Help Desk Scam: Types, Examples & Prevention Tips

A help desk scam targets people with fake technical problems and support offers. The FBI reported $2.13 billion in losses from Tech/Customer Support scams in 2025, placing them third among cyber-enabled fraud categories by reported losses. Continue reading this article to learn more about help desk scams, how it works and how you can prevent them.

What Is a Help Desk Scam?

In these attacks, cybercriminals impersonate trusted IT or support staff to persuade employees to reveal credentials or provide access to company systems. A help desk attack uses phone calls, phishing emails, or text messages to look legitimate.

A service desk attack specifically targets an organization and its employees. Attackers may impersonate the internal IT team or exploit support procedures to gain access to business accounts, systems or sensitive data.

This is different from a tech support scam, which typically targets individuals. In those scams, criminals may pretend to be from a well-known technology or software company and claim that the victim’s personal computer or device has a problem that needs to be fixed.

How Does a Help Desk Scam Work?

In a help desk attack, also known as a service desk attack, the attacker uses the situation to build trust and gradually push the support team to relax its usual security checks.

1. Target Identified: The attacker first identifies an employee, account or support process that could provide useful access. They may use publicly available information to make the request appear more credible.
2. Impersonated: The attacker poses as a genuine employee, contractor or authorized user. They may use familiar names, job titles or technical language.
3. Something is Locked and Urgent: A locked account, security alert or deadline makes the request seem time-sensitive.
4. Verification Steps Are Resisted: They push back on identity checks, claiming there is no time for the usual process.
5. Credentials or Access Requested: The attacker asks for a password reset, MFA bypass, credentials or remote access.
6. Access Obtained: If the support agent accepts the request without completing the required checks, the attacker gains the access they were trying to obtain.
7. Systems Compromised: The attacker can then use that foothold to access accounts, devices, data or other parts of the network.

Types of Help Desk Scams

Attackers may use calls, messages, fake support channels or even AI to make their approach more convincing.

Vishing Help Desk Scams

A vishing help desk scam begins with a phone call that sounds like a routine IT support interaction. The caller may pose as a help desk employee, use a spoofed number or mimic a familiar voice to gain trust.

For example, in a traveler help desk scam, an attacker pretends to assist an employee with a locked account while they are traveling. Then they create a scenario and ask for credentials or remote access.

Help Desk Email Scams

A help desk email scam uses a convincing message to make an employee believe they are receiving support from a legitimate IT team. The email may warn about a locked account, security issue or software problem and include a link to a fake support page.

For example, an employee may receive an email saying their company account will be suspended unless they “verify” it through a support link. The page could steal their login details or download malware onto their device.

Help Desk Spoofing

Help desk spoofing makes a fake support request look like it came from a real IT team or trusted service provider. Unlike a help desk email scam that uses a deceptive email to lure the victim, spoofing focuses on forging or manipulating the request.

For example, an attacker may spoof an internal IT support phone number so that it appears on an employee’s caller ID as the company’s genuine help desk. The attacker may then ask for remote access or send a link to a fake support page to collect login or payment details.

Internal Help Desk Impersonation

Attackers pose as a company’s IT support team to make employees believe they are receiving genuine help.

For example, after flooding an employee’s inbox with spam, a scammer could send a Teams message claiming to be from IT and offering to fix the issue. If the employee shares credentials or access, these scams and identity theft help desk attacks can put company accounts and data at risk.

Real-Life Example: Hackers Impersonate IT Support to Breach Financial Companies

A recent case tracked by the Google Threat Intelligence Group (GTIG) shows just how easily a help desk spoofing attack can happen. GTIG has been tracking UNC6671, a threat actor, using voice phishing to target employees of financial companies. This has targeted companies in financial services and other enterprises.

Here is how the service desk attack was initiated:

1. The attackers called employees on their personal mobile numbers while pretending to be IT help desk staff.
2. They spoofed the organization’s legitimate help desk number, making the call harder to question.
3. The caller then created a sense of urgency, claiming the employee needed to complete a mandatory security change by enabling a FIDO2 passkey or updating multi-factor authentication (MFA).
4. The next step was equally convincing. Victims were directed to lookalike websites designed to capture their credentials and MFA information.
5. GTIG says UNC6671 used Adversary-in-the-Middle infrastructure to intercept credentials and MFA information. In some cases, attackers could use the captured session to take over the account.
6. Once access was established, the attackers could maintain account access and target enterprise cloud services.

The key lesson: A familiar caller ID, a convincing IT employee or an urgent security request does not prove that a help desk request is genuine. The UNC6671 case shows why employees should be cautious when a help desk request involves FIDO2 passkeys, MFA enrollment or changes to account security. These requests should be verified through a trusted internal channel before taking any action.

Also read: Caller ID Spoofing: How Fraudsters Impersonate Banks

Warning Signs in a Help Desk Scam

In a help desk scam, there are certain signs that will help you verify the request:

• Unexpected IT Contact: Be cautious if someone contacts you about a technical issue you never reported.
• Pressure to Act Quickly: Claims that your account will be locked or access will be lost unless you act immediately are common tactics.
• Requests for Passwords or MFA codes: Legitimate support teams do not ask to share your password or multi-factor authentication (MFA) codes.
• Download Software or Click Links: Be wary of anyone asking to install software or approve remote access without following your organization’s usual process.
• Caller or Email Address Looks Strange: Check the caller’s identity and email address carefully. It is very easy to overlook small spelling changes in domains.
• Resistance to Verification: The attacker may avoid normal identity checks or discourage you from confirming their request.
• Conversation Feels Off: Awkward wording or unfamiliar processes can signal a customer support attack.

How to Prevent Help Desk Scams

Here are a few ways you can prevent help desk scams:

Verify Identity Before Taking Any Action

Ask for a support ticket number and confirm the request through a trusted internal channel. To reset passwords, change MFA and recover accounts, IT teams should carry out stronger identity checks before making any changes.

Restrict Remote Access and Privileged Actions

Use only approved remote-support tools and limit sensitive actions to authorized staff. Following the principle of least privilege also means that a compromised account has fewer systems and resources within reach.

Train Teams to Challenge Unusual Requests

Employees should pause when an unexpected IT request feels unusual and ask questions before taking any action. Regular training can help them recognize tactics, credential requests and attempts to skip standard procedures.

Use AI Tools to Analyze Suspicious Support Interactions

AI tools can provide an additional layer of help desk defense by analyzing support interactions for suspicious patterns and social engineering signals. These tools may highlight unusual behavior during or after a conversation. This may in turn, help security teams investigate risky interactions before they develop into something bigger.

How Diopter Helps Detect AI-Driven Help Desk Impersonation

A convincing caller can make a help desk scam surprisingly hard to spot. An attacker may sound like a genuine employee, as they know enough about the organization to seem credible and use pressure to get a quick response.

Diopter strengthens defenses by analyzing live support interactions in real time for AI-generated or cloned voices and patterns of social engineering. This helps teams detect a help desk spoofing attack early, flag suspicious interactions and respond before an attacker can gain access to sensitive information.

Conclusion

A help desk scam works because attackers know that the philosophy of support teams is built to provide help quickly. Strong verification, employee awareness and smarter detection can make it harder for an impersonator to turn trust into access.

As AI makes fake voices and convincing pretexts easier to create, organizations need defenses that can keep pace. Diopter AI helps security teams identify suspicious voice and behavioral signals while interactions are still happening.

Frequently Asked Questions