IT service desks have emerged as a primary vector for bypassing Multi-Factor Authentication (MFA), as attackers increasingly exploit human-to-human interactions to gain administrative access. Threat actors, most notably the Scattered Spider (UNC3944) group, are targeting help desk agents with sophisticated voice phishing (vishing) campaigns to trigger unauthorized password resets or new device registrations.
The scale of this “Identity Gap” is expanding. Reported vishing incidents surged by 442% year-over-year in late 2026, according to industry data. This trend coincides with a rise in the financial impact of such breaches; the IBM 2026 Cost of a Data Breach Report indicates that the average cost of a global data breach has reached $4.99 million. Specifically, incidents involving voice and SMS phishing as the initial entry point are significantly more expensive, costing an average of $5.29 million and taking approximately 247 days to contain.
The Failure of Knowledge-Based Authentication
Traditional identity verification at the service desk frequently relies on Knowledge-Based Authentication (KBA). These methods require users to provide “secret” information, such as an employee ID number, the last four digits of a Social Security number, or manager names. However, NIST SP 800-63-4 guidelines have moved toward officially deprecating KBA for high-assurance environments because this information is easily harvested from social media platforms like LinkedIn or acquired through historical data leaks.
Attackers leverage this publicly available data to impersonate employees convincingly. In 2025 and 2026, high-profile campaigns against major retailers, including Marks & Spencer, demonstrated how vishing-driven ransomware can cause massive operational losses by compromising the very department tasked with maintaining security: the IT service desk.
Cryptographic and Biometric Gates
To close the gap, organizations are shifting toward cryptographic and biometric verification that removes the human agent’s discretion from the process. Recent updates to Specops Verified ID, for example, have expanded support for Microsoft Entra ID users as of September 2026. This integration enables IT departments to perform biometric liveness checks and verify government-issued identity documents within cloud-only environments.
A critical component of this transition is the implementation of “Hard Gates” within service desk workflows. In a Hard Gate configuration, the reset tools available to the IT agent remain locked and inaccessible until the user successfully completes an out-of-band verification. This prevents agents from being socially engineered into “making an exception” for a caller who sounds distressed or urgent.
Modern verification platforms have scaled to meet global requirements, with some now supporting over 16,000 different identity document types across 200 countries. This allows for automated, high-assurance verification that matches a user’s live selfie against the photo on a government-issued ID, a process that is significantly harder to spoof than traditional voice-based interactions.
Addressing AI Voice Cloning and Real-Time Deepfakes
The threat landscape is further complicated by the emergence of AI voice cloning. In 2026, data showed a sharp increase in the use of real-time deepfakes specifically targeting help desks. While a human agent may struggle to distinguish a cloned voice from a genuine employee, cryptographic verification methods do not rely on auditory cues.
By moving the point of trust from a human conversation to a cryptographic exchange or a biometric match, organizations can mitigate the risks associated with the 72% of users who reportedly abandon complex or friction-heavy onboarding processes. Modern solutions aim for “passive” or “low-friction” biometric checks that provide higher security than KBA without increasing the operational burden on the service desk.