Why do attackers call the contact center first?
Several financially motivated groups now use the phone call as their way in. Some pose as employees and call the help desk, others pose as IT support and call employees or contact center agents.
- Scattered Spider: the joint advisory by CISA, the FBI and international partners describes a group that targets large companies and their contracted IT help desks. After collecting usernames, passwords and personal details, it convinces help desk staff to reset passwords and MFA tokens and takes over the accounts in single sign-on environments. The advisory was last updated in July 2025.
- UNC6040: Google Threat Intelligence Group tracks a cluster that impersonates IT support on the phone and talks employees into authorising a modified version of the Salesforce Data Loader app, then exports CRM data for extortion. Later extortion demands used the ShinyHunters name.
- Storm-1811: Microsoft observed this group flooding inboxes with email and then calling users while posing as IT support, to get them to open a Quick Assist remote session. The intrusions led to Black Basta ransomware.
In each case a convincing caller makes a request that looks routine to someone under time pressure.
Four features of the job make contact centers and service desks efficient targets:
- Public entry point: published phone numbers lead straight to staff who can see customer records, employee accounts and reset functions.
- Pressure to help: handle-time and satisfaction targets reward resolving a request quickly, not slowing down to challenge a caller.
- Contracted support: many service desks are run by outsourcing providers, and CISA names contracted IT help desks explicitly.
- Slow reporting: when agents have to log a suspicious call by hand, the security team may learn about it only after the attacker has used the access.
Which companies were breached through a service desk or call centre?
Caesars, Clorox, Marks & Spencer and Qantas each disclosed, or alleged in court, that an attack began with social engineering of support staff or a third party acting for them.
| Company | Year | Entry point | Reported impact |
|---|---|---|---|
| Caesars Entertainment | 2023 | Social engineering attack on an outsourced IT support vendor (SEC filing) | Copy of the loyalty program database, including driver's licence and Social Security numbers |
| Clorox | 2023 | Attacker called the outsourced service desk and had passwords and MFA reset without identity checks, according to Clorox's 2025 lawsuit against Cognizant. Cognizant disputes responsibility | Clorox claims $380 million in damages |
| Marks & Spencer | 2025 | Initial entry on 17 April through impersonation involving a third party, as the chairman told MPs | Estimated £300 million hit to operating profit |
| Qantas | 2025 | Caller impersonating IT support at an outsourced contact centre, according to the Australian privacy regulator | About 5.67 million customer records compromised |
The Clorox complaint describes the calls in detail, and its claims are untested allegations in a pending lawsuit.
According to the complaint, on 11 August 2023 the caller had an employee's Okta and VPN passwords reset, then called back the same day to have the Microsoft MFA and Okta credentials reset again. The attacker then used the same approach for a second employee who worked in IT security, whose account gave privileged access to the network.
Repeat calls about the same account, and a jump from one account to a more privileged one, are patterns a service desk can watch for.
How do vishing attacks differ between contact centers and IT help desks?
Attacks on IT service desks usually aim at identity, while attacks on customer-facing contact centers usually aim at the customer data and workflows agents can reach. Both start with a convincing call, and an agent who follows the caller's instructions does the attacker's work.
| IT service desk | Customer-facing contact center | |
|---|---|---|
| Caller usually poses as | An employee, often a manager or administrator | A customer, or internal IT support |
| Typical request | Password reset, new MFA device, changed phone number for SMS codes | Account changes, disclosure of customer details, actions in the CRM |
| What the attacker gains | Access to the employee's account, then escalation to privileged accounts | Customer records, account takeover or data extraction at scale |
| Documented example | Clorox (alleged), Okta customer cases | Qantas |
The Qantas case shows the contact center version. On 28 June 2025, an agent at an overseas contact centre operated by a Qantas contractor took a call from someone presenting as "Qantas IT help". The caller walked the agent through steps in the CRM platform that were said to close an IT support ticket. Those steps connected the agent's CRM session to a data extraction tool run by the attacker, which pulled the customer profiles the agent was allowed to see.
Qantas staff spotted unusual login alerts two days later. The regulator closed its preliminary inquiries without action and noted that most social engineering training focuses on credential theft, not on inducing an employee to authorise access through legitimate system steps. The CRM provider has since changed the default setting that allowed agents to authorise third-party connections.
In the Qantas incident, the attacker did not ask for a password but persuaded the agent to authorise access through legitimate CRM functionality. Training that only covers credential requests leaves that decision untested, so simulations need to reach agents inside their actual workflows, for example a caller asking them to approve a connection in the CRM.
What happens after a help desk resets MFA?
In August 2023, Okta reported that multiple US-based customers had received calls to their IT service desks in which the caller asked staff to reset all MFA factors enrolled by highly privileged users. The intrusions followed the same sequence:
- Before calling, the attackers already had the password to a privileged account or could manipulate the delegated authentication flow through Active Directory. They asked the service desk to reset all MFA factors on that account.
- After the reset, they signed in through anonymizing proxy services from an IP address and device not previously associated with the user.
- From the compromised Super Administrator accounts, they gave other accounts higher privileges, reset the authenticators of existing administrators and in some cases removed second-factor requirements from authentication policies.
- They then set up a second identity provider under their control and connected it through inbound federation. This let them sign in to applications as other users in the organization.
Every step after the call used legitimate identity and administration features. Okta's detection guidance therefore watches for full MFA factor resets, newly created identity providers and administrator sign-ins from anonymizing proxies.
How does AI voice cloning change caller verification?
In May 2025 the FBI warned of an ongoing campaign in which criminals sent text messages and AI-generated voice messages impersonating senior US officials. The FBI noted that cloned voices can sound nearly identical to the real person and that AI-generated content is often difficult to identify.
A cloned voice of an executive or colleague takes away the informal check of whether a caller sounds right, which you can test yourself with the free voice phishing tool. The FBI's first recommendation is to research the contact, independently find a phone number for the person and call back. An independent callback helps verify identity without relying on how the caller sounds.
Which controls stop help desk social engineering?
The advisories behind these cases recommend overlapping process and identity controls:
- Stronger verification before any reset: Okta recommends strengthening help desk identity verification, including visual verification, before factors are reset.
- Extra scrutiny for privileged accounts: after the 2025 attacks on UK retailers, the NCSC asked organisations to review how the helpdesk authenticates staff before resetting passwords, especially for accounts with escalated privileges.
- Constrained help desk roles: Okta advises limiting help desk roles so they cannot reset groups of highly privileged administrators.
- Fewer standing admin rights: Okta recommends a zero-standing-privileges approach, dual authorization for just-in-time access to privileged roles and re-authentication for sensitive administrative actions.
- Phishing-resistant MFA: CISA and the FBI recommend FIDO/WebAuthn or PKI-based MFA, which resists push bombing and SIM swapping.
- Independent callback: for unusual or high-impact requests, agents call back on a number already on record, never one the caller supplies.
- Same rules for outsourced desks: the Caesars, Clorox and M&S cases all involved a third party, so contracts with support providers need the same verification rules and regular tests.
What should an agent do when a caller seems suspicious?
The steps below are practical guidance for front-line agents, built on the recommendations from the FBI, the NCSC and Okta cited above. They work as a short card at the agent's desk.
- Verify identity with the standard procedure. Use the defined verification steps for every reset or sensitive request, regardless of who the caller says they are.
- Call back on a known number. For unusual or high-impact requests, end the call and call the person back on the number in the company directory or customer record.
- Do not let urgency or authority skip a step. An executive in a hurry, an "IT ticket" that must be closed now or a threat of escalation are reasons to slow down.
- Never run steps the caller dictates in your own systems. Do not open links, install tools, approve app connections or change settings because a caller says IT needs it.
- Apply extra checks to sensitive requests. MFA resets, phone number changes, bulk data exports and changes to privileged accounts need a second check or approval.
- Report the call immediately. Use the approved reporting process, even if you already shared information before noticing something was wrong.
Why do agents need to practise refusing a convincing caller?
Most agents can recite the callback rule. Applying it is harder when handle-time targets are running, the caller sounds confident, knows the agent's name and offers a plausible reason to skip a step. Refusal becomes routine only when agents have practised it on calls that resemble real attacks.
Traditional awareness training builds knowledge of vishing, but a quiz score does not show what an agent does three minutes into a call with someone who knows their system. Realistic simulated calls record whether each agent verified the caller, refused the request and reported the call.
Counting correct refusals matters as much as counting failures. It shows the security team whether the protective habit exists on the floor, and it gives agents who refuse a convincing caller credit for doing so.
Illustrative example: Measuring the impact of vishing simulations
How can organizations measure whether their vishing training is making a difference? Let's look at a hypothetical contact center with 1,000 agents to illustrate how simulated attacks can help security teams evaluate employee behavior, identify weaknesses and track progress over time. The following figures are entirely illustrative and demonstrate how a vishing simulation program could be measured.
Of the 1,000 agents reached, 173 verified the caller and refused the request before engaging further. The remaining 827 agents continued the conversation, but that does not necessarily mean the attack was successful. 805 ultimately took a protective action, while 22 took a non-protective action. Based on these outcomes, all 827 agents who engaged with the caller would be assigned follow-up training.
The value of dedicated contact center simulation programs becomes even clearer when looking at how behavior develops across multiple campaigns. In this hypothetical example, non-protective actions decrease from 116 to 22 per 1,000 agents reached between the first and sixth campaign. Through repeated vishing simulations, organizations can track how employees respond to realistic calls, identify recurring weaknesses and assess whether protective behaviors become more consistent over time. Unlike course completion rates alone, these measurements provide insight into how agents actually handle suspicious requests.
How do you protect agents during a real call?
Training prepares agents, but on a real call the agent is still alone with the attacker. Three measures support them in that moment and turn a single refusal into protection for the whole team.
- One-click reporting: a report button in the agent desktop or softphone sends the call details to security while the attack is still running, without a manual ticket.
- Automatic triage: reports above a risk threshold go straight to the ticketing system or SOC with the call data attached, and lower-risk reports are logged without extra work for the agent.
- Warning and blocking: once a caller is flagged, other agents see a warning when the same number calls again, or the call is blocked.
In the Clorox complaint the caller came back several times on the same day, and the next agent should not have to recognise them alone.
Agents also report more readily when a report has no negative consequence for them, including when they have already shared information before noticing the attack.
How revel8 helps protect contact centers
Contact Center Protection covers both training and live-call protection. For training, security teams generate vishing scenarios by persona, voice and pretext, using cloned or scripted AI voices that match the scams agents face. The platform navigates IVR menus and DTMF prompts on its own so calls reach agents, and schedules simulations across peak, off-peak and overnight shifts for large teams without manual work. The module also tests the AI agents that increasingly handle first-line support, using current prompt-injection techniques.
For real attacks, agents report a suspicious call with a button integrated into their desktop. Automated triage forwards incidents to the ticketing system and enriches them for the SOC, and flagged callers trigger a warning to agents or a block of the call.
You can book a demo to see a simulated vishing campaign against your own service desk.
