Organizations have invested heavily in securing employee connections. Multi-factor authentication (MFA), conditional access policies, and other identity controls make it more difficult for attackers to gain unauthorized access. But these protections can be compromised if the access recovery process is not held to the same standards.
When an employee needs to regain access to their account, it is often the service desk that provides password reset or account recovery. Yet identity verification still typically relies on knowledge-based questions, such as the name of an employee’s manager or department.
This creates a gap in identity security, where a weaker path to an account can bypass stronger login security. And as social engineering attacks become more convincing, this gap becomes increasingly dangerous.
Why knowledge-based verification is no longer reliable
Attackers can gather a surprising amount of information before making a call. LinkedIn profiles, company websites, social media and data leaks can reveal everything from job titles and colleagues to office locations and personal information.
Armed with this information, an attacker can correctly answer verification questions and appear as a legitimate employee.
This becomes particularly dangerous when passing these checks is enough to authorize a password reset or recover an account. An attacker could gain access to this account without ever having to compromise the employee’s original credentials.
The risks of knowledge-based authentication are well established. NIST Digital Identity Guidelines no longer recognize security questions as an acceptable authentication method. In the threat landscape of 2026, knowing information about someone is not proof of their identity.
Verizon’s Data Breach Investigations Report reveals that stolen credentials are involved in 44.7% of breaches.
Secure Active Directory effortlessly with compliant password policies, blocking over 4 billion compromised passwords, strengthening security and dramatically reducing support issues!
AI and social engineering make the gap even more dangerous
Cybercriminal groups such as Spider scattered have made the service desk a privileged target. Rather than trying to bypass MFA directly, attackers pose as employees and convince service desk agents to reset passwords or register new MFA devices. A convincing phone call may be all it takes to gain access to an account.
Generative AI makes these attacks harder to detect and easier to scale. Attackers can use AI to create believable stories, generate natural-sounding conversations, and even impersonate employees. This makes it increasingly difficult for service desk agents to distinguish legitimate callers from attackers.
A Gartner Survey 2025 found that 62% of organizations had experienced a deepfake attack involving social engineering or automated processes in the previous year.
In the meantime, Verizon DBIR 2026 found that social engineering via text messages and voice calls had a 40% higher success rate than traditional email phishing.
Service Desk agents can no longer rely on a person’s ability to convince. Identity verification should be based on secure, consistent controls rather than an agent’s ability to recognize attempted identity theft.
It’s not just a security issue
Access recovery also has a cost. Account lockouts create service desk tickets that interrupt employee work and put pressure on overworked IT teams. When someone loses access outside of business hours, even a routine reset can result in hours of downtime.
There is also a monetary cost; one time help desk password reset costs around $70. Multiply that by hundreds or thousands of requests, and the expenses add up quickly.
Secure self-service recovery can help employees regain access without contacting the help desk, while streamlined identity verification helps agents process requests that still require assistance. With the right processes in place, organizations can reduce workload without weakening security.
Closing the Gap: What Secure Service Desk Verification Looks Like
It is unrealistic to expect service desk agents to become experts in detecting AI-based social engineering attempts. Training remains crucial, and agents must be able to confidently decline requests or report them when something doesn’t seem right.
Along with this, they need a reliable way to verify identities before making sensitive changes to their account. Verification should be a mandatory step and not a judgment based on a person’s level of belief.
Solutions like Specops Secure Service Center Helping organizations put this into practice with a simple four-step process:
- An employee contacts the service desk: An employee, “John Doe,” calls because he cannot access his account. The agent initiates a recovery request via Specops Secure Service Desk.
- The agent locates the account: Using John’s contact information, the agent finds his account and begins the verification process.
- Identity verification takes place: Specops Secure Service Desk supports a range of verification methods, including email, SMS and third-party authenticators like Duo, so organizations can choose an appropriate method for the request, whether the caller has access to a smartphone or not.
- The agent continues after successful verification: Only once John has successfully verified his identity can the agent perform the requested action, such as resetting his password.
The goal is to make secure identity verification an integral part of service desk workflows, without adding unnecessary friction for agents or employees.
Make account recovery as secure as logging in
Strong login security doesn’t mean much if attackers can bypass it by convincingly calling the service desk. Password resets and account recovery require verification every bit as robust as the authentication controls they protect.
By replacing knowledge-based questions with consistent, secure verification, organizations can reduce the risk of identity theft without making life more difficult for employees or service desk agents.
Want to see how it works? Take it interactive walkthrough of Specops Secure Service Desk to see how service desk agents can securely verify identities before making sensitive account changes.
If you would like to see how Specops can support your identity security strategy, contact us today.
Sponsored and written by Specops software.
