The Security Risk Hiding in Help Desk Requests
The article explains that despite advances in employee authentication like multi-factor and passwordless logins, attackers increasingly exploit weak and convenience-focused account recovery processes—such as help desk password resets relying on easily compromised signals and human judgment—to bypass security and gain unauthorized access to enterprise systems.
Organizations have spent the past decade strengthening employee authentication and access to sensitive environments. Multi-factor authentication, fully-integrated identity providers, and passwordless logins have made it harder for attackers to break into enterprise systems using brute force.
However, attackers rarely attack the strongest defensive points directly. Instead, they look for the easiest path to gain access. Increasingly, that “easy” path takes advantage of archaic employee account recovery workflows.
Password reset, IT help desk request, and device enrollment workflows exist to help employees quickly regain access when something goes wrong. Yet when these processes rely on weak or passive signals, human judgment, and knowledge-based authentication, they can quickly become one of the easiest ways for adversaries to access internal systems and bypass security protocols.
Why account recovery is becoming a target
Account recovery sits at a difficult intersection between security and productivity. Employees forget passwords. Devices are lost, stolen, or replaced. Authentication apps stop working. Even organizations that have moved to Passkeys still need recovery processes when something goes wrong.
To keep work moving, companies design these workflows to be fast and convenient. But that convenience creates opportunities for attackers.
Many recovery workflows still rely on signals that attackers can easily compromise or impersonate, including:
- Security questions
- Password reset links (possibly sent to compromised email accounts)
- One-time passcodes (intercepted, or sent to compromised devices)
- Manual identity checks by help desk agents
These methods were designed for usability, not to withstand sophisticated social engineering powered by GenAI tools.
Recent incidents have shown how effective these tactics can be. Attackers have increasingly targeted corporate help desks directly, impersonating employees in order to convince IT staff to reset credentials or two-factor authentication methods. When attackers gain access to one system, they can often move laterally across internal systems.
Instead of bypassing security controls, attackers persuade someone to open the door for them.
The operational reality for IT teams
Inside most organizations, account recovery is not a rare edge case, it’s a routine operational task. At large organizations, it’s almost guaranteed that at least one employee will encounter this issue every day. As a result, password resets account for 20 to 50 percent of IT help desk tickets each year, according to Gartner.
Each request forces IT teams to balance two priorities:
- 1.Quickly restoring access so employees can get back to work.
- 2.Ensuring they aren’t granting access to someone impersonating a legitimate employee.
This tension is exactly what attackers exploit. A convincing story, a sense of urgency, and a small amount of personal information can often persuade a support agent to issue a reset or temporary credential. When that happens, the attacker bypasses every other security control that came before it.
Identity attacks are accelerating
The broader threat environment makes this problem even more urgent. The IBM Cost of a Data Breach Report estimates that the average cost of a data breach in the U.S. reached a staggering $10.22 million in 2025, highlighting the growing cost of identity-driven security incidents.
At the same time, credential theft has exploded. Last year, researchers reported a dataset containing more than 16 billion leaked login records, giving attackers enormous resources for launching account takeover campaigns.
Artificial intelligence is also amplifying social engineering. Security researchers warn that generative AI tools are enabling more convincing impersonation attacks, including deepfake audio and video designed to trick support teams.
Taken together, these trends make identity the most valuable target for attackers. And account recovery is often the weakest point in that system.
A better model for account recovery
The most effective way to close this “account recovery” gap is simple: verify the identity of the person requesting access before the recovery process is completed. Instead of relying on security questions or subjective judgment, organizations can require employees to prove who they are as part of the workflow.
This approach can secure several common recovery scenarios:
Self-service password resets (SSPR)
Before issuing a reset link, the system requires employees to complete identity verification. Once verification succeeds, password resets can proceed.
Help desk-assisted recovery
When an employee contacts IT support, the help desk agent sends an identity verification link. The recovery process is initiated only after verification succeeds.
Device and MFA enrollment
When an employee is being onboarded, or needs to enroll a new device or authenticator, identity verification ensures the request is coming from the legitimate user.
This process eliminates the most vulnerable and commonly exploited step in traditional recovery workflows: subjective identity checks.
How Proof secures account recovery
Proof enables organizations to verify employee identities as part of their account recovery workflows. By integrating identity verification with password reset systems, help desk platforms, and identity providers, organizations can ensure the person requesting access is actually an employee.
Companies use Proof to:
- Verify employee identities before password resets
- Secure help desk recovery requests
- Protect device and MFA enrollment workflows
- Detect deepfakes and impersonation attempts
- Create reusable digital identities that simplify future verification
For IT teams, this removes guesswork from recovery processes. Help desk agents don’t have to rely on intuition or incomplete identity signals. Verification becomes part of the workflow itself.
Employees benefit as well. Instead of answering security questions or waiting for manual assistance, they can complete a quick identity verification step and regain access quickly. Security gets better while the employee experience becomes faster and more reliable.
Learn how Proof protects account recovery
Proof helps organizations verify employee identities before completing password resets, help desk requests, and device enrollment. By embedding identity verification directly into recovery workflows, teams can restore access quickly while ensuring only legitimate users regain control of their accounts.
Related
The Evolving Landscape of Authentication | Proof
The blog explores five advanced authentication methods, focusing on app-based and continuous authentication, explaining how app-based authentication uses time-sensitive codes generated on a device to prevent phishing and SIM-swapping, while continuous authentication monitors user behavior throughout a session to ensure ongoing identity verification, with Proof enhancing security by integrating these methods into a comprehensive identity assurance framework combining device, document, and biometric verification.
Multi-Signal Fraud Detection Benchmarks
Proof has developed a layered fraud detection model that combines passive signals, active checks, and collective telemetry from its Identity Authorization Network to outperform traditional passive-only methods by 600-1,300% in detecting sophisticated fraud without increasing user friction, addressing the shortcomings of standard approaches like MFA and KBA that are increasingly ineffective against targeted attacks.
The Fraud Files: Stolen Credentials, Fake Biometrics, and the Synthetic Identity Wave (June 2026)
A June 2026 report reveals that financial institutions' traditional identity verification methods—relying on secret information, trusted documents, and biometric authenticity—are under massive commercial-scale attack, with infostealer malware in 2025 exfiltrating over 1.8 billion credentials from 5.8 million devices (an 800% increase), leading to widespread circulation of valid stolen banking and payment card data on dark web marketplaces, fueling account takeovers, synthetic identity fraud, and ransomware attacks, thereby exposing the critical vulnerabilities in current security assumptions.
How Financial Institutions Can Keep Customers Safe with Authentication
The article emphasizes that financial institutions must implement strong, layered, and biometric-based authentication methods—moving toward passwordless solutions and combining identity verification with fraud intelligence platforms like Proof—to effectively combat rising threats such as account takeover, credential stuffing, and SIM-swapping, thereby protecting customer assets, maintaining trust, and ensuring regulatory compliance.
Deepfakes in the Financial Services Industry | Proof
The article discusses how AI-generated deepfakes pose significant fraud risks to financial services by exploiting the fraud triangle—motivation, opportunity, and rationalization—enabling sophisticated attacks like account takeover and payment fraud, while highlighting Proof's AI-driven platform that detects deepfake anomalies in real time to protect institutions from these emerging threats.
Introducing Persistent Identity: The Foundation of Repeatable Trust
Persistent Identity is a secure digital ID system that enables individuals to verify their identity once to a high-assurance standard, store it on the Proof platform, and reuse it across multiple online transactions and organizations via the Identity Authorization Network, thereby reducing inefficiency, abandonment rates, and trust erosion caused by repeated identity verifications in an increasingly digital and threat-prone environment.