Anatomy of a Fraud Attempt: The Help Desk Ticket

An employee is locked out. They post in the IT Slack channel asking for a password reset. Someone on the IT team helps.

Fast, familiar, and almost entirely unverifiable.

Proof's own IT team looked at that flow and saw what an attacker would see. Felicia Carnell, Director of Information Technology: "In today's world of malicious actors, how do you know that the person on the other end of that is that person? That could be somebody who just has their phone that's logged into Slack."

Key takeaways

• Internal account recovery is usually the least verified path into a company, and it is defended by helpfulness.
• The attack needs no exploit. A logged-in device, a borrowed account, or a convincing message is sufficient.
• Proof rebuilt its own flow around identity verification through Okta, completing in under two minutes.

How the scheme works

1. Get a foothold in a channel people trust. A misplaced phone still logged into Slack, a compromised account, or an external contractor account nobody deprovisioned.
2. Pick a plausible moment. Monday morning, a new device, a travel week. Lockouts are ordinary and urgent, which is the combination that shortcuts scrutiny.
3. Ask for the reset in the normal way. No pretext elaborate enough to attract attention, because the request itself is routine.
4. Let helpfulness do the work. The IT team's job is to restore access quickly, and the request looks exactly like the dozens of legitimate ones that week.
5. Use the new credentials before anyone reconciles the request with the person.

Why it gets past normal checks

There is nothing to catch.

The request arrives through an internal channel, from an account that belongs to a real employee, asking for something that happens every day. Single sign-on does not help, because the reset is what grants access. MFA does not help, because the reset re-enrolls it. The control that would catch this is a verification step that nobody had, and the pressure runs the other way: an IT team measured on time-to-resolution is being asked to slow down.

External attackers know this. CISA and the FBI updated their Scattered Spider advisory in July 2025, describing a group that "targets large companies and their contracted information technology (IT) help desks" to social-engineer resets and MFA transfers. Mandiant's M-Trends 2026 found voice phishing surged to 11% of initial infection vectors, now second only to one, while email phishing dropped to 6% of intrusions. Verizon's 2026 DBIR added pretexting as a newly tracked vector at 6% of all breaches, naming attackers "impersonating help desk agents or users needing a password reset."

How Proof disrupts the fraud scheme

Proof ran this on itself.

Verify before anything resets. 

Identify is integrated into the account recovery flow through Okta. Any employee locked out, or receiving a replacement device, verifies identity before a credential is reset or a machine provisioned. The check runs against existing Okta profile attributes, sends a secure link by SMS or personal email, and completes in under two minutes.

Give the failure a path. 

Anyone who cannot pass verification routes to a trusted referee, so the control does not simply lock people out.

‍Move it earlier, into enrollment. 

Working with the security team, Proof embedded verification directly into device enrollment. A new hire logging in for the first time, or a replacement machine shipping out, prompts verification before the process can continue.

The friction everyone expected did not arrive. Proof's summer interns, whose college addresses sometimes differ from their government IDs, were the obvious edge case. There were none.

Carnell's argument for the return is blunt, and drawn from having lived through a breach at a previous company: "Even something as small as impersonating someone on Slack to get their laptop password changed, it can cost a company everything: dollars, manpower, all sorts of things." 

Against IBM's 2025 figure of $4.44 million for an average breach globally and $10.22 million in the United States, two minutes reads differently.

The question to ask

What does your IT team do when someone messages asking for a password reset? If the honest answer involves recognizing a name or a profile photo, you have the exposure CISA, Mandiant, and Verizon all documented in the same twelve months.

To learn more about the fraud patterns we see emerging in 2026, check out our field guide.