Fraudsters Use AI to Bypass Help Desks

A recent report confirms that threat actors are now gaining unauthorized access to corporate systems by calling help desks, posing as legitimate users, and using artificial intelligence to craft convincing requests. The technique does not rely on traditional malware but instead exploits human trust and procedural gaps.

The incidents involved several large enterprises in the United States during the first quarter of 2024. Attackers called support lines, identified themselves as employees, and used AI‑generated language to sound credible while requesting privileged credentials or remote‑access tools. In at least two cases, the help‑desk staff complied, allowing the fraudsters to enter internal networks and exfiltrate data.

The primary victims are organizations that rely on phone‑based support for internal users, especially those with loosely defined verification steps. The scam works because the callers can produce realistic details—such as recent ticket numbers or internal jargon—thanks to AI text generators that process publicly available information and any leaked data. When staff members accept the request without additional verification, the attackers obtain the same level of access they would have achieved with a sophisticated phishing email.

To reduce the risk, companies should enforce strict identity‑verification procedures for any remote‑access request, including multi‑factor authentication and a secondary confirmation channel such as a corporate messenger or face‑to‑face check. Training programs must emphasize that polite requests do not replace proper security checks. Organizations should also log and audit all privileged‑access grants, reviewing them for anomalies.

Individuals can protect themselves by being wary of unsolicited phone calls that ask for passwords or system access, even if the caller sounds knowledgeable. Use strong, unique passwords and check them with free tools like the password strength checker on ComputerScams.com. If you receive a suspicious email, run it through the free email checker on the same site before opening any links or attachments.

The report highlights that reliance on trust alone is no longer sufficient. By combining social engineering with AI, fraudsters can bypass traditional defenses and obtain direct system access.

A practical step you can take right now is to verify any request for account information or remote access by contacting the person or department through an independently sourced phone number or email address.

Source: Read the original report