A major UK retailer loses control of its systems for weeks. An insurance carrier’s customer files walk out the door. A well-known casino operator pays millions to get its own network back. None of these incidents started with clever malware or an unpatched server sitting exposed online. They started with a phone call.
In each case, the attacker didn’t break anything technical. They called the help desk, sounded like they belonged there, and asked for a password reset or a new multi-factor device. That’s it. No exploit, no malware, just a confident voice and a target who wasn’t trained to say no.
Voice Phishing Is Having a Moment, and Not a Good One
According to CrowdStrike’s 2026 Threat Hunting Report, voice phishing, known as vishing, rose 134 percent from 2024 to 2025. It then roughly doubled again between the second half of 2025 and the first half of 2026. Adam Meyers, CrowdStrike’s head of counter adversary operations, summed up why during a briefing this summer: targeting people, specifically the help desk, is simply more effective than targeting the technology.
The report includes one case that shows how fast this moves. A group CrowdStrike tracks as Cordial Spider called a company’s help desk, talked its way into a password reset, and registered a new MFA device, all in about four minutes. The business caught it and cut off access twelve minutes later. Twelve minutes sounds quick. It’s still more than enough time for a lot of damage once someone’s inside.
Why This Isn’t Just a Big-Company Problem
It’s tempting to read those headlines and assume this only happens to retailers with call centers and household names. It doesn’t. Smaller businesses are arguably easier targets, not harder ones. A lot of SMB help desks, whether in-house or outsourced, don’t have a documented process for verifying who’s actually on the phone before resetting a password or re-enrolling MFA. The attacker doesn’t need your firewall rules, they need your help desk’s trust, and that’s usually the thinner line of defense.
Attackers also know that smaller teams move fast and hate making callers wait. That instinct, the one that makes for good customer service, is exactly what a social engineer is counting on.
Cyber insurance underwriters have started catching up to this, too. Renewal applications increasingly ask whether a business has a documented identity verification process for help desk resets, not just whether it has MFA turned on. A business that can’t answer that question with anything more than “we trust our team” is going to have a harder time at renewal, and a much harder time explaining the gap after an incident.
What Actually Stops a Convincing Phone Call
Technology alone won’t fix this. The businesses that hold up under this kind of pressure tend to have a few things in common:
- A callback policy that verifies the caller using a number already on file, not one the caller provides
- A second person’s sign-off before any password reset or MFA change tied to sensitive systems or financial access
- Phishing-resistant MFA, like a hardware key or authenticator app, instead of SMS codes or simple push approvals that can be talked through
- Logging and alerts on new device enrollments, especially from unfamiliar locations
If your help desk doesn’t have that first item written down anywhere, that’s the place to start. This is identity governance work, and it belongs inside a modern security stack, not bolted on after something goes wrong.
Common Questions About Vishing and Help Desk Security
What is vishing?
Vishing is voice phishing. An attacker phones an employee or the help desk, poses as a coworker or executive, and talks their way into a password reset, a new MFA device or sensitive information. No malware is involved. Just a convincing story told with confidence.
How should a help desk verify who’s calling?
Call the person back on a number already in your records, never one the caller supplies. For resets that touch financial systems or admin accounts, require a second approver before anything changes.
Does MFA stop vishing attacks?
Not by itself. If an attacker persuades the help desk to register a new MFA device, that protection now works for them. Phishing-resistant methods like hardware keys help, but the verification process at the help desk matters just as much.
Are small businesses really being targeted?
Yes. Smaller help desks often have no written verification steps and a strong instinct to help quickly, and that combination is exactly what social engineers look for.
Cloud9 Tech Solutions works with businesses across Massachusetts who assumed a phone call wasn’t a real attack surface, right up until it was. The fix isn’t complicated, but it does need to be deliberate. Schedule a free security assessment with Cloud9, and we’ll walk through exactly what your help desk process looks like today and where it needs to tighten up.