Every day, the service desk helps colleagues who cannot sign in. Resetting a password or linking a new device for MFA is routine. But how does the service desk know for sure that the caller really is that colleague? If it cannot, one phone call can be enough to take over an account. This is called account takeover via the service desk.
What is account takeover?
In an account takeover (ATO), also known as account hijacking, an attacker gains access to someone else's account. They can then sign in, read email and use systems as if they were that person. With all the permissions of that account.
There are several routes into an account. This article is about the route via the service desk: the attacker calls, poses as an employee and has the password reset or MFA set up again. This is a form of voice phishing, also known as vishing.
Why via the service desk?
The service desk exists to get colleagues back to work quickly. As a result, an attacker does not need to hack anything: a normal process gives them access. To the service desk, it looks like ordinary work. A ticket, a reset, a satisfied caller.
That is not the employees' fault. They have to establish who is calling without seeing that person, and often under time pressure. The risk lies in the process, not in the people.
Why MFA does not stop this
MFA protects the sign-in. But MFA also has to be resettable, for example when someone has a new phone. Anyone who gets the service desk to do that bypasses MFA. Your MFA is therefore only as strong as the reset.
Does this really happen?
Yes. In a joint advisory on the group Scattered Spider, the US CISA and FBI describe how attackers pose as employees to the helpdesk. This is how they have passwords reset and MFA transferred to a device they control themselves.
In the Netherlands, it is also a board-level issue. Since 15 August 2026, the Cyberbeveiligingswet (the Dutch Cybersecurity Act) has been in force. The board bears ultimate responsibility for cyber risk management, and NIS2 lists access control and multi-factor authentication among the mandatory measures.
How do you know whether your service desk stops this?
A procedure on paper says little about what happens on the phone. To know, you have to test it. In an account takeover assessment, DeepCalls calls your service desk as an attacker would. Always within signed authorisation and agreements set out in advance.
What can you do?
- Test the practice. An account takeover assessment shows whether your service desk releases an account to someone who calls.
- Look at the process. A process analysis shows where policy and practice diverge.
- Consider technical verification. Technical measures replace the judgement of a single employee with a control that the caller must pass themselves.
