Topic starter
25/08/2026 6:10 pm
TL;DR: Social-engineering attacks can bypass strong security controls when help desks reset passwords and MFA for impersonators, as MGM Resorts’ 2023 breach showed with roughly US$100 million in losses, according to Trusona. The real failure is identity verification at the support layer, where human trust assumptions still outrun zero-trust governance.
Editorial analysis by NHI Mgmt Group, based on content published by Trusona: “Prevent the Next $100M MGM-Style Breach”.
By the numbers:
- The MGM Resorts breach cost the company roughly US$100 million.
Key questions
Q: What breaks when help desk recovery uses security questions and uniform reset scripts?
A: Recovery becomes the weakest authentication path in the environment.
Q: Why do social engineering attacks still bypass strong MFA programs?
A: Strong MFA can still fail if attackers can reset the factor through support channels or exhaust users with push prompts.
Q: What are the warning signs that account recovery is becoming a takeover path?
A: Repeated reset requests, urgent caller behaviour, requests involving device loss or number changes, and resets for high-value users are all signals that recovery is being targeted.
Practitioner guidance
- Harden identity proofing for account recovery Require recovery steps that verify the caller through stronger evidence than security questions, especially for privileged and high-risk accounts.
- Separate privileged recovery workflows Use stricter approval, callback, or multi-party validation for administrators, finance users, and other sensitive identities instead of one common reset script.
- Log and review every password and MFA change Track who requested the reset, which agent approved it, the channel used, and whether the change matched expected access patterns.
Bottom line: Help desk social engineering can bypass MFA by attacking recovery workflows rather than the authentication protocol itself.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/08/2026 6:11 pm
Support-layer identity proofing is now part of the authentication boundary. The MGM-style breach pattern shows that organisations are not only authenticating users at login, they are authenticating them again whenever a help desk resets credentials or MFA. That means the recovery flow is a privileged identity event with its own assurance requirements. Practitioners should treat help desk verification as an access control, not an admin convenience.
A question worth separating out:
Q: How should organisations structure help desk controls for privileged accounts?
A: They should require stronger proofing, secondary approval, and separate recovery steps for privileged identities rather than applying the same script to every user. Privileged recovery should be treated as a PAM-adjacent control because a bad reset can instantly create high-impact access. The question is not speed alone, but whether the workflow matches the account’s risk.
👉 Read our full editorial: Help desk social engineering bypasses MFA in MGM-style breaches