Attackers stopped fighting MFA and started phoning the service desk

The awkward part of the recovery problem is that a support agent is being asked to do identity forensics with the tools of a call centre. The checks that remain common, according to the same write-up, are an employee ID, a phone number, or the name of a first pet ^[8]. Every one of those exists in writing somewhere an attacker can reach through breach data or social media ^[9]. None of them establishes that the voice on the line belongs to the person named in the record.

The joint alert describes the enrollment version of the same failure, and the mechanism is worth reading closely. It is not simply a stolen passport being replayed. Images are supplied by a third party based in another country to register the accounts, and the North Korean worker then performs the job ^[6]. The identity presented at the gate is partly real. The person who ends up holding the access is not the person who passed the check.

That distinction matters because of what the article recommends. Its remedy pairs government document scanning with biometric liveness detection, which by its own description confirms that a real, present person is completing the process rather than a static image or replayed evidence ^[2]. A cooperating accomplice in front of a camera is real and present. Liveness answers whether a live human completed the enrollment; it does not answer whether that human will be the one doing the work afterwards. The control offered is aimed at the narrower attack, and the article also carries a product pitch and a free trial for the vendor's password tooling, which is worth knowing before treating it as a threat assessment ^[10].

The numbers underneath are less flattering to authentication than they first look. The source cites Verizon's breach report finding stolen credentials involved in 44.7% of breaches ^[1]. Read the other way, 55.3% of breaches involve no stolen credential at all ^[11], and the process paths sit in that majority: the new joiner, the lost account, the factor reset, the sensitive change made on request ^[4].

Price the two ends against each other. The recovery call is cheap to attempt and Scattered Spider is described as proficient at exactly that, impersonating employees to get passwords reset ^[7]. The tactic was linked to the 2025 M&S ransomware breach, which contributed to an estimated $400 million hit to operating profit through lost sales ^[12]. The mitigation, whatever form it takes, is measured in minutes of agent time and caller friction.

The structural asymmetry is the thing to take away. Authentication is re-checked at every login. Identity is checked once, at hire, and then only under pressure, when someone is locked out and wants it fixed now. Both of the moments in this material are moments when the record is being written rather than read, and the technology companies the alert names as typical targets ^[14] are the ones most likely to have automated the reading and left the writing to people ^[5].