The Fake Password Reset Call: How Attackers Talk Their Way Into Your Accounts

If you run a small business in Monterey County or anywhere else on the Central Coast, someone on your team resets a password most weeks. Attackers know that routine is a door. They call, sound stressed, and ask for help getting back in.

This guide covers how the fake password reset call works, why it succeeds, and the simple rules that shut it down.

1. How the fake reset call works

The caller pretends to be an employee, often a manager or someone who is traveling. They claim a phone broke, a laptop is lost, or a code never arrived. The ask is always the same: reset my access now.

• They do their homework first. Names, titles, and org charts come from your website, LinkedIn, and old breach data. The details make the story believable.
• They create urgency. "I'm about to present to a client" is a classic. Urgency is meant to make you skip the check.
• They target the weakest link. That may be an outsourced help desk, a new hire, or the front desk. Similar tactics show up in voice phishing and in help desk impersonation campaigns.
• Voice cloning makes it worse. A cloned voice can sound like your boss, as covered in our post on voice clone fraud.

2. Why it works, and why MFA alone does not save you

Multi-factor authentication protects against a stolen password. It does not protect against a person who is willing to reset it for the attacker.

• The reset is the bypass. If a help desk agent removes your MFA method and enrolls a new phone, the attacker now holds a trusted device.
• Weak questions fail. Birthdays, addresses, and a manager's name can all be found online. Treat them as information, not proof.
• Caller ID proves nothing. Numbers are easy to spoof, and a text from "the CEO" is only a text.
• Helpfulness is the vulnerability. Good people want to unblock a coworker. A written rule gives them permission to say no.

3. A verification routine that stops it

You do not need new software. You need a short rule that everyone, including the owner, follows every time.

• Call back on a known number. Use the directory or HR record. If the person cannot be reached, the reset waits.
• Add a second approver for high-risk changes. MFA resets, new devices, and admin accounts need a manager to confirm through a separate channel.
• Reset in person or on video when possible. For remote staff, a short video call with a known face beats a phone call.
• Limit who can reset. Keep admin rights narrow, as described in our guide to privileged access.
• Move toward phishing-resistant sign-in. Passkeys and security keys reduce how often resets are needed, and a break-glass admin account keeps real emergencies manageable.
• Watch for the aftermath. Alert on new MFA methods and check for a hidden forwarding rule. If someone fell for it, follow the steps for when a staff member clicks a phishing link.

The takeaway

A fake reset call works because it asks a helpful person to skip a step. Make the step non-negotiable: call back, get a second approval, and log it. If you want a written reset procedure and tighter sign-in controls, see our cybersecurity and managed IT services, or check current pricing.

Frequently asked questions

What is a help desk password reset scam?

An attacker phones or messages your IT help desk, or an employee, pretending to be a staff member who is locked out. The goal is to get a password or multi-factor authentication method reset so they can sign in as that person.

How do attackers know enough to sound real?

They gather names, job titles, and phone numbers from LinkedIn, your website, and earlier data breaches. A caller who knows your manager's name and your office location sounds legitimate, but none of that proves identity.

How should a small business verify a password reset request?

Call the employee back on a number already on file, or have a manager confirm the request through a separate channel. Never rely on caller ID, a text from an unknown number, or answers to questions that can be looked up online.

Should we reset multi-factor authentication over the phone?

Treat a request to reset or add an MFA method as higher risk than a password reset. Require the same call-back check plus a second approval, because it hands the attacker a trusted device.

What if the attacker is already inside after a reset?

Reset the password again from a trusted device, sign out of all sessions, remove unknown MFA methods and mail forwarding rules, and tell your IT provider right away so sign-in logs can be reviewed.

Prefer to talk first? Email sales@ghosxt.com or call (831) 204-0501.