Attackers Target Account Recovery to Bypass Multi-Factor Authentication

Cybercriminals are increasingly targeting account recovery workflows to circumvent multi-factor authentication (MFA) protections. Instead of bypassing technical controls, threat actors are using social engineering to manipulate service desk staff into resetting credentials or authentication methods.

As organisations adopt phishing-resistant technologies such as FIDO security keys and passkeys, the difficulty of traditional credential theft increases. This shift has incentivised attackers to seek alternative routes, specifically the processes designed to help legitimate users regain access when they lose devices or credentials.

The service desk, traditionally viewed as a support function, has effectively become a critical part of an organisation’s identity security boundary. When a user cannot satisfy MFA requirements, a support agent often has the authority to reset passwords, remove existing authentication methods, or issue temporary credentials.

If the recovery process requires less verification than the initial login, the recovery path becomes the path of least resistance for an attacker.

Social Engineering Exploits Identity Recovery Processes

The hacking collective Scattered Spider has frequently utilised these tactics. Advisories from CISA and the FBI note that the group poses as employees to persuade IT and help desk staff to reset passwords or transfer MFA to devices controlled by the attackers. These actors may conduct reconnaissance via multiple calls to learn specific organisational reset procedures before attempting a takeover.

A significant real-world example occurred during a 2025 attack on Marks & Spencer. In that instance, attackers impersonated an employee to trick a third-party contractor into resetting a password. This initial breach allowed the group to compromise additional accounts and eventually deploy ransomware across the retailer’s network.

The impact of such identity-focused attacks can be catastrophic. Marks & Spencer chairman Archie Norman informed Parliament that the incident was expected to reduce profits by approximately £300 million before recovery efforts were completed.

To mitigate these risks, security experts suggest moving away from traditional, question-based verification. Simple security questions are often easily phished or guessed, providing a weak link in an otherwise robust authentication chain.

Instead, organisations are encouraged to implement high-assurance identity verification. Microsoft has already begun categorising account recovery in Entra ID as a “high-assurance” process, distinguishing it from standard help desk procedures to ensure stronger identity verification is used to re-establish trust before access is restored.

Effective defence requires integrating rigorous identity verification directly into the service desk workflow. This ensures that high-risk actions, such as unlocking accounts or resetting MFA, can only be completed after a caller has securely proven their identity through methods that cannot be easily manipulated by a social engineer.