Skip to main content
Diopter
Log inBook a demo
Red team simulationHelp desk impersonation

The call is step one of four.

Call, then an email with a link, then a document request, then a second call that refers back to the first. Most programs test step one.

Phone, Teams, RingCentral, and other voice channels.
Attack 03
We call
Your employees
As
Your own help desk
To get
Credentials

Why this one

Your staff are told to trust the help desk. Everyone calling as the help desk gets that trust for free, and a single-channel test never shows you what happens when the call is backed up by something in writing. Help desk scams often run this way.
The chain

Attackers stopped doing one-touch years ago.

The call makes the email look real. The email makes the second call look real. Each piece on its own looks normal.
One chain, four steps, three daysOnly the first is commonly tested
  1. Day 0 · 10:1401Voice

    The call

    Your help desk, about a ticket they never filed.

    Commonly tested

    Did anyone check the ticket existed?

  2. Day 0 · 10:3102Written

    The summary

    A recap of the call arrives, with a link inside it.

    Rarely tested

    Who opened the link, and who reported it?

  3. Day 1 · 09:0203Written

    The request

    A document, sent somewhere it would not normally go.

    Rarely tested

    Did anyone ask where it was going?

  4. Day 2 · 11:2004Voice

    The second call

    Refers back to the first, which is what makes it work.

    Rarely tested

    Was it questioned, given the first had landed?

Each step on its own looks ordinary. The call makes the written follow-up believable, and the written follow-up is what makes the second call work.

The call that only works because of the first one.

LiveOutbound call11:20
  1. 11:20AgentHi, it's the service desk again. Did my summary come through on Monday?
  2. 11:20StaffYeah, I saw it. Sorry, I meant to action it.the first call just paid off
  3. 11:21AgentGood. There's a re-enrollment link in it. Can we walk through it together now?answered in 0.7s
  4. 11:22StaffSure, give me a second.
The staff member authenticated us. Nobody asked who was calling, because the summary that arrived yesterday had already answered it. A test that stops at the first call never sees this happen.
You scope it. You sign it. You can stop it.

Run this one against your own team.

The first exercise is free, and you keep the readout.help desk defense on live callspricing

Run this chain free
Audio deepfake detectionAll three attacks