Account Recovery: Identity Security's Blind Spot

Organizations have implemented robust authentication controls like MFA and conditional access, but account recovery remains a weak point. Service desks traditionally verify identity through knowledge-based questions—a manager’s name, department affiliation—that attackers easily answer using publicly available information from LinkedIn, company websites, and social media. This creates a bypass around stronger login protections.

Social engineering attacks on service desks are becoming more sophisticated and effective. Groups like Scattered Spider deliberately target help desk staff, relying on convincing impersonation to authorize password resets and new MFA device registrations. Generative AI amplifies this threat by enabling realistic voice cloning and persuasive fictional narratives, making it nearly impossible for agents to distinguish legitimate callers from attackers through conversation alone. Verizon’s 2026 breach report shows social engineering via phone has a 40% higher success rate than email phishing, and a recent survey found 62% of organizations experienced deepfake-enabled social engineering in the past year.

The solution requires replacing subjective human judgment with consistent, technical verification methods—email codes, SMS confirmations, or third-party authenticators. This approach reduces security risk while potentially lowering operational costs (average password reset costs around $70) and minimizing employee downtime from account lockouts. Implementing secure verification as a mandatory step rather than an optional check closes the identity gap without adding friction to legitimate recovery workflows.