What is social engineering, and why is the IT help desk the most common target?

Social engineering is a cyberattack technique where an attacker manipulates a person — rather than a system — into handing over access or credentials. The IT help desk is the single most targeted entry point because it is designed to help. Agents are trained to be accommodating, and the legitimate purpose of the call — a password reset, an account unlock — gives the attacker a plausible and sympathetic cover story. Unlike firewall exploits or phishing emails, a successful help desk social engineering attack requires no technical skill whatsoever. The attacker simply needs to sound convincing and know a handful of facts about the real user — information that is routinely available on LinkedIn, social media, or from prior data breaches. This is what makes it so effective and so consistently underestimated.

What is vishing, and how does it threaten the help desk?

Vishing — voice phishing — is social engineering carried out over the phone. At the IT help desk, a visher calls in pretending to be a legitimate employee, typically with an urgent story about being locked out or needing access before an important meeting. If the agent cannot reliably verify the caller's identity through an automated, enforceable process, the attacker walks away with credentials. Two of the most damaging corporate breaches of 2023 — MGM Resorts, costing $100 million, and Clorox, costing $380 million — both began with a single vishing call to the IT help desk. In the Clorox case, the attacker succeeded despite Clorox having clear written procedures in place. The agent simply did not follow them. FastPass IVM makes that failure mode impossible by taking the decision out of the agent's hands entirely. Cases continues to emerge like the Marks & Spencer and Coop breaches in 2025.

What happened at MGM and Clorox, and how could FastPass IVM have prevented it?

In September 2023, attackers linked to the Scattered Spider group called MGM Resorts' IT help desk, impersonated an employee, and convinced an agent to reset credentials for a privileged account. The breach cost MGM over $100 million in disruption, remediation, and reputational damage. One month earlier, the same group used an identical playbook against Clorox. They called the outsourced help desk operated by Cognizant, claimed to be a locked-out employee, and requested a password and MFA reset. The agent handed over credentials without asking a single verification question — in direct violation of Clorox's own written procedures. The attacker then called back and repeated the trick with a second account belonging to an IT security employee, instantly gaining domain-admin privileges. The resulting ransomware attack paralysed Clorox's production lines and caused widespread product shortages across the United States. Total damages reached $380 million. Clorox subsequently sued Cognizant for gross negligence. The critical lesson from both incidents is that FastPass IVM would have made the attack impossible at step one. Not harder — impossible. There is no charm, no urgency, and no social pressure that can make FastPass release a password before the verification threshold is met. The system controls the process, not the person. [Read the full MGM case analysis → MGM Data Breach: How Hackers Used Vishing to Target IT Help Desk ]

What happened at Clorox?

On 11 August 2023, attackers posing as locked-out Clorox employees called the IT help desk operated by Cognizant and asked for password and MFA resets. The agent complied without asking a single verification question, without following Clorox's credential support procedures, and without sending the required notification emails to the employee or their manager. The attacker walked away with working credentials. They then called back and repeated the same approach with a second account — this time belonging to a Clorox IT security employee. That gave them domain-admin privileges and unrestricted access to Clorox's core Active Directory environment. The attackers deployed ransomware across the network. Production lines were shut down. The company reverted to manual ordering and processing. Clorox bleach, Pine-Sol, Glad, and Burt's Bees products disappeared from store shelves across the US for months. In the six months following the attack, Clorox reported a 6% drop in sales volume and $380 million in total damages, including $49 million in direct remediation costs. Why the Clorox case matters more than MGM Clorox had updated its credential support procedures just months before the attack to make them clearer and more explicit. The procedures existed. The training had happened. The agent broke protocol anyway — most likely under social pressure from a convincing caller. Clorox subsequently sued Cognizant for negligence, alleging the agent handed credentials to a criminal with no authentication questions asked. FastPass IVM addresses this at the architectural level: it is not possible for an agent to skip the verification steps, because the system — not the agent — controls what happens next. No credential is issued until the required threshold is met.

AI is being used to attack help desks. How does FastPass IVM respond?

The threat: AI has removed the skill barrier from social engineering The traditional assumption was that a convincing impersonation required effort — research, preparation, and some level of natural talent. AI has dismantled that assumption entirely. Voice cloning tools are now freely available and can produce a convincing imitation of someone's voice from a few minutes of source material — a recorded all-hands meeting, a LinkedIn video, a voicemail. An attacker does not need to be charming or composed. They need a recording and an internet connection. Deepfake video calls are following the same trajectory. The same identity that once required physical presence to fake can now be approximated from a screen and a microphone. When these capabilities are pointed at an IT help desk — where agents are trained to be helpful and where a password reset requires nothing more than a convincing conversation — the exposure is significant. This is not a future risk. Scattered Spider, the group responsible for the MGM and Clorox breaches , has already been observed combining AI-assisted reconnaissance with live vishing calls against enterprise help desks. Why FastPass IVM is structurally immune to AI voice and deepfake attacks FastPass IVM does not verify identity by assessing how someone sounds or looks. It verifies identity through deterministic, policy-enforced checks that operate independently of the interaction itself. A push notification sent to the user's registered MFA device cannot be answered by a voice clone — the attacker does not have the physical device. An HR data check that requires the caller to confirm a partial value without being shown the full answer cannot be passed through a deepfake call — the attacker does not have access to the HR system. A device-matching check that confirms the call is associated with the user's enrolled workstation cannot be faked through a video call — the attacker is not on that machine. The attack surface that AI exploits — the human agent's judgment about whether someone seems legitimate — is exactly the surface that FastPass IVM removes from the equation. When the system controls the verification workflow, the agent's perception of the caller becomes irrelevant to the security outcome.

2024 Archives - Self Service Password Reset Tool

FN6/2024 Ny forventning til årsresultat

December 17, 2024

Nasdaq First North Growth Market meddelelse nr. 6/2024 København, den 16. december 2024 FN6/2024 Ny forventning til årsresultat Intern viden: Selskabets bestyrelse meddeler hermed at selskabet forventer et netto resultat før skat på minus 2,25-3,25 millioner DKK primært grundet ændrede regnskabsprincipper. Den tidligere forventning lå på minus 1 million DKK. Baggrund Selskabet ændrer nu periodiseringspraksis,

FN6/2024 Ny forventning til årsresultat Read More »

Preventing Social Engineering Attacks on IT Help Desks: Lessons from MoneyGram’s Breach

November 6, 2024

Home » 2024 Share on Facebook Facebook Share on Linkedin Linkedin 𝕏 Share on X X Preventing Social Engineering Attacks on IT Help Desks: Lessons from MoneyGram’s Breach Finn Jensen | Founder, FastPasscorp Social Engineering: The Invisible Threat to IT Help Desks In a recent high-profile data breach, MoneyGram fell victim to a social engineering attack

Preventing Social Engineering Attacks on IT Help Desks: Lessons from MoneyGram’s Breach Read More »

FN5/2024 Halvårsmeddelelse FastPassCorp 2024

August 27, 2024

FN5/2024 Halvårsmeddelelse FastPassCorp 2024 Resumé Delårsrapport for 1. halvår 2024 Selskabet har gennem det første halvår af 2024 oplevet en posi v udvikling sammenlignet med dligere år, hvilket har bidraget l en væsentlig forbedring af det samlede økonomiske resultat for 1.halvår. Tradi onelt set er første halvår præget af lav ak vitet, men i år

FN5/2024 Halvårsmeddelelse FastPassCorp 2024 Read More »

What is Vishing – The latest social engineering scam explained

June 27, 2024

Home » 2024 Share on Facebook Facebook Share on Linkedin Linkedin 𝕏 Share on X X What is Vishing? The latest social engineering scam explained and what you can do about it Finn Jensen | Founder, FastPasscorp Vishing, a shortened term for Voice Phishing, has emerged as a prevalent form of social engineering scam in recent

What is Vishing – The latest social engineering scam explained Read More »

Password Protection Plan

June 20, 2024

Share on Facebook Facebook Share on Linkedin Linkedin 𝕏 Share on X X Password Protection Plan Finn Jensen | Founder, FastPasscorp More than 80% of data breaches involve a weak or stolen password. Act with a comprehensive plan to protect the corporate passwords – it is much more than a question of password policy! In today’s digital age,

Password Protection Plan Read More »

Corvus Insurance: Attackers don’t break in; they log in

June 13, 2024

Home » 2024 Share on Facebook Facebook Share on Linkedin Linkedin 𝕏 Share on X X Corvus Insurance: Attackers don’t break in; they log in Finn Jensen | Founder, FastPasscorp In today’s digital era, cybersecurity threats are rapidly increasing, and one of the most critical yet often overlooked vulnerabilities is the IT help desk. Corvus Insurance

Corvus Insurance: Attackers don’t break in; they log in Read More »

Penetration Testing the Help Desk

June 5, 2024

Home » 2024 Share on Facebook Facebook Share on Linkedin Linkedin 𝕏 Share on X X Penetration testing your Help Desk? Finn Jensen | Founder, FastPasscorp In today’s cybersecurity landscape, service desks play a pivotal role in safeguarding sensitive corporate information. To illustrate, notable breaches at major companies have been traced back to service desk vulnerabilities:

Penetration Testing the Help Desk Read More »

6 steps implementing FastPass IVM: Project Managers' Guide

6 Steps Implementing FastPass IVM for Secure User Verification: A Project Manager’s Guide

May 30, 2024

Home » 2024 Share on Facebook Facebook Share on Linkedin Linkedin 𝕏 Share on X X 6 Steps Implementing FastPass IVM for Secure User Verification: A Project Manager’s Guide Finn Jensen | Founder, FastPasscorp In the digital age, the security of IT help desks against social engineering attacks is paramount. Hackers often attempt to exploit help

6 Steps Implementing FastPass IVM for Secure User Verification: A Project Manager’s Guide Read More »

IVM in Practice – FastPass

May 28, 2024

Home » 2024 Share on Facebook Facebook Share on Linkedin Linkedin 𝕏 Share on X X Identity Verification Manager in Practice Anders Meyer | CEO FastPasscorp At FastPass, we envisioned the FastPass Identity Verification Manager (IVM) back in 2017. It took a few years to build, followed by additional time to perfect. Now, we are

IVM in Practice – FastPass Read More »

Cisco Duo Breach Report

May 3, 2024

Home » 2024 Share on Facebook Facebook Share on Linkedin Linkedin 𝕏 Share on X X Cisco Duo Breached by Social Engineering – Dark Reading reports Finn Jensen | Founder, FastPasscorp Dark Reading reports that threat actors stole employee credentials through social engineering from a telco company sending SMS on behalf of DUO! It gave the

Cisco Duo Breach Report Read More »

Referat fra FastPassCorp generalforsamling 2024

April 30, 2024

Referat fra selskabets generalforsamling d. 29. marts 2024 kl. 16:00 findes i nedenstående link. Generalforsamlingen afsluttedes kl 16:30 Vedhæftet fil

Referat fra FastPassCorp generalforsamling 2024 Read More »

Ensuring Unparalleled Security in FastPass: A Deep Dive into Our Penetration Test Report

April 23, 2024

Home » 2024 Share on Facebook Facebook Share on Linkedin Linkedin 𝕏 Share on X X Ensuring Unparalleled Security in FastPass: A Deep Dive into Our Penetration Test Report Anders Meyer | CEO FastPasscorp At FastPass, our commitment to safeguarding our systems and protecting our users’ data is paramount. We understand that in the ever-evolving

Ensuring Unparalleled Security in FastPass: A Deep Dive into Our Penetration Test Report Read More »

A Guide to Robust User Verification: IT Help Desk Security

April 19, 2024

Home » 2024 Share on Facebook Facebook Share on Linkedin Linkedin 𝕏 Share on X X Enhancing IT Help Desk Security: A Guide to Robust User Verification Finn Jensen | Founder, FastPasscorp In an era where cyber threats loom larger than ever, the security of IT help desk operations has become a critical concern for organizations

A Guide to Robust User Verification: IT Help Desk Security Read More »

FastPassCorp omtalt i IT-WATWCH vedr årsregnskab

April 11, 2024

FastPassCorp omtalt i IT-WATWCH vedr årsregnskab Kære investor, branchemediet ITWATCH interviewede Finn Jensen i anledning af årsregnskabet og Finn’s fratræden som direktør. Se hele artiklen her: https://itwatch.dk/ITNyt/Brancher/software/article16996522.ece?utm_source Da artiklen er bag et medlemslogin, så har vi her samlet nogle få afsnit fra artiklen: ………. I september 2023 blev det famøse Las Vegas-hotel MGM ramt af et

FastPassCorp omtalt i IT-WATWCH vedr årsregnskab Read More »

FN3/2024 Indkaldelse til generalforsamling

April 5, 2024

Link to: WEB Følgebrev til aktionærer 2024

FN3/2024 Indkaldelse til generalforsamling Read More »

FN2-2024 2023 FastPassCorp årsresultat

April 3, 2024

FN2-2024 2023 FastPassCorp årsresultat FastPassCorp A/S’ bestyrelse har godkendt årsregnskabet for 2023 samt gennemgået revisionsprotokollatet, og i overensstemmelse hermed offentliggøres regnskabet i vedlagte PDF. Selskabets revision har ikke givet anledning til yderligere bemærkninger. Resume Resultatet for 2023 levede ikke op til forventningerne. Det er positivt, at fakturering af løbende kontrakter øgedes og vi dermed i

FN2-2024 2023 FastPassCorp årsresultat Read More »

FastPassCorp omtalt i ITWATCH vedr FirstNorth serie

March 26, 2024

FastPassCorp omtalt i ITWATCH vedr FirstNorth serie Kære investor, branchemediet ITWATCH kører en serie om FirstNorth. I den forbindelse blev også FastPassCorp kontaktet og gav sit besyv med. https://itwatch.dk/ITNyt/Startup/article16948811.ece Da artiklen er bag et medlemslogin, så har vi her samlet citaterne fra Finn Jensen: De fremførte argumenter gør sig i større eller mindre grad også

FastPassCorp omtalt i ITWATCH vedr FirstNorth serie Read More »

Ny direktør i FastPassCorp pr 1. april

March 1, 2024

FN1/2024 Ledelsesændring FastPassCorp FastPassCorp får ny CEO (Direktør) per 1. april 2024 når Anders Meyer overtager ansvaret efter Finn Jensen. Finn Jensen har ønsket at få reduceret arbejdstiden og ansvaret efter at have passeret de 70 år og efter 15 år i spidsen for FastPassCorp. Finn fortsætter med at deltage i direkte salgs- og marketing

Ny direktør i FastPassCorp pr 1. april Read More »

Password Synchronization with Entra (Azure AD) Blog

February 21, 2024

Home » 2024 Share on Facebook Facebook Share on Linkedin Linkedin 𝕏 Share on X X Navigating the Complexities of Password Synchronization with Entra (Azure AD) Finn Jensen | Founder, FastPasscorp In the ever-evolving landscape of corporate IT, the quest for seamless user experience often leads us down the path of integration and synchronization. Entra (Azure AD), Microsoft’s

Password Synchronization with Entra (Azure AD) Blog Read More »

Help-Desk-Password-Theft-IBM-Survey-Blog

23% of Attacks Rely on Stolen Passwords – How Help Desk Password Theft is Compromising Our Cybersecurity

February 5, 2024

Home » 2024 Share on Facebook Facebook Share on Linkedin Linkedin 𝕏 Share on X X 23% of Attacks Rely on Stolen Passwords – How Help Desk Password Theft is Compromising Our Cybersecurity Finn Jensen | Founder, FastPasscorp According to the latest findings from the IBM/Ponemon 2023 survey, social engineering and stolen or compromised credentials are

23% of Attacks Rely on Stolen Passwords – How Help Desk Password Theft is Compromising Our Cybersecurity Read More »

Financial-Impact-of-Data-Breaches-IBM-2023-Report

Insights from IBM’s 2023 Report

January 29, 2024

Home » 2024 Share on Facebook Facebook Share on Linkedin Linkedin 𝕏 Share on X X Understanding the Financial Impact of Data Breaches: Insights from IBM’s 2023 Report Finn Jensen | Founder, FastPasscorp In the rapidly evolving digital world, the financial consequences of data breaches are becoming increasingly significant for businesses across the globe. The IBM-sponsored

Insights from IBM’s 2023 Report Read More »

Fortifying IT Help Desk Security with FastPass: Mastering Identity Verification

January 22, 2024

Home » 2024 Share on Facebook Facebook Share on Linkedin Linkedin 𝕏 Share on X X Fortifying IT Help Desk Security with FastPass: Mastering Identity Verification Finn Jensen | Founder, FastPasscorp Turning the Tide: Proactive Solutions to Thwart Social Engineering at Your Help Desk Picture this alarming scenario: It’s a regular day at the office, and

Fortifying IT Help Desk Security with FastPass: Mastering Identity Verification Read More »