iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Scammers have impersonated company IT staff to trick employees and help desks into resetting passwords, sharing one-time codes or granting access. Financial-sector regulators recognize call-center and help-desk credential resets as a security risk, and FS-ISAC assessed that Scattered Spider likely targeted some U.S. mortgage and title-insurance companies affected by late-2023 breaches. But the available evidence does not show that major financial firms broadly—or all firms in the sector—have been hit.
What the evidence says about financial-firm IT support scams
The documented risk is a method of gaining access, not a verified sector-wide count. The Federal Reserve, FDIC and OCC warn that threat actors have used social engineering to deceive customer call-center and IT help-desk representatives into resetting passwords or other credentials. A successful reset could expose systems, accounts or confidential information.
In its 2024 annual threat review, FS-ISAC assessed with high probability that Scattered Spider targeted U.S. mortgage and title-insurance victims of breaches in late 2023. That is an attributed assessment about those victims—not evidence that the group, or this technique, affected every major financial institution. The sources available here do not establish how many major financial firms have faced IT-support impersonation.
Recommended Free Tools
The FBI and CISA’s November 2023 advisory describes Scattered Spider targeting large companies and their contracted IT help desks. Its documented techniques include posing as company IT or help-desk staff by phone or text, inducing employees to run commercial remote-access tools, and persuading them to reveal one-time passwords. These are documented tactics; they do not prove that every company or incident was affected.
How a company help-desk attack can work
- Impersonate a trusted person. An attacker contacts an employee or help desk while posing as a colleague, company employee or IT worker. Phone calls and text messages can make the request feel urgent and routine.
- Exploit the support workflow. The attacker tries to persuade staff to disclose a one-time code, reset a password, change multifactor authentication (MFA), or run remote-access software. The FBI/CISA advisory documents these approaches.
- Use the new access. A reset or transferred MFA factor may let the attacker enter an account or system. The Federal Reserve, FDIC and OCC warn that compromised credentials can expose systems, accounts or confidential information; the result depends on the access granted and the controls in place.
- Turn access into further harm. Financial-sector threat reporting also describes separate social-engineering activity, including account-takeover attempts, executive impersonation, invoice and payroll diversion, and text messages impersonating financial institutions. Those categories are related to the broader fraud landscape, but should not be treated as proof that each is part of the same help-desk intrusion.
Corporate help-desk intrusions and consumer tech-support fraud are different
A scammer pretending to be internal IT and a scammer posing as consumer tech support may both rely on deception, but the target, access sought and likely response differ. FBI Boston described consumer cases in which an unsolicited tech-support contact led victims to install remote-access software, followed by a second impersonation: someone claiming to represent a financial institution or fraud department and urging the victim to move money to a supposed safe account or wallet.
| Pattern | Who is targeted | Impersonated role | What the scammer seeks | Useful response |
|---|---|---|---|---|
| Corporate help-desk impersonation | Employees, IT help desks or customer call-center staff | A company employee or internal IT/support worker | Credential disclosure, a password or MFA reset, remote access, or entry to company systems | Use established identity-verification and reset procedures; report suspicious requests promptly. |
| Consumer tech-support fraud | An individual and their device or financial account | External technology support, followed by a purported bank or fraud representative | Remote access to the device and a money transfer induced by a false safety claim | Do not install remote-access software at an unknown caller’s direction; contact the institution independently. |
FBI Boston reported examples of consumer losses of $1.1 million, approximately $1 million and $200,000. These are individual reported cases, not a representative sample and not evidence that the financial firms named or impersonated were breached.
What the consumer-scam statistics do—and do not—show
FBI Boston’s October 2022 warning, attributing figures to the FBI’s Internet Crime Complaint Center (IC3), said that 23,903 people reported losing more than $347 million to tech-support scams nationwide in 2021. Reported losses were 137% higher than in 2020. In those same cited 2021 figures, almost 60% of victims reported being over 60, and that group experienced 68% of losses.
Those figures describe historical consumer tech-support scam reports. They are not current totals, a count of corporate intrusions, or a measure of how many financial firms were affected by help-desk impersonation.
How organizations can reduce help-desk reset risk
Interagency guidance from the Federal Reserve, FDIC and OCC points organizations toward risk assessment, secure processes, staff training, effective controls and identity verification. Apply those principles to the workflows attackers may try to exploit:
- Review identity and access workflows. Assess customer call centers, internal IT help desks, remote access and third-party access. Identify how staff verify a requester before changing credentials or MFA.
- Make resets hard to socially engineer. Define secure password and MFA reset procedures, use effective controls, and require staff to follow them even when a request seems urgent or comes from someone claiming to be an employee.
- Train support staff to recognize and report manipulation. FBI guidance recommends educating help-desk staff with real examples and establishing immediate reporting protocols. Include phishing and verification procedures in that training.
- Strengthen authentication and monitoring. FBI guidance advises against email-based MFA. The joint FBI/CISA advisory recommends enabling and enforcing phishing-resistant MFA. Monitor suspicious logins as part of the response to attempted or successful credential compromise.
- Prepare recovery controls. FBI/CISA lists offline backups and application controls among Scattered Spider mitigations. These help address broader intrusion and recovery risks; they do not replace secure identity checks at the help desk.
A FIDO2-compatible hardware security key is one possible way to implement phishing-resistant MFA, but the advisory recommends the protection rather than endorsing a particular key or product. A key also cannot fix an unsafe reset process or prevent staff from being deceived into changing account access.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What individuals should do if someone claiming to be support contacts them
- Do not give an unsolicited caller or message your password, PIN or one-time code.
- Do not install remote-access software because an unknown contact or pop-up tells you to.
- Do not use a phone number supplied in a pop-up or unsolicited message. Contact the institution independently using a verified number, such as the number printed on your bank card.
- If you installed remote-access software or think an account or money may be compromised, contact your financial institution immediately.
The FBI Boston Division’s warning is direct: “Legitimate customer and tech support representatives will never initiate unsolicited contact with customers.” Treat an unexpected support call or message as a reason to verify independently, not as proof that the person is who they claim to be.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
