Hi, I’m Locked Out

“Hi, I’m locked out of my account.” 

It’s 8:47 on a Monday morning. The service desk is already busy and tickets are building. Teams notifications are firing across multiple screens, and the phone hasn’t stopped ringing since people started logging on. 

The caller sounds frustrated, but polite. They’ve just changed their mobile device and now can’t access Microsoft Authenticator. They explain they’ve got an important customer meeting later this morning, and they’re keen to get everything sorted before it starts. 

They know who they report to and mention a project they both been working on, referencing colleagues by name as they chat. Nothing about the conversation feels unusual. 

In fact, it feels exactly like the sort of call a service desk analyst might handle dozens of times each week. 

The only problem is that the caller isn’t an employee. 

They’re an attacker. 

By the time anyone realises that, the conversation is already over. 

The mistake 

Many organisations still picture cyber-attacks as highly technical operations carried out by people hunting for software vulnerabilities and probing security controls. That image persists because it’s familiar, and because technology is where many cyber discussions naturally gravitate. Board conversations focus on tools, security teams discuss platforms and controls, and vendors compete to demonstrate ever more advanced, futuristic capabilities. 

Attackers, however, are often looking at the same environment and reaching a very different conclusion. Rather than asking how to defeat a security control, they’re asking who can be persuaded to bypass it. 

See, that’s where many organisations become vulnerable. Significant investment goes into identity security, detection platforms, endpoint protection, conditional access policies, and monitoring tools (and rightly so), yet the processes surrounding identity verification don’t always receive the same attention.  

Too often, account recovery processes rely on information that attackers can find with enough curiosity and an internet connection. Names, job titles, departments, managers, mobile numbers. None of it is particularly difficult to obtain. If those details are enough to convince someone they’re speaking to a legitimate employee, then we’ve accidentally turned reconnaissance into authentication. 

Many organisations have become exceptionally good at protecting technology – protecting the human processes that sit around that technology, now that’s a different story. That’s why attackers aren’t always interested in defeating security controls. They’re interested in finding somebody who can be persuaded to sidestep them. 

The reality 

This is why social engineering remains such a stubbornly effective attack technique. Attackers don’t need a mole inside your organisation when so much intelligence is already available in plain sight. LinkedIn profiles reveal reporting structures, company announcements highlight projects and priorities, and social media fills in the gaps.  

By the time an attacker picks up the phone, they’re rarely making it up as they go along. They’ve already built a version of the truth that’s believable enough to survive scrutiny and convincing enough to pass as routine. They know which details establish credibility, which situations create urgency, and which requests are most likely to be viewed as reasonable. More importantly, they understand the mindset of the person they’re targeting. Service desk analysts are there to help people solve problems and keep work moving, and attackers are perfectly happy to take advantage of that instinct. 

This is where many organisations end up fighting the wrong battle. While defenders are busy discussing the latest controls, attackers are studying help desk procedures, account recovery processes, and the ways people behave when they’re under pressure. Technology still matters, of course, but the quickest route into a business isn’t always through a vulnerability. Sometimes it’s through a perfectly legitimate process being used in a perfectly illegitimate way. 

Detection, monitoring, and response capabilities remain essential, but none of them are designed to stop a trusted employee willingly opening a door for somebody who appears legitimate. 

The uncomfortable question 

Here’s the question every organisation should ask itself: would your service desk know the difference between a genuine employee and a well-prepared attacker? 

It’s a difficult question because most organisations instinctively answer “yes”. They trust their processes, they trust their people, and they believe suspicious behaviour would be recognised if it appeared. Underpinning all of this is an assumption that common sense will prevail when something doesn’t feel right. Attackers understand that confidence and build their approach around it. 

The challenge isn’t identifying an obviously malicious caller claiming to be the Chief Executive while speaking from a noisy internet café. Most organisations would spot that immediately. The real challenge is identifying the caller who sounds entirely credible because they’ve invested time in understanding the organisation, learning how it operates, and gathering enough information to blend in. They know who reports to whom, understand the language people use internally, and create just enough urgency to encourage somebody to make an exception or speed up a process. 

More often than not, security failures arrive disguised as routine requests from somebody who sounds stressed, frustrated, and desperate to get back to work. In that moment, the service desk is presented with what appears to be a genuine colleague asking for help. 

What good looks like 

Organisations don’t have to choose between security and customer service. Users still expect quick resolutions, positive experiences, and support teams that can solve problems efficiently. It’s about ensuring those outcomes are underpinned by robust identity verification processes that remain consistent – even when circumstances feel urgent or unusual. 

Achieving this starts with recognising that service desks form part of the security perimeter. Every account recovery request, MFA reset, and access-related interaction carries an element of risk, which means verification processes need to be applied consistently regardless of who is making the request or how urgent the situation appears to be. Security controls that disappear when somebody sounds senior or claims they’re under pressure aren’t really controls at all. 

Furthermore, it means giving frontline teams the confidence and authority to challenge requests when something doesn’t feel right. Many organisations talk about creating a “security culture”, but culture is only meaningful when service desk analysts know they will be supported for following the process, even if that means slowing things down or refusing the odd request. Attackers only succeed when they find moments where trust outweighs verification and truly resilient organisations ensure verification remains part of the conversation (even when the request appears entirely reasonable). 

Ultimately, identity has become one of the most important battlegrounds in cyber security. Organisations that recognise this understand that their service desk isn’t just a support function.  

A final thought  

The phrase “Hi, I’m locked out” sounds harmless and most of the time, it is. 

Yet, hidden inside that seemingly ordinary request is a lesson many organisations are still learning: attackers don’t always need to break in. Sometimes they’re invited. 

Every organisation has gatekeepers. They’re the people answering calls, resetting passwords, verifying identities, and helping users get back to work. When we think about cyber resilience, those people deserve far more attention than they typically receive. 

If this article has prompted a few uncomfortable questions about your own account recovery processes, that’s probably a good thing! If you’d like to explore how your service desk, identity processes, and security controls stand up to real-world social engineering tactics, we’d be happy to start a conversation.