Help desk spoofing is a social-engineering tactic where an attacker pretends to be IT support, service desk staff, or another trusted helper. The goal is to sound legitimate enough that the target lowers caution and follows unsafe instructions, such as resetting credentials, approving remote access, or sharing sensitive information. Unlike malware-based attacks, this technique depends on trust, urgency, and familiarity with normal support workflows.
It matters because support teams are often allowed to request actions that would otherwise look suspicious. Attackers exploit that authority in email, phone calls, messaging apps, and collaboration platforms. Defenders reduce the risk by requiring independent verification, using known internal channels for sensitive requests, training users to check external indicators, and limiting what support staff can ask for. Security teams also monitor help desk interactions for unusual requests, repeated credential-reset attempts, and attempts to steer users away from standard approval processes.