Topic starter
25/08/2026 6:10 pm
TL;DR: Account takeover protection for help desks focuses on verifying recovery requests before a new password or MFA factor is issued, because attackers increasingly exploit the reset path rather than the login path, according to Trusona. The control gap is not authentication strength alone, but whether help desk workflows can be socially engineered into issuing a legitimate factor to the wrong person.
Editorial analysis by NHI Mgmt Group, based on content published by Trusona: “How to evaluate account takeover protection for IT help desks”.
Key questions
Q: What breaks when help desk recovery is only protected with knowledge questions?
A: Knowledge questions fail when the attacker can gather employee details from public sources, breach data, or prior support interactions.
Q: Why do help desk impersonation attacks succeed even when MFA is deployed?
A: They succeed because MFA failure or recovery conditions create a fallback path, and that fallback often becomes the weakest part of the identity boundary.
Q: What signs suggest a recovery workflow is being socially engineered?
A: Repeated urgency, requests tied to device loss or number changes, references to managers or projects, and attempts to bypass standard verification are all warning signs.
Practitioner guidance
- Verify recovery at issuance time Require proof at the moment a password reset, MFA change, or account recovery request is made, before any new factor is issued or enrollment is altered.
- Remove discretionary agent override Make sure support staff cannot bypass the verification outcome with informal judgment, manager familiarity, or ticket pressure when a recovery request fails checks.
- Separate login MFA from recovery assurance Review your workflow so that strong login authentication is not mistaken for recovery security, because the reset path is a different attack surface.
Bottom line: Help desk recovery is a primary account takeover target because it can issue a new legitimate factor to the wrong person.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/08/2026 6:11 pm
Recovery is the governance boundary, not the login screen: The industry spent years hardening authentication and left issuance controls under-governed. That assumption fails when an attacker can cause a help desk to mint a new legitimate factor for the wrong person. The implication is that identity assurance has to be enforced at the moment of recovery, not assumed after it.
A question worth separating out:
Q: When should organisations use stronger identity proofing for account recovery?
A: Use stronger proofing when the recovery event carries higher risk than ordinary sign-in, such as account lockout, access restoration after repeated failures, or help desk calls involving sensitive systems. The point is to match assurance to the recovery path, not to impose maximum friction everywhere.
👉 Read our full editorial: Account takeover protection for help desks starts at recovery