Specialisation

Account takeover via the service desk

An attacker does not need a password. One convincing phone call to the service desk can be enough to have a password reset or a new MFA device linked. DeepCalls tests whether your service desk stops that.

Book an intro callHow it works
  • Tailored to your organisation
  • Within signed authorisation
  • Conducted by experienced specialists
  • Including an overview of technical measures

What it is

What is account takeover via the service desk?

In an account takeover, an attacker takes over an employee's account. Via the service desk, this can happen without a hack. The attacker calls, poses as that employee and asks for help signing in.

If they get a new password or a new MFA device is linked, they have access to that employee's email, systems and data. With that employee's permissions.

That is not the service desk's fault. It exists to help colleagues quickly, and has to establish who is calling without seeing that person. Account takeover is also known as account hijacking, and is a form of voice phishing or vishing.

Why

Your MFA is only as strong as the reset

01
Nothing fails technically.
The attacker does not break in. They gain access through a normal process.
02
It looks like ordinary work.
A ticket, a reset, a satisfied caller. That is why it does not stand out by itself.
03
One account can be enough.
What an attacker can do with it depends on the permissions of that account.
04
It happens in practice.
In their advisory on Scattered Spider, the US CISA and FBI describe how attackers have the helpdesk reset passwords and transfer MFA.
05
It is a board-level issue.
Since 15 August 2026, the Cyberbeveiligingswet (the Dutch Cybersecurity Act) has been in force. The board bears ultimate responsibility for cyber risk management, and NIS2 lists access control and MFA among the measures.

Who it is for

For organisations where one account can open a lot

Relevant to any organisation where the service desk can reset passwords or MFA at a caller's request. In particular:

You do not need to know exactly what you want tested. In the intake, we decide together what makes sense.

  • Multinationals and complex organisations with multiple entities, locations or languages
  • Organisations with an outsourced service desk, or with local IT alongside a central service desk
  • Banks, insurers and other financial institutions
  • Government bodies, education and organisations that fall under the Cybersecurity Act
  • Organisations that have invested in MFA and want to know whether it also holds up on the phone

The assessment

We test the process, not the people

In an ATO assessment, we call your service desk as an attacker would, within agreements set out in advance. We look at:

01
Identity verification.
How the service desk establishes who is calling.
02
Password and MFA resets.
Whether the procedures hold up in practice.
03
Escalation and handover.
What happens when a request goes to another department or to local IT.
04
Resilience under pressure.
Whether the process stands firm when a caller persists.
I do not test people, I test processes. That is why I process everything anonymously. A service desk wants to help, and a good procedure and the right technical verification make sure it can do so safely.

Lara Hemstede

founder DeepCalls

What you get

  • A report with the findings per call

  • Optional: a process analysis that shows where the procedure leaves room, so you can improve the process

  • An overview of technical measures for identity verification at the service desk

  • A final presentation for your team

The process

From intake to insight

  1. 01

    Intake.

    We discuss your organisation, processes and risk profile, and record the agreements.

  2. 02

    Scenario development.

    Tailored to your sector and organisation. No standard scripts.

  3. 03

    Execution.

    The calls with your service desk, within signed authorisation.

  4. 04

    Reporting and final presentation.

    You receive the report and we present the outcomes to your team.

Within agreements

Realistic, but controlled

Every assessment takes place within signed authorisation and rules of engagement agreed in advance. We work in accordance with the GDPR and without disrupting your operations. Findings are reported anonymously and confidentially.

Frequently asked questions

Can someone have my password reset via the helpdesk?
If the service desk cannot properly establish who is calling, yes. An ATO assessment shows whether that is the case for you.
We have MFA. Is this still necessary?
MFA protects the sign-in. If the service desk can reset MFA or link a new device, there is a route around MFA via the phone.
What is the difference from a phishing simulation?
A phishing simulation tests whether employees respond to an email. An ATO assessment tests whether the service desk releases an account to someone who calls.
Is this a pentest?
No. It is a test of a process via the phone. We offer technical pentests through our partner network.
Can an outsourced service desk be tested too?
Yes. The external party that runs your service desk gives permission for the test. The contract and arrangements run through you as the client.
What do we do after the assessment?
Using the report, the optional process analysis and the overview of technical measures, you decide what to change.

Introductory call

Do you know what your service desk does when we call?

In an introductory call, we discuss your situation and whether an ATO assessment is a good fit.

Book an intro call