Vishing and Help Desk Social Engineering: How to Stop It

Several of the most disruptive attacks attributed to Scattered Spider did not start with malware, but with a phone call to the IT help desk. An attacker posing as an employee asks for a password or multifactor authentication (MFA) reset, and a helpful agent hands over the keys. This guide explains how vishing and help desk social engineering work, and the controls that stop them in a Microsoft 365 environment.

‍

What Is Vishing?

Vishing, short for voice phishing, is a social engineering attack carried out by phone or voice call, where the attacker pretends to be someone trusted to get information, a password reset or access. In a vishing attack, the caller relies on urgency and a believable story rather than a malicious link.

Common business pretexts include:

• IT support calling to “fix” a problem with your account.
• An employee who is locked out minutes before an important meeting.
• The bank’s fraud team asking you to confirm a transaction.
• A supplier calling to change its bank details.

Calls no longer come only through phone lines. Attackers also reach staff through Microsoft Teams, posing as internal tech support.

The table shows how vishing compares with phishing and the other attacks it is often confused with. Vishing and smishing both move the attack off email, one onto calls and the other onto text messages.

‍

What Is Pretexting in Cyber Security?

Pretexting is when an attacker builds a believable story, the pretext, to persuade someone to share information or take an action they normally would not. In the UK it is also called blagging.

A good pretext is built from public information. Attackers pull job titles and reporting lines from LinkedIn, the name of the IT provider from the company website, and timing from recent company news. The more accurate the details, the less the target questions the request.

Here is an illustrative example, not a real case. A caller says they are a regional manager locked out of their account before a board meeting. They name the right line manager and the company’s IT supplier, sound stressed, and ask for an MFA reset on a “new phone”. Every detail checks out, and none of it proves who they are.

Pretexting is the story itself, while phishing and vishing are the channels used to tell it, so a pretexting attack can arrive by email, text, phone or Teams.

‍

What Is Help Desk Social Engineering?

Help desk social engineering is when attackers manipulate IT support processes to take over accounts. It runs in two directions: attackers pretend to be employees calling the help desk, or pretend to be the help desk calling employees. The same applies to an outsourced service desk, so the risk sits with whoever handles your resets.

Direction 1: the attacker poses as an employee. The attack usually follows five steps:

1. Research the target employee and the company’s IT provider online.
2. Call the help desk with urgency, such as “I’m locked out and presenting in 10 minutes.”
3. Pass weak identity checks using public or leaked details.
4. Get a password and MFA reset, then register the attacker’s own phone or sign-in method.
5. Sign in as the employee, then go after admin accounts and data, often ending in how ransomware attacks start.

This is a documented pattern. The CISA advisory on Scattered Spider describes the group convincing IT help desk staff to reset passwords and MFA tokens, then registering its own MFA tokens to keep access.

Direction 2: the attacker poses as the help desk. Here the target is an ordinary employee:

• A caller claiming to be IT asks the employee to read out a code or approve a sign-in prompt.
• The caller tells the employee to install a remote access tool so they can “fix” the problem.
• In Microsoft Teams, Microsoft reports that Storm-1811 flooded users with junk email, then posed as tech support offering to fix it, and used remote management tools to deliver ransomware.

Once an attacker is signed in, stopping them becomes a job for identity threat detection and response.

‍

What Happened at M&S and Co-op?

In spring 2025, Marks & Spencer and Co-op were hit by cyberattacks that put help desk social engineering in the headlines. The NCSC responded by telling organisations to review how their help desks verify staff before resetting passwords.

M&S. Chairman Archie Norman told MPs in July 2025 that the attackers got in on 17 April through a sophisticated impersonation involving a third party. In its full-year results, M&S estimated an impact of about £300m on 2025/26 operating profit before cost mitigation, insurance and trading actions, and online shopping was paused for weeks.

Co-op and others. Co-op was attacked in the same weeks, and Harrods soon after. In July 2025, the National Crime Agency arrested four people in connection with the attacks on all three retailers.

The NCSC’s guidance for retailers urged organisations to “review helpdesk password reset processes”, especially for staff with escalated privileges. It also noted that press links to Scattered Spider were speculation. Microsoft has since reported that Octo Tempest, also known as Scattered Spider, hit retail, food services, hospitality, insurance and airlines in 2025, often starting by impersonating users to service desk support.

Outsourced help desks are targets too, because attackers impersonate users to whoever runs the service desk. That puts MSPs in the firing line, and security monitoring for MSPs covers the accounts their help desks reset.

A fake reset only works if nobody notices what happens next. Book a call with CyberQuell to set up 24/7 SOC monitoring that watches identity activity across Microsoft 365 and Entra ID, with a 15-minute alert response.

‍

Why Do Phone Attacks Get Past Security Tools?

Phone attacks get past security tools because there is no email to filter and no malicious link to block. The attack targets a person whose job is to help, often under time pressure.

The numbers back this up. In phishing simulations covered by the Verizon 2026 Data Breach Investigations Report, phone and text-based campaigns had a median click rate about 40% higher than email campaigns. Staff who have learned to spot a suspicious email are far less practised at spotting a suspicious caller.

Voice is also getting easier to fake. Attackers can use AI-generated voice deepfakes to sound like a real executive, which turns a familiar voice into a weak form of proof. The same tactics show up in deepfake and email-based social engineering, where a call is used to make a fake request look genuine.

Help desk targets often reward speed. Agents are measured on how quickly they resolve tickets, and a stressed caller who is “locked out before a board meeting” is exactly the kind of ticket they want to close fast.

‍

How to Secure Your Help Desk Against Social Engineering

Secure the help desk by verifying callers with something an attacker cannot look up, applying stricter rules to privileged accounts, and alerting on risky changes after every reset. These eight controls cover the process, the technology and the people.

1. Stop using public facts as proof. An employee ID, a manager’s name, a date of birth and a job title can all be found online or guessed. If a detail appears on LinkedIn or in a data breach, it cannot prove identity.
2. Call back on a known number. End the call and ring the number held in the HR directory, never one the caller gives you. An attacker can spoof caller ID, but cannot answer the real employee’s phone.
3. Require video or manager verification for MFA resets. Ask the caller to join a video call and show their face against their staff photo, or get their line manager to confirm the request through a separate channel. Either step adds friction an attacker struggles to fake.
4. Verify identity with Microsoft Entra Verified ID. In a verified help desk, Face Check matches a live selfie to the photo in the employee’s verified credential, and only then can a Temporary Access Pass be issued. The agent no longer has to judge identity alone. Verified ID pricing includes a free baseline tier of up to 50,000 transactions a month, while Face Check is billed per verification.
5. Lock down privileged resets. Never reset an admin account over the phone. Give help desk agents roles such as Helpdesk Administrator, which can only reset passwords for non-administrators, and scope them further with Entra ID administrative units. Administrative units need an Entra ID P1 licence for each administrator assigned to them.
6. Make a reset less valuable. With phishing-resistant MFA such as passkeys, a reset password on its own does not get the attacker in. CISA recommends FIDO-based phishing-resistant MFA as a core defence against Scattered Spider.
7. Alert on what follows a reset. Watch for a new MFA method registered soon after a reset, sign-ins from new locations and admin role changes. Catching that sequence quickly is the job of 24/7 SOC monitoring.
8. Give agents permission to say no. Set a clear escalation path for suspicious requests. Include vishing calls in social engineering training for employees, starting with the help desk.

‍

How to Protect Staff From Callers Pretending to Be IT

Tell staff, in writing, that IT will never ask for their MFA code or password, and that any unexpected support call should be ended and reported. Then back that rule up with technical controls, so a single mistake does not hand over access.

• One rule everyone remembers. “IT will never ask you to read out a code.” Put it in onboarding, on the intranet and in every IT email signature.
• Restrict Microsoft Teams external access. Microsoft recommends limiting external chat and meetings to approved domains, which cuts off the route used in the fake tech support calls it has seen in Teams.
• Block unapproved remote access tools. CISA’s Scattered Spider advisory recommends application allowlisting, so staff cannot install a tool a caller asks for.
• Confirm bank detail changes by phone. Finance teams should call a known number before changing payment details. CyberQuell made this recommendation after a payment redirection attack it investigated, where a lookalike email address was used to swap the bank details on an invoice. Pair it with dual authorisation for wire transfers, so no single person can move money on request.
• Make reporting easy. Give staff one channel for “I think I just got a scam call”, and thank them every time they use it.

‍

Vishing and Impersonation Warnings in the UK and UAE

UK and UAE authorities have both warned about impersonation attacks. The NCSC focused on help desk resets after the 2025 retail incidents, and the UAE Cyber Security Council warned about fraudsters posing as government bodies and trusted companies.

UK. The NCSC’s retail guidance asks organisations to review how their help desks verify staff before resetting passwords, especially for privileged accounts. Retailers and the suppliers that run their IT support remain targets, because one successful call can reach a whole business.

UAE. In February 2026, the UAE Cyber Security Council warned that scam messages had risen by about 35% over the past year, with fraudsters impersonating government entities, institutions and trusted companies. That figure covers messages rather than calls, but the impersonation tactic is the same one vishing relies on. For organisations in Dubai, Abu Dhabi and across the Emirates, the UAE Information Assurance Standards behind NESA compliance include access control requirements, and help desk resets for privileged accounts sit squarely inside them. CyberQuell’s guide to NESA identity and access requirements covers the detail, and SOC as a service in the UAE adds round-the-clock monitoring of what happens after a reset.

‍

Final Thoughts

Attackers go where verification is weakest, and that is often a phone line rather than a firewall. Fix the help desk process, make a reset less valuable with phishing-resistant MFA, and watch closely for what happens after every reset, because that is where a fake call turns into a breach. Book a call with CyberQuell to set up 24/7 SOC monitoring for Microsoft 365, or to run a Microsoft 365 security assessment of the Entra ID settings that limit the damage. UAE organisations can start with our SOC as a service in the UAE.