There is a real risk, but the available evidence does not show that major financial firms have been broadly or uniformly hit by IT-support scams. Federal banking regulators warn that social engineering can trick call-center and IT help-desk staff into resetting credentials. The FBI has documented attackers impersonating company IT staff, while FS-ISAC assessed that Scattered Spider likely targeted some U.S. mortgage and title-insurance companies affected by late-2023 breaches. That is a serious, specific threat—not a verified sector-wide count.
What does an IT-support scam against a company look like?
In a corporate help-desk attack, the criminal targets an employee or support worker, not necessarily a bank customer. The objective may be a password reset, access to a one-time passcode, transfer of multifactor authentication (MFA) to a device controlled by the attacker, or another change that opens a path into company systems.
As an Amazon Associate I earn from qualifying purchases.
Impersonating an employee or internal IT
The FBI and CISA’s November 2023 advisory describes Scattered Spider targeting large companies and their contracted IT help desks. The group’s documented techniques include posing as company IT or help-desk staff by phone or text message, persuading employees to run commercial remote-access tools, and asking them to share one-time passwords. A July 2025 advisory update, as summarized in FBI search results, says actors also posed as employees to persuade help-desk staff to disclose sensitive information, reset passwords, or transfer MFA to an attacker-controlled device. These are documented tactics, not proof that every institution or incident was affected.
Recommended Free Tools
Why a routine reset can become a security incident
Help desks and customer call centers can make consequential identity decisions: they may reset passwords or other credentials. Guidance from the Federal Reserve, FDIC, and OCC warns that social engineering can deceive representatives into making those changes, potentially giving an attacker access to systems, accounts, or confidential information. The risk is not limited to a sophisticated technical exploit; it can begin with a persuasive request that defeats an identity-checking process.
#1 Best Overall
- Used Book in Good Condition
What is known about financial firms being targeted?
FS-ISAC’s 2024 threat review assessed with high probability that Scattered Spider targeted U.S. mortgage and title-insurance victims of late-2023 breaches. This is an attributed assessment about a defined group of victims and period. It does not establish how many financial firms have faced help-desk impersonation, what share of the sector has been affected, or that all major financial firms are exposed in the same way.
The available official material does not provide a verified current prevalence statistic for IT-support impersonation at major financial firms. It supports treating credential resets and support workflows as meaningful attack surfaces, but not describing the problem as a measured, sector-wide wave.
Rank #2
- Updated Compliance: While the new rule takes effect on 7/19/2024, training and compliance dates don’t start until 1/19/2026, giving your team ample time to prepare with this thorough guide to OSHA regulations (29 CFR 1910.1200(j)).
- Comprehensive Safety Training Handbook: Prepares your employees for 25 of OSHA’s hottest safety topics, from Confined Space Entry to Workplace Violence, ensuring they are equipped with vital safety knowledge for a safer work environment.
- In-Depth, Easy-to-Understand Content: Each chapter tackles key workplace hazards like Electrical Safety, Lockout/Tagout, Respiratory Protection, and more, helping to prevent injuries and illnesses while promoting safe practices.
- Interactive Learning with Quizzes: Engaging chapter review quizzes reinforce safety concepts, making it easier for employees to retain and apply the knowledge, with downloadable answer keys for easy tracking.
- Specifications: English, Softbound, full-color pages (272 pages) offer clear, visually appealing safety information for a diverse workforce, with home safety details included throughout.
How corporate help-desk attacks differ from consumer tech-support fraud
Both patterns use impersonation, but they target different people and seek different outcomes. A corporate intrusion can begin with an attacker posing as an employee or internal IT worker to manipulate a help desk. In a consumer scam, the criminal may first pose as technology support, gain remote access to an individual’s device, then impersonate a financial institution or fraud representative and pressure the victim to move money. The consumer cases described by the FBI do not establish that the financial companies impersonated were breached.
| Pattern | Who is targeted | Impersonated role | Access or harm sought | Source basis |
|---|---|---|---|---|
| Corporate help-desk social engineering | Employees, internal IT help desks, or customer call-center staff | Company employee or internal IT/help-desk staff | Credential resets, MFA changes, access to systems, accounts, or confidential information | Federal Reserve, FDIC, and OCC guidance; FBI/CISA advisory |
| Consumer tech-support fraud | Individual consumers | Technology support, followed in some cases by a purported financial or fraud representative | Remote device access and induced transfers to supposed safe accounts or wallets | FBI Boston Division warning, October 2022 |
Other financial-sector fraud is related, but not the same attack
FS-ISAC’s 2024 review also describes customer-call-center vishing and account-takeover attempts, business-email scams involving executive impersonation, invoice and payroll diversion, and smishing that impersonates financial institutions. These are distinct forms of social engineering and fraud; they should not all be counted as corporate IT-help-desk breaches.
What do the consumer tech-support scam figures show?
FBI Boston’s October 2022 warning, citing IC3 data, reported that 23,903 people nationwide said they lost more than $347 million to tech-support scams in 2021. Reported losses were 137% higher than in 2020. Almost 60% of victims reported being over 60, and that group experienced 68% of the cited losses.
Those are historical reports about consumer tech-support scams, not current figures and not a count of financial-firm breaches. The same FBI Boston release described individual cases with reported losses of $1.1 million, approximately $1 million, and $200,000. They are examples, not a representative sample of typical losses or evidence that a named financial company was breached.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How can financial firms reduce help-desk impersonation risk?
The Federal Reserve, FDIC, and OCC call for risk assessment, secure processes, employee training, effective controls, and identity verification. The FBI and CISA also recommend phishing-resistant MFA and other mitigations for Scattered Spider activity.
Build verification into resets and access changes
- Assess identity and access workflows across internal IT help desks, customer call centers, remote access, and third-party access.
- Set secure procedures and effective controls for password and MFA resets. A request that sounds urgent should not bypass identity verification.
- Train support staff to recognize social engineering and phishing, follow verification procedures, and report suspicious requests promptly. FBI guidance recommends help-desk education using real examples and immediate reporting protocols.
Strengthen authentication and monitoring
- Monitor for suspicious logins and refine MFA controls. FBI guidance advises against email-based MFA; the joint advisory recommends enabling and enforcing phishing-resistant MFA.
- A FIDO2-compatible hardware security key is one possible physical way to implement phishing-resistant MFA, but the cited guidance does not endorse a particular key or model. A key does not prevent an attacker from exploiting weak reset procedures or persuading staff to transfer authentication to an attacker-controlled device.
- Maintain offline backups and use application controls as part of the FBI/CISA mitigations.
What should consumers do if a fake support agent contacts them?
- Do not give an unsolicited caller or message your password, PIN, or one-time code. Independently contact your financial institution using a verified number, such as the one printed on your bank card.
- Do not install remote-access software because an unknown caller or pop-up tells you to. Do not trust a phone number displayed in an unexpected pop-up.
- If you may have granted remote access or your money or account may be at risk, contact your financial institution immediately.
FBI Boston’s October 2022 warning put the principle plainly: “Legitimate customer and tech support representatives will never initiate unsolicited contact with customers.”
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
