer whether a help desk agent can recognise a suspicious voice; it is whether the organisation can verify identity when attackers can manufacture context faster than humans can validate it. That changes social engineering from a nuisance into a repeatable access path. Practitioners should treat impersonation as a governed identity workflow, not a training-only problem.
A few things that frame the scale:
- Password-related issues can represent 10–50% of service desk calls, many of which are avoidable.
A question worth separating out:
Q: How should security teams reduce social engineering risk in identity recovery workflows?
A: They should treat recovery as a privileged control path, not a customer service process. That means verifying the person through independent proof, restricting who can approve resets, logging every step, and separating account recovery from routine support. Where possible, use phishing-resistant authentication so an attacker cannot simply move the second factor onto a new device.
👉 Read our full editorial: AI-powered impersonation is testing help desk trust at scale