● Covered by 1 source · 1 reportMedium impact1 neutral
Service Desk Identity Verification Weaknesses Undermine Strong Login Security
Key points
- Service desks often use knowledge-based questions for identity verification.
- Attackers exploit this by gathering public information and using social engineering.
- Generative AI makes impersonation attacks more convincing and scalable.
- NIST guidelines no longer consider security questions acceptable for authentication.
The Identity Verification Gap
Despite heavy investments in securing employee logins with multi-factor authentication (MFA) and conditional access policies, a significant security gap exists in account recovery processes. Service desks frequently use knowledge-based questions for identity verification during password resets or account recovery, which can be easily circumvented by attackers.
Vulnerabilities of Knowledge-Based Verification
Attackers can gather extensive personal and professional information from sources like LinkedIn, company websites, and social media. This data allows them to answer verification questions accurately, impersonating legitimate employees. Successfully passing these checks can lead to unauthorized password resets or account recovery, bypassing the initial strong login security measures.
The risks associated with knowledge-based authentication are recognized by industry standards; NIST's digital identity guidelines no longer endorse security questions as an acceptable authentication method. Stolen credentials contribute to 44.7% of data breaches, highlighting the severity of this vulnerability.
AI and Social Engineering Escalating Threats
Cybercriminal groups, such as Scattered Spider, specifically target service desks. Instead of directly bypassing MFA, these groups impersonate employees to persuade service desk agents to reset passwords or register new MFA devices. The effectiveness of these social engineering attacks is amplified by generative AI, which makes impersonations more convincing and allows attackers to scale their efforts.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
Organizations often rely on knowledge-based questions for service desk identity verification, creating a security gap that bypasses stronger login protections like MFA. Attackers use publicly available information and social engineering, increasingly aided by AI, to impersonate employees and gain account access through password resets or MFA device registration. This vulnerability is significant as stolen credentials are a major factor in data breaches, and NIST guidelines no longer recommend knowledge-based authentication.