The password started with “Welcome”

In August 2023, according to a lawsuit Clorox later filed, someone called its outsourced IT help desk. The exchange, as quoted in the complaint, went like this:

Clorox says the agent then reset the caller’s MFA several times and reset the phone number used for text-message codes. Weeks of disruption followed, and Clorox is now suing for $380 million. Cognizant disputes the claims, and a court will sort out who was responsible.

We want to focus on something else. Read the transcript again. The agent isn’t careless or malicious. They’re being helpful, which is exactly what a help desk is built and measured to do.

This keeps happening

Clorox isn’t an outlier. MGM reported a roughly $100 million hit in 2023 from an attack the hackers say began with a help desk call. In 2025, M&S estimated a roughly £300 million hit to profit from an attack that began with attackers impersonating an employee, reportedly to get a password reset. This September, researchers tracked a campaign where callers posing as IT talked executives into fake “passkey” portals and took over their accounts.

The pattern is always the same. A convincing voice, a believable story, and a reset.

Why better scripts don’t fix it

Most help desks verify callers with something the caller knows: an employee ID, a manager’s name, a birth date. All of that is on LinkedIn or in a breach dump. Attackers even make practice calls to learn how your reset process works.

Sending a code to the user’s phone helps, until the caller says the phone is lost. That’s the fallback, and it’s the path attackers choose. A voice that “sounds right” proves nothing anymore; a few seconds of audio can be enough to clone one.

Under every one of these checks sits the same design flaw. A person on a phone call decides whether to trust another person on a phone call, under time pressure, while being measured on how fast they unblock people.

Take the decision off the agent

We think the fix is structural, not motivational.

1. Gate the ticket. A password or MFA reset can’t be completed until the caller passes identity verification: a live selfie, an ID check when policy calls for it, matched to the directory. The agent doesn’t decide. The policy does.
2. Decide the failure path in advance. If the caller can’t verify, the next step is set by security ahead of time: in-person check, escalation, or a block. No improvising on the call.
3. Score the fallbacks. A flow is only as strong as its weakest fallback. Know which path an attacker would pick before they pick it.
4. Remove the password. If employees sign in passwordless, there is no “Welcome…” for anyone to read out. Most reset calls never happen.

Your help desk agents want to help. Let them. Just stop asking them to be the security control.

TruU Identity Verification gates help desk resets on verified identity, works with the proofing vendor you already use, and flows straight into passwordless sign-in. Book a Demo.

Frequently asked questions